Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 09:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
32638d56ee0dd78a6e480813d334e84f7ea5a45e855abf0567646c0227b9ba9dN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
32638d56ee0dd78a6e480813d334e84f7ea5a45e855abf0567646c0227b9ba9dN.exe
-
Size
455KB
-
MD5
eddf5278334f62a134bd4ab6d6c2c7f0
-
SHA1
be691a82e0e5909e2f2cc6a57189138d16d1f4d8
-
SHA256
32638d56ee0dd78a6e480813d334e84f7ea5a45e855abf0567646c0227b9ba9d
-
SHA512
d29aa8d6b78bf91b18eef52aaeaa8d4995518ae3b856f51eddc8276da07b0f7f53eb12fcf6a5869715e375bfe30cd244acf828da76eb1f2914e7b8049569321f
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeZ:q7Tc2NYHUrAwfMp3CDZ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 57 IoCs
resource yara_rule behavioral1/memory/2500-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2868-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-64-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2872-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-80-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2628-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/992-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1348-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1152-121-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1720-139-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/840-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2196-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1200-209-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1200-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1404-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-247-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2424-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/344-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2072-272-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2072-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-302-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2508-328-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2772-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-355-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/2988-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1764-389-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1764-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1868-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1764-410-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2400-413-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2400-418-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1428-428-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/764-446-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/764-465-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/812-472-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2756-587-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-606-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2436-613-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-633-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-652-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2644-670-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1684-747-0x00000000001C0000-0x00000000001EA000-memory.dmp family_blackmoon behavioral1/memory/1336-760-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-817-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2660-842-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2580-912-0x00000000001C0000-0x00000000001EA000-memory.dmp family_blackmoon behavioral1/memory/1696-1026-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1200-1033-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1200-1052-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1596-1059-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2656 llxlfrr.exe 2996 xfxfxlf.exe 2868 djpdv.exe 2724 jpdpp.exe 2908 9nhhtt.exe 2872 ddjpv.exe 2844 9xrfxxr.exe 2744 pvvjj.exe 2596 tnnhtt.exe 2628 5jvdd.exe 992 5nntht.exe 1152 jppvv.exe 1348 bbttht.exe 1720 ddjdv.exe 1216 hbthbh.exe 1544 ddpdd.exe 2504 bhttnn.exe 840 jdvvj.exe 2196 3btbtb.exe 1220 djjpj.exe 2392 llxlffr.exe 1200 nhbthn.exe 1776 3xxlffl.exe 1404 9fxlllx.exe 592 3fxlxfx.exe 2424 hhbhbh.exe 2088 pjjjj.exe 344 5vvpv.exe 2072 lfrfrxr.exe 1412 hbntnt.exe 2936 lflrfll.exe 2932 btthth.exe 2508 5frfrxl.exe 2864 nhtthn.exe 3028 bbtntb.exe 2788 vpppd.exe 2856 xfxfrxl.exe 2772 5bttnt.exe 3044 7bthbn.exe 2872 vjjjd.exe 2988 rflfllx.exe 2576 7lrxfll.exe 2648 hbnhbb.exe 3012 ppjdd.exe 1764 9flrxfl.exe 2112 btttbh.exe 1868 dddpd.exe 1152 llllxfx.exe 2400 rlfrlxl.exe 2372 ntbbth.exe 1428 jvjvv.exe 1952 7lffllr.exe 764 1nbhth.exe 1684 hhtnhn.exe 1248 dvpvj.exe 1732 lfxfllx.exe 812 bbnbhh.exe 2924 vvpdp.exe 1336 ddvjv.exe 1200 llffrxx.exe 1448 1bthth.exe 1592 3bhntb.exe 1404 7vpdv.exe 1400 xrrfflx.exe -
resource yara_rule behavioral1/memory/2500-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-80-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2596-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/992-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1348-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/840-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1200-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1404-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/344-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1868-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1868-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2400-413-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2400-418-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1428-428-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/764-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/764-446-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1336-479-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1400-511-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-580-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-587-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-606-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-613-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-633-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-670-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2480-696-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1336-760-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-767-0x00000000003D0000-0x00000000003FA000-memory.dmp upx behavioral1/memory/1548-780-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-842-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1412-845-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-899-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-987-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-1000-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/1696-1007-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1596-1059-0x0000000000220000-0x000000000024A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttthbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxlxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nhhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllxlxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbtbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttntth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bthth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllxxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2500 wrote to memory of 2656 2500 32638d56ee0dd78a6e480813d334e84f7ea5a45e855abf0567646c0227b9ba9dN.exe 30 PID 2500 wrote to memory of 2656 2500 32638d56ee0dd78a6e480813d334e84f7ea5a45e855abf0567646c0227b9ba9dN.exe 30 PID 2500 wrote to memory of 2656 2500 32638d56ee0dd78a6e480813d334e84f7ea5a45e855abf0567646c0227b9ba9dN.exe 30 PID 2500 wrote to memory of 2656 2500 32638d56ee0dd78a6e480813d334e84f7ea5a45e855abf0567646c0227b9ba9dN.exe 30 PID 2656 wrote to memory of 2996 2656 llxlfrr.exe 31 PID 2656 wrote to memory of 2996 2656 llxlfrr.exe 31 PID 2656 wrote to memory of 2996 2656 llxlfrr.exe 31 PID 2656 wrote to memory of 2996 2656 llxlfrr.exe 31 PID 2996 wrote to memory of 2868 2996 xfxfxlf.exe 32 PID 2996 wrote to memory of 2868 2996 xfxfxlf.exe 32 PID 2996 wrote to memory of 2868 2996 xfxfxlf.exe 32 PID 2996 wrote to memory of 2868 2996 xfxfxlf.exe 32 PID 2868 wrote to memory of 2724 2868 djpdv.exe 33 PID 2868 wrote to memory of 2724 2868 djpdv.exe 33 PID 2868 wrote to memory of 2724 2868 djpdv.exe 33 PID 2868 wrote to memory of 2724 2868 djpdv.exe 33 PID 2724 wrote to memory of 2908 2724 jpdpp.exe 34 PID 2724 wrote to memory of 2908 2724 jpdpp.exe 34 PID 2724 wrote to memory of 2908 2724 jpdpp.exe 34 PID 2724 wrote to memory of 2908 2724 jpdpp.exe 34 PID 2908 wrote to memory of 2872 2908 9nhhtt.exe 35 PID 2908 wrote to memory of 2872 2908 9nhhtt.exe 35 PID 2908 wrote to memory of 2872 2908 9nhhtt.exe 35 PID 2908 wrote to memory of 2872 2908 9nhhtt.exe 35 PID 2872 wrote to memory of 2844 2872 ddjpv.exe 36 PID 2872 wrote to memory of 2844 2872 ddjpv.exe 36 PID 2872 wrote to memory of 2844 2872 ddjpv.exe 36 PID 2872 wrote to memory of 2844 2872 ddjpv.exe 36 PID 2844 wrote to memory of 2744 2844 9xrfxxr.exe 37 PID 2844 wrote to memory of 2744 2844 9xrfxxr.exe 37 PID 2844 wrote to memory of 2744 2844 9xrfxxr.exe 37 PID 2844 wrote to memory of 2744 2844 9xrfxxr.exe 37 PID 2744 wrote to memory of 2596 2744 pvvjj.exe 38 PID 2744 wrote to memory of 2596 2744 pvvjj.exe 38 PID 2744 wrote to memory of 2596 2744 pvvjj.exe 38 PID 2744 wrote to memory of 2596 2744 pvvjj.exe 38 PID 2596 wrote to memory of 2628 2596 tnnhtt.exe 39 PID 2596 wrote to memory of 2628 2596 tnnhtt.exe 39 PID 2596 wrote to memory of 2628 2596 tnnhtt.exe 39 PID 2596 wrote to memory of 2628 2596 tnnhtt.exe 39 PID 2628 wrote to memory of 992 2628 5jvdd.exe 40 PID 2628 wrote to memory of 992 2628 5jvdd.exe 40 PID 2628 wrote to memory of 992 2628 5jvdd.exe 40 PID 2628 wrote to memory of 992 2628 5jvdd.exe 40 PID 992 wrote to memory of 1152 992 5nntht.exe 41 PID 992 wrote to memory of 1152 992 5nntht.exe 41 PID 992 wrote to memory of 1152 992 5nntht.exe 41 PID 992 wrote to memory of 1152 992 5nntht.exe 41 PID 1152 wrote to memory of 1348 1152 jppvv.exe 42 PID 1152 wrote to memory of 1348 1152 jppvv.exe 42 PID 1152 wrote to memory of 1348 1152 jppvv.exe 42 PID 1152 wrote to memory of 1348 1152 jppvv.exe 42 PID 1348 wrote to memory of 1720 1348 bbttht.exe 43 PID 1348 wrote to memory of 1720 1348 bbttht.exe 43 PID 1348 wrote to memory of 1720 1348 bbttht.exe 43 PID 1348 wrote to memory of 1720 1348 bbttht.exe 43 PID 1720 wrote to memory of 1216 1720 ddjdv.exe 44 PID 1720 wrote to memory of 1216 1720 ddjdv.exe 44 PID 1720 wrote to memory of 1216 1720 ddjdv.exe 44 PID 1720 wrote to memory of 1216 1720 ddjdv.exe 44 PID 1216 wrote to memory of 1544 1216 hbthbh.exe 45 PID 1216 wrote to memory of 1544 1216 hbthbh.exe 45 PID 1216 wrote to memory of 1544 1216 hbthbh.exe 45 PID 1216 wrote to memory of 1544 1216 hbthbh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\32638d56ee0dd78a6e480813d334e84f7ea5a45e855abf0567646c0227b9ba9dN.exe"C:\Users\Admin\AppData\Local\Temp\32638d56ee0dd78a6e480813d334e84f7ea5a45e855abf0567646c0227b9ba9dN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\llxlfrr.exec:\llxlfrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\xfxfxlf.exec:\xfxfxlf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\djpdv.exec:\djpdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\jpdpp.exec:\jpdpp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\9nhhtt.exec:\9nhhtt.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\ddjpv.exec:\ddjpv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\9xrfxxr.exec:\9xrfxxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\pvvjj.exec:\pvvjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\tnnhtt.exec:\tnnhtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\5jvdd.exec:\5jvdd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\5nntht.exec:\5nntht.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
\??\c:\jppvv.exec:\jppvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\bbttht.exec:\bbttht.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
\??\c:\ddjdv.exec:\ddjdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
\??\c:\hbthbh.exec:\hbthbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\ddpdd.exec:\ddpdd.exe17⤵
- Executes dropped EXE
PID:1544 -
\??\c:\bhttnn.exec:\bhttnn.exe18⤵
- Executes dropped EXE
PID:2504 -
\??\c:\jdvvj.exec:\jdvvj.exe19⤵
- Executes dropped EXE
PID:840 -
\??\c:\3btbtb.exec:\3btbtb.exe20⤵
- Executes dropped EXE
PID:2196 -
\??\c:\djjpj.exec:\djjpj.exe21⤵
- Executes dropped EXE
PID:1220 -
\??\c:\llxlffr.exec:\llxlffr.exe22⤵
- Executes dropped EXE
PID:2392 -
\??\c:\nhbthn.exec:\nhbthn.exe23⤵
- Executes dropped EXE
PID:1200 -
\??\c:\3xxlffl.exec:\3xxlffl.exe24⤵
- Executes dropped EXE
PID:1776 -
\??\c:\9fxlllx.exec:\9fxlllx.exe25⤵
- Executes dropped EXE
PID:1404 -
\??\c:\3fxlxfx.exec:\3fxlxfx.exe26⤵
- Executes dropped EXE
PID:592 -
\??\c:\hhbhbh.exec:\hhbhbh.exe27⤵
- Executes dropped EXE
PID:2424 -
\??\c:\pjjjj.exec:\pjjjj.exe28⤵
- Executes dropped EXE
PID:2088 -
\??\c:\5vvpv.exec:\5vvpv.exe29⤵
- Executes dropped EXE
PID:344 -
\??\c:\lfrfrxr.exec:\lfrfrxr.exe30⤵
- Executes dropped EXE
PID:2072 -
\??\c:\hbntnt.exec:\hbntnt.exe31⤵
- Executes dropped EXE
PID:1412 -
\??\c:\lflrfll.exec:\lflrfll.exe32⤵
- Executes dropped EXE
PID:2936 -
\??\c:\btthth.exec:\btthth.exe33⤵
- Executes dropped EXE
PID:2932 -
\??\c:\5frfrxl.exec:\5frfrxl.exe34⤵
- Executes dropped EXE
PID:2508 -
\??\c:\nhtthn.exec:\nhtthn.exe35⤵
- Executes dropped EXE
PID:2864 -
\??\c:\bbtntb.exec:\bbtntb.exe36⤵
- Executes dropped EXE
PID:3028 -
\??\c:\vpppd.exec:\vpppd.exe37⤵
- Executes dropped EXE
PID:2788 -
\??\c:\xfxfrxl.exec:\xfxfrxl.exe38⤵
- Executes dropped EXE
PID:2856 -
\??\c:\5bttnt.exec:\5bttnt.exe39⤵
- Executes dropped EXE
PID:2772 -
\??\c:\7bthbn.exec:\7bthbn.exe40⤵
- Executes dropped EXE
PID:3044 -
\??\c:\vjjjd.exec:\vjjjd.exe41⤵
- Executes dropped EXE
PID:2872 -
\??\c:\rflfllx.exec:\rflfllx.exe42⤵
- Executes dropped EXE
PID:2988 -
\??\c:\7lrxfll.exec:\7lrxfll.exe43⤵
- Executes dropped EXE
PID:2576 -
\??\c:\hbnhbb.exec:\hbnhbb.exe44⤵
- Executes dropped EXE
PID:2648 -
\??\c:\ppjdd.exec:\ppjdd.exe45⤵
- Executes dropped EXE
PID:3012 -
\??\c:\9flrxfl.exec:\9flrxfl.exe46⤵
- Executes dropped EXE
PID:1764 -
\??\c:\btttbh.exec:\btttbh.exe47⤵
- Executes dropped EXE
PID:2112 -
\??\c:\dddpd.exec:\dddpd.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1868 -
\??\c:\llllxfx.exec:\llllxfx.exe49⤵
- Executes dropped EXE
PID:1152 -
\??\c:\rlfrlxl.exec:\rlfrlxl.exe50⤵
- Executes dropped EXE
PID:2400 -
\??\c:\ntbbth.exec:\ntbbth.exe51⤵
- Executes dropped EXE
PID:2372 -
\??\c:\jvjvv.exec:\jvjvv.exe52⤵
- Executes dropped EXE
PID:1428 -
\??\c:\7lffllr.exec:\7lffllr.exe53⤵
- Executes dropped EXE
PID:1952 -
\??\c:\1nbhth.exec:\1nbhth.exe54⤵
- Executes dropped EXE
PID:764 -
\??\c:\hhtnhn.exec:\hhtnhn.exe55⤵
- Executes dropped EXE
PID:1684 -
\??\c:\dvpvj.exec:\dvpvj.exe56⤵
- Executes dropped EXE
PID:1248 -
\??\c:\lfxfllx.exec:\lfxfllx.exe57⤵
- Executes dropped EXE
PID:1732 -
\??\c:\bbnbhh.exec:\bbnbhh.exe58⤵
- Executes dropped EXE
PID:812 -
\??\c:\vvpdp.exec:\vvpdp.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2924 -
\??\c:\ddvjv.exec:\ddvjv.exe60⤵
- Executes dropped EXE
PID:1336 -
\??\c:\llffrxx.exec:\llffrxx.exe61⤵
- Executes dropped EXE
PID:1200 -
\??\c:\1bthth.exec:\1bthth.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1448 -
\??\c:\3bhntb.exec:\3bhntb.exe63⤵
- Executes dropped EXE
PID:1592 -
\??\c:\7vpdv.exec:\7vpdv.exe64⤵
- Executes dropped EXE
PID:1404 -
\??\c:\xrrfflx.exec:\xrrfflx.exe65⤵
- Executes dropped EXE
PID:1400 -
\??\c:\ttthbh.exec:\ttthbh.exe66⤵
- System Location Discovery: System Language Discovery
PID:936 -
\??\c:\ddpdp.exec:\ddpdp.exe67⤵PID:2424
-
\??\c:\9fxxrfl.exec:\9fxxrfl.exe68⤵PID:604
-
\??\c:\lxxffxf.exec:\lxxffxf.exe69⤵PID:3064
-
\??\c:\bhnhbb.exec:\bhnhbb.exe70⤵PID:892
-
\??\c:\jdvdp.exec:\jdvdp.exe71⤵PID:2412
-
\??\c:\dvdvd.exec:\dvdvd.exe72⤵PID:3016
-
\??\c:\ffflrxl.exec:\ffflrxl.exe73⤵PID:2660
-
\??\c:\bhbnht.exec:\bhbnht.exe74⤵PID:2264
-
\??\c:\pppvj.exec:\pppvj.exe75⤵PID:2932
-
\??\c:\rlxllrf.exec:\rlxllrf.exe76⤵PID:2756
-
\??\c:\1fxlrrf.exec:\1fxlrrf.exe77⤵PID:2984
-
\??\c:\tnnthn.exec:\tnnthn.exe78⤵PID:2684
-
\??\c:\9ppvp.exec:\9ppvp.exe79⤵PID:2764
-
\??\c:\1ffrfrr.exec:\1ffrfrr.exe80⤵PID:2436
-
\??\c:\xrrrrrf.exec:\xrrrrrf.exe81⤵PID:2808
-
\??\c:\hthntb.exec:\hthntb.exe82⤵PID:2768
-
\??\c:\jppjp.exec:\jppjp.exe83⤵PID:2624
-
\??\c:\jdddp.exec:\jdddp.exe84⤵PID:2572
-
\??\c:\1ffxrfx.exec:\1ffxrfx.exe85⤵PID:2576
-
\??\c:\nhhhbh.exec:\nhhhbh.exe86⤵PID:2648
-
\??\c:\pjvjd.exec:\pjvjd.exe87⤵PID:3012
-
\??\c:\jpppv.exec:\jpppv.exe88⤵PID:1388
-
\??\c:\rxlxlrl.exec:\rxlxlrl.exe89⤵PID:2644
-
\??\c:\bttthh.exec:\bttthh.exe90⤵PID:1824
-
\??\c:\tbhnbh.exec:\tbhnbh.exe91⤵PID:2128
-
\??\c:\3pjpp.exec:\3pjpp.exe92⤵PID:1880
-
\??\c:\xrrlxxl.exec:\xrrlxxl.exe93⤵PID:1016
-
\??\c:\1lfrlfx.exec:\1lfrlfx.exe94⤵PID:2480
-
\??\c:\httttb.exec:\httttb.exe95⤵PID:1188
-
\??\c:\vpjpj.exec:\vpjpj.exe96⤵PID:2876
-
\??\c:\9dpdd.exec:\9dpdd.exe97⤵PID:2224
-
\??\c:\5xxrrxr.exec:\5xxrrxr.exe98⤵PID:1684
-
\??\c:\bnnntt.exec:\bnnntt.exe99⤵PID:2672
-
\??\c:\3jdjv.exec:\3jdjv.exe100⤵PID:1944
-
\??\c:\jddjp.exec:\jddjp.exe101⤵PID:3024
-
\??\c:\lffrxxr.exec:\lffrxxr.exe102⤵PID:3052
-
\??\c:\tnbhbh.exec:\tnbhbh.exe103⤵PID:1336
-
\??\c:\ppddp.exec:\ppddp.exe104⤵PID:1608
-
\??\c:\ppjjv.exec:\ppjjv.exe105⤵PID:1448
-
\??\c:\ffflxxl.exec:\ffflxxl.exe106⤵PID:1592
-
\??\c:\nttttb.exec:\nttttb.exe107⤵PID:1548
-
\??\c:\pjvvd.exec:\pjvvd.exe108⤵PID:1400
-
\??\c:\dpvdd.exec:\dpvdd.exe109⤵PID:732
-
\??\c:\fxrrflf.exec:\fxrrflf.exe110⤵PID:2424
-
\??\c:\nnbhtb.exec:\nnbhtb.exe111⤵
- System Location Discovery: System Language Discovery
PID:604 -
\??\c:\7hnthn.exec:\7hnthn.exe112⤵PID:3064
-
\??\c:\ddvjp.exec:\ddvjp.exe113⤵PID:892
-
\??\c:\lrxxlrx.exec:\lrxxlrx.exe114⤵PID:1412
-
\??\c:\hbnthh.exec:\hbnthh.exe115⤵PID:1512
-
\??\c:\dpppd.exec:\dpppd.exe116⤵PID:2660
-
\??\c:\fllxlxf.exec:\fllxlxf.exe117⤵
- System Location Discovery: System Language Discovery
PID:2380 -
\??\c:\htnbtn.exec:\htnbtn.exe118⤵
- System Location Discovery: System Language Discovery
PID:2932 -
\??\c:\3ppdv.exec:\3ppdv.exe119⤵PID:2704
-
\??\c:\rlflxxr.exec:\rlflxxr.exe120⤵PID:2868
-
\??\c:\ffxrflx.exec:\ffxrflx.exe121⤵PID:2684
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-