Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 09:18
Behavioral task
behavioral1
Sample
afd489a94397c690c8d5cbe56dd85bc9c7580d922d44b0cdb0944b65aba37392.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
afd489a94397c690c8d5cbe56dd85bc9c7580d922d44b0cdb0944b65aba37392.exe
-
Size
333KB
-
MD5
a0eb85e9d6df89a8fc4518fe28da4707
-
SHA1
5968e2d79f82b56d2d56c0ac24520aecf9c65abb
-
SHA256
afd489a94397c690c8d5cbe56dd85bc9c7580d922d44b0cdb0944b65aba37392
-
SHA512
dba84fc36f880bb353058d68a32267e1d12e2b92164c4cd5dbf84efb835d450628eeb4dbe8c71b0ac55ca2eec92f39dc93b23558393e10c9b176602ce75a5798
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbe8:R4wFHoSHYHUrAwfMp3CD8
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/2812-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2876-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2836-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2724-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2844-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2620-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2596-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2396-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1540-78-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2596-90-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3064-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2424-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2188-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1120-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2928-140-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2240-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1940-173-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1636-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/864-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1320-205-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3008-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2328-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1840-245-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2448-253-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1680-261-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2492-271-0x0000000076DD0000-0x0000000076ECA000-memory.dmp family_blackmoon behavioral1/memory/2492-270-0x0000000076ED0000-0x0000000076FEF000-memory.dmp family_blackmoon behavioral1/memory/2828-277-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1224-341-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1052-340-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1364-365-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1664-411-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2236-433-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1200-445-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2100-506-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2852-548-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2492-15693-0x0000000076ED0000-0x0000000076FEF000-memory.dmp family_blackmoon behavioral1/memory/2492-27595-0x0000000076ED0000-0x0000000076FEF000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2836 lxlffrf.exe 2876 nhhhnn.exe 2724 pdvdp.exe 2844 thhbnn.exe 2620 dvpvd.exe 2596 rrlrffr.exe 2396 hhttbn.exe 1540 rrlfxxx.exe 3064 rlxfflr.exe 2424 1bhnnn.exe 2188 pjpvj.exe 1636 xlfllrf.exe 2756 7pjjp.exe 2788 jvjjd.exe 2928 fxrxxfl.exe 1120 bthnbh.exe 1648 dvpjv.exe 1844 frlffll.exe 1940 nbnbhh.exe 2240 rlfrflx.exe 864 xrxfllx.exe 1092 vpjpj.exe 1320 xlrlrfx.exe 1500 bnnhbn.exe 1144 9pdjv.exe 3008 frfxllx.exe 2328 bntnbb.exe 1840 3pjjj.exe 2448 ffxfrfr.exe 1680 7ddjp.exe 356 ffrxlrx.exe 2492 pdjjj.exe 2864 hbbnbh.exe 2816 pjdpv.exe 2868 5xxxfxf.exe 2680 ffxlxfr.exe 2892 btbnhn.exe 2676 jdpjp.exe 2728 5dddv.exe 2560 5lrffxx.exe 1944 7btbhn.exe 1224 vpvdd.exe 1600 jvddd.exe 1052 3rfxxxx.exe 672 rlxxfxf.exe 2384 9tthnt.exe 2428 5dpjj.exe 1364 1djdd.exe 1660 rrxfxxf.exe 468 bthntn.exe 2756 ddjvj.exe 2788 pdjdd.exe 340 ffxxffl.exe 792 bnnthn.exe 1208 vjdvd.exe 1664 dvdvv.exe 912 7xlfllr.exe 2136 hbbnbh.exe 1940 7pvpv.exe 2236 5dvvj.exe 2420 5rrrrrx.exe 1200 bthhbb.exe 2108 ttnnhn.exe 828 vjpvv.exe -
resource yara_rule behavioral1/memory/2812-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000012102-8.dat upx behavioral1/memory/2812-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2812-6-0x00000000001B0000-0x00000000001D7000-memory.dmp upx behavioral1/files/0x000c0000000186c8-18.dat upx behavioral1/memory/2876-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2836-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000190c6-25.dat upx behavioral1/files/0x00080000000190c9-33.dat upx behavioral1/memory/2844-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2724-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000191f3-43.dat upx behavioral1/memory/2844-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2620-54-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000019217-53.dat upx behavioral1/memory/2596-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000019220-63.dat upx behavioral1/files/0x0006000000019238-70.dat upx behavioral1/memory/2396-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1540-78-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x000800000001925d-79.dat upx behavioral1/files/0x00070000000194bd-89.dat upx behavioral1/memory/2424-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3064-88-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3064-86-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0005000000019fb9-98.dat upx behavioral1/memory/2424-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a067-107.dat upx behavioral1/memory/2188-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a07b-117.dat upx behavioral1/files/0x000500000001a0a1-124.dat upx behavioral1/files/0x000500000001a301-132.dat upx behavioral1/files/0x000500000001a42b-149.dat upx behavioral1/memory/1120-148-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a42d-157.dat upx behavioral1/files/0x000500000001a345-141.dat upx behavioral1/memory/2928-140-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a42f-164.dat upx behavioral1/memory/2240-180-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a434-183.dat upx behavioral1/files/0x000500000001a431-174.dat upx behavioral1/memory/1940-173-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1636-116-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a46a-192.dat upx behavioral1/memory/864-191-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0039000000018662-198.dat upx behavioral1/files/0x000500000001a48c-207.dat upx behavioral1/files/0x000500000001a48e-214.dat upx behavioral1/files/0x000500000001a49a-222.dat upx behavioral1/files/0x000500000001a49c-230.dat upx behavioral1/memory/3008-229-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2328-237-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4aa-239.dat upx behavioral1/files/0x000500000001a4b5-246.dat upx behavioral1/memory/1840-245-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4b7-255.dat upx behavioral1/memory/2448-253-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1680-261-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4bb-262.dat upx behavioral1/files/0x000500000001a4c0-269.dat upx behavioral1/memory/2828-277-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4c6-278.dat upx behavioral1/memory/1224-341-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1052-340-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nbhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fxxxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxxfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntthbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbttbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxffxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2812 wrote to memory of 2836 2812 afd489a94397c690c8d5cbe56dd85bc9c7580d922d44b0cdb0944b65aba37392.exe 30 PID 2812 wrote to memory of 2836 2812 afd489a94397c690c8d5cbe56dd85bc9c7580d922d44b0cdb0944b65aba37392.exe 30 PID 2812 wrote to memory of 2836 2812 afd489a94397c690c8d5cbe56dd85bc9c7580d922d44b0cdb0944b65aba37392.exe 30 PID 2812 wrote to memory of 2836 2812 afd489a94397c690c8d5cbe56dd85bc9c7580d922d44b0cdb0944b65aba37392.exe 30 PID 2836 wrote to memory of 2876 2836 lxlffrf.exe 31 PID 2836 wrote to memory of 2876 2836 lxlffrf.exe 31 PID 2836 wrote to memory of 2876 2836 lxlffrf.exe 31 PID 2836 wrote to memory of 2876 2836 lxlffrf.exe 31 PID 2876 wrote to memory of 2724 2876 nhhhnn.exe 32 PID 2876 wrote to memory of 2724 2876 nhhhnn.exe 32 PID 2876 wrote to memory of 2724 2876 nhhhnn.exe 32 PID 2876 wrote to memory of 2724 2876 nhhhnn.exe 32 PID 2724 wrote to memory of 2844 2724 pdvdp.exe 33 PID 2724 wrote to memory of 2844 2724 pdvdp.exe 33 PID 2724 wrote to memory of 2844 2724 pdvdp.exe 33 PID 2724 wrote to memory of 2844 2724 pdvdp.exe 33 PID 2844 wrote to memory of 2620 2844 thhbnn.exe 34 PID 2844 wrote to memory of 2620 2844 thhbnn.exe 34 PID 2844 wrote to memory of 2620 2844 thhbnn.exe 34 PID 2844 wrote to memory of 2620 2844 thhbnn.exe 34 PID 2620 wrote to memory of 2596 2620 dvpvd.exe 35 PID 2620 wrote to memory of 2596 2620 dvpvd.exe 35 PID 2620 wrote to memory of 2596 2620 dvpvd.exe 35 PID 2620 wrote to memory of 2596 2620 dvpvd.exe 35 PID 2596 wrote to memory of 2396 2596 rrlrffr.exe 36 PID 2596 wrote to memory of 2396 2596 rrlrffr.exe 36 PID 2596 wrote to memory of 2396 2596 rrlrffr.exe 36 PID 2596 wrote to memory of 2396 2596 rrlrffr.exe 36 PID 2396 wrote to memory of 1540 2396 hhttbn.exe 37 PID 2396 wrote to memory of 1540 2396 hhttbn.exe 37 PID 2396 wrote to memory of 1540 2396 hhttbn.exe 37 PID 2396 wrote to memory of 1540 2396 hhttbn.exe 37 PID 1540 wrote to memory of 3064 1540 rrlfxxx.exe 38 PID 1540 wrote to memory of 3064 1540 rrlfxxx.exe 38 PID 1540 wrote to memory of 3064 1540 rrlfxxx.exe 38 PID 1540 wrote to memory of 3064 1540 rrlfxxx.exe 38 PID 3064 wrote to memory of 2424 3064 rlxfflr.exe 39 PID 3064 wrote to memory of 2424 3064 rlxfflr.exe 39 PID 3064 wrote to memory of 2424 3064 rlxfflr.exe 39 PID 3064 wrote to memory of 2424 3064 rlxfflr.exe 39 PID 2424 wrote to memory of 2188 2424 1bhnnn.exe 40 PID 2424 wrote to memory of 2188 2424 1bhnnn.exe 40 PID 2424 wrote to memory of 2188 2424 1bhnnn.exe 40 PID 2424 wrote to memory of 2188 2424 1bhnnn.exe 40 PID 2188 wrote to memory of 1636 2188 pjpvj.exe 41 PID 2188 wrote to memory of 1636 2188 pjpvj.exe 41 PID 2188 wrote to memory of 1636 2188 pjpvj.exe 41 PID 2188 wrote to memory of 1636 2188 pjpvj.exe 41 PID 1636 wrote to memory of 2756 1636 xlfllrf.exe 42 PID 1636 wrote to memory of 2756 1636 xlfllrf.exe 42 PID 1636 wrote to memory of 2756 1636 xlfllrf.exe 42 PID 1636 wrote to memory of 2756 1636 xlfllrf.exe 42 PID 2756 wrote to memory of 2788 2756 7pjjp.exe 43 PID 2756 wrote to memory of 2788 2756 7pjjp.exe 43 PID 2756 wrote to memory of 2788 2756 7pjjp.exe 43 PID 2756 wrote to memory of 2788 2756 7pjjp.exe 43 PID 2788 wrote to memory of 2928 2788 jvjjd.exe 44 PID 2788 wrote to memory of 2928 2788 jvjjd.exe 44 PID 2788 wrote to memory of 2928 2788 jvjjd.exe 44 PID 2788 wrote to memory of 2928 2788 jvjjd.exe 44 PID 2928 wrote to memory of 1120 2928 fxrxxfl.exe 45 PID 2928 wrote to memory of 1120 2928 fxrxxfl.exe 45 PID 2928 wrote to memory of 1120 2928 fxrxxfl.exe 45 PID 2928 wrote to memory of 1120 2928 fxrxxfl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\afd489a94397c690c8d5cbe56dd85bc9c7580d922d44b0cdb0944b65aba37392.exe"C:\Users\Admin\AppData\Local\Temp\afd489a94397c690c8d5cbe56dd85bc9c7580d922d44b0cdb0944b65aba37392.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\lxlffrf.exec:\lxlffrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\nhhhnn.exec:\nhhhnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\pdvdp.exec:\pdvdp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\thhbnn.exec:\thhbnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\dvpvd.exec:\dvpvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\rrlrffr.exec:\rrlrffr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\hhttbn.exec:\hhttbn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\rrlfxxx.exec:\rrlfxxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
\??\c:\rlxfflr.exec:\rlxfflr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\1bhnnn.exec:\1bhnnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\pjpvj.exec:\pjpvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\xlfllrf.exec:\xlfllrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\7pjjp.exec:\7pjjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\jvjjd.exec:\jvjjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\fxrxxfl.exec:\fxrxxfl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\bthnbh.exec:\bthnbh.exe17⤵
- Executes dropped EXE
PID:1120 -
\??\c:\dvpjv.exec:\dvpjv.exe18⤵
- Executes dropped EXE
PID:1648 -
\??\c:\frlffll.exec:\frlffll.exe19⤵
- Executes dropped EXE
PID:1844 -
\??\c:\nbnbhh.exec:\nbnbhh.exe20⤵
- Executes dropped EXE
PID:1940 -
\??\c:\rlfrflx.exec:\rlfrflx.exe21⤵
- Executes dropped EXE
PID:2240 -
\??\c:\xrxfllx.exec:\xrxfllx.exe22⤵
- Executes dropped EXE
PID:864 -
\??\c:\vpjpj.exec:\vpjpj.exe23⤵
- Executes dropped EXE
PID:1092 -
\??\c:\xlrlrfx.exec:\xlrlrfx.exe24⤵
- Executes dropped EXE
PID:1320 -
\??\c:\bnnhbn.exec:\bnnhbn.exe25⤵
- Executes dropped EXE
PID:1500 -
\??\c:\9pdjv.exec:\9pdjv.exe26⤵
- Executes dropped EXE
PID:1144 -
\??\c:\frfxllx.exec:\frfxllx.exe27⤵
- Executes dropped EXE
PID:3008 -
\??\c:\bntnbb.exec:\bntnbb.exe28⤵
- Executes dropped EXE
PID:2328 -
\??\c:\3pjjj.exec:\3pjjj.exe29⤵
- Executes dropped EXE
PID:1840 -
\??\c:\ffxfrfr.exec:\ffxfrfr.exe30⤵
- Executes dropped EXE
PID:2448 -
\??\c:\7ddjp.exec:\7ddjp.exe31⤵
- Executes dropped EXE
PID:1680 -
\??\c:\ffrxlrx.exec:\ffrxlrx.exe32⤵
- Executes dropped EXE
PID:356 -
\??\c:\pdjjj.exec:\pdjjj.exe33⤵
- Executes dropped EXE
PID:2492 -
\??\c:\rfllrrx.exec:\rfllrrx.exe34⤵PID:2828
-
\??\c:\hbbnbh.exec:\hbbnbh.exe35⤵
- Executes dropped EXE
PID:2864 -
\??\c:\pjdpv.exec:\pjdpv.exe36⤵
- Executes dropped EXE
PID:2816 -
\??\c:\5xxxfxf.exec:\5xxxfxf.exe37⤵
- Executes dropped EXE
PID:2868 -
\??\c:\ffxlxfr.exec:\ffxlxfr.exe38⤵
- Executes dropped EXE
PID:2680 -
\??\c:\btbnhn.exec:\btbnhn.exe39⤵
- Executes dropped EXE
PID:2892 -
\??\c:\jdpjp.exec:\jdpjp.exe40⤵
- Executes dropped EXE
PID:2676 -
\??\c:\5dddv.exec:\5dddv.exe41⤵
- Executes dropped EXE
PID:2728 -
\??\c:\5lrffxx.exec:\5lrffxx.exe42⤵
- Executes dropped EXE
PID:2560 -
\??\c:\7btbhn.exec:\7btbhn.exe43⤵
- Executes dropped EXE
PID:1944 -
\??\c:\vpvdd.exec:\vpvdd.exe44⤵
- Executes dropped EXE
PID:1224 -
\??\c:\jvddd.exec:\jvddd.exe45⤵
- Executes dropped EXE
PID:1600 -
\??\c:\3rfxxxx.exec:\3rfxxxx.exe46⤵
- Executes dropped EXE
PID:1052 -
\??\c:\rlxxfxf.exec:\rlxxfxf.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:672 -
\??\c:\9tthnt.exec:\9tthnt.exe48⤵
- Executes dropped EXE
PID:2384 -
\??\c:\5dpjj.exec:\5dpjj.exe49⤵
- Executes dropped EXE
PID:2428 -
\??\c:\1djdd.exec:\1djdd.exe50⤵
- Executes dropped EXE
PID:1364 -
\??\c:\rrxfxxf.exec:\rrxfxxf.exe51⤵
- Executes dropped EXE
PID:1660 -
\??\c:\bthntn.exec:\bthntn.exe52⤵
- Executes dropped EXE
PID:468 -
\??\c:\ddjvj.exec:\ddjvj.exe53⤵
- Executes dropped EXE
PID:2756 -
\??\c:\pdjdd.exec:\pdjdd.exe54⤵
- Executes dropped EXE
PID:2788 -
\??\c:\ffxxffl.exec:\ffxxffl.exe55⤵
- Executes dropped EXE
PID:340 -
\??\c:\bnnthn.exec:\bnnthn.exe56⤵
- Executes dropped EXE
PID:792 -
\??\c:\vjdvd.exec:\vjdvd.exe57⤵
- Executes dropped EXE
PID:1208 -
\??\c:\dvdvv.exec:\dvdvv.exe58⤵
- Executes dropped EXE
PID:1664 -
\??\c:\7xlfllr.exec:\7xlfllr.exe59⤵
- Executes dropped EXE
PID:912 -
\??\c:\hbbnbh.exec:\hbbnbh.exe60⤵
- Executes dropped EXE
PID:2136 -
\??\c:\7pvpv.exec:\7pvpv.exe61⤵
- Executes dropped EXE
PID:1940 -
\??\c:\5dvvj.exec:\5dvvj.exe62⤵
- Executes dropped EXE
PID:2236 -
\??\c:\5rrrrrx.exec:\5rrrrrx.exe63⤵
- Executes dropped EXE
PID:2420 -
\??\c:\bthhbb.exec:\bthhbb.exe64⤵
- Executes dropped EXE
PID:1200 -
\??\c:\ttnnhn.exec:\ttnnhn.exe65⤵
- Executes dropped EXE
PID:2108 -
\??\c:\vjpvv.exec:\vjpvv.exe66⤵
- Executes dropped EXE
PID:828 -
\??\c:\llxxllx.exec:\llxxllx.exe67⤵PID:2532
-
\??\c:\7xxlxlf.exec:\7xxlxlf.exe68⤵PID:612
-
\??\c:\bthnhb.exec:\bthnhb.exe69⤵PID:992
-
\??\c:\dvddv.exec:\dvddv.exe70⤵PID:1924
-
\??\c:\vvvvd.exec:\vvvvd.exe71⤵PID:3008
-
\??\c:\fffflrr.exec:\fffflrr.exe72⤵PID:976
-
\??\c:\nntnhb.exec:\nntnhb.exe73⤵PID:832
-
\??\c:\9pdvv.exec:\9pdvv.exe74⤵PID:1004
-
\??\c:\xllrxxr.exec:\xllrxxr.exe75⤵PID:2100
-
\??\c:\1frxxxf.exec:\1frxxxf.exe76⤵PID:1676
-
\??\c:\nhbthb.exec:\nhbthb.exe77⤵PID:892
-
\??\c:\dvjjp.exec:\dvjjp.exe78⤵PID:356
-
\??\c:\vdjjd.exec:\vdjjd.exe79⤵PID:2840
-
\??\c:\xxfrlxr.exec:\xxfrlxr.exe80⤵PID:1468
-
\??\c:\fxrxllr.exec:\fxrxllr.exe81⤵PID:2836
-
\??\c:\5ntbbt.exec:\5ntbbt.exe82⤵PID:2876
-
\??\c:\1jvdj.exec:\1jvdj.exe83⤵PID:2852
-
\??\c:\1jvdp.exec:\1jvdp.exe84⤵PID:1748
-
\??\c:\llfxxrx.exec:\llfxxrx.exe85⤵PID:2724
-
\??\c:\1thntn.exec:\1thntn.exe86⤵PID:2676
-
\??\c:\nbthtt.exec:\nbthtt.exe87⤵PID:2636
-
\??\c:\5pdjp.exec:\5pdjp.exe88⤵PID:2560
-
\??\c:\lfffrxf.exec:\lfffrxf.exe89⤵PID:3060
-
\??\c:\bhhthh.exec:\bhhthh.exe90⤵PID:2904
-
\??\c:\bhbhbt.exec:\bhbhbt.exe91⤵PID:2604
-
\??\c:\9jvpv.exec:\9jvpv.exe92⤵PID:2952
-
\??\c:\3vdjp.exec:\3vdjp.exe93⤵PID:2780
-
\??\c:\xlxflrx.exec:\xlxflrx.exe94⤵PID:2360
-
\??\c:\fxlxllr.exec:\fxlxllr.exe95⤵PID:1856
-
\??\c:\nnhtbh.exec:\nnhtbh.exe96⤵PID:2172
-
\??\c:\7dpdd.exec:\7dpdd.exe97⤵PID:2624
-
\??\c:\vjpdv.exec:\vjpdv.exe98⤵PID:2796
-
\??\c:\rlflrrx.exec:\rlflrrx.exe99⤵PID:2284
-
\??\c:\htntnn.exec:\htntnn.exe100⤵PID:2632
-
\??\c:\tbnbht.exec:\tbnbht.exe101⤵PID:552
-
\??\c:\vvpvv.exec:\vvpvv.exe102⤵PID:476
-
\??\c:\fxfxffr.exec:\fxfxffr.exe103⤵PID:880
-
\??\c:\xlrlrlr.exec:\xlrlrlr.exe104⤵PID:3004
-
\??\c:\tnttbb.exec:\tnttbb.exe105⤵PID:2068
-
\??\c:\jvjdj.exec:\jvjdj.exe106⤵PID:2996
-
\??\c:\3xflrfl.exec:\3xflrfl.exe107⤵PID:624
-
\??\c:\lfrfrrl.exec:\lfrfrrl.exe108⤵PID:1872
-
\??\c:\7nbhhb.exec:\7nbhhb.exe109⤵PID:2212
-
\??\c:\nhbnhn.exec:\nhbnhn.exe110⤵PID:864
-
\??\c:\7vdjj.exec:\7vdjj.exe111⤵PID:1628
-
\??\c:\xrxflfl.exec:\xrxflfl.exe112⤵PID:948
-
\??\c:\nhtbhh.exec:\nhtbhh.exe113⤵PID:1796
-
\??\c:\tntbbh.exec:\tntbbh.exe114⤵PID:2536
-
\??\c:\jdvjj.exec:\jdvjj.exe115⤵PID:1144
-
\??\c:\9djjp.exec:\9djjp.exe116⤵PID:2984
-
\??\c:\fxrfrxl.exec:\fxrfrxl.exe117⤵PID:1124
-
\??\c:\hbbnbb.exec:\hbbnbb.exe118⤵PID:1640
-
\??\c:\tnntth.exec:\tnntth.exe119⤵PID:700
-
\??\c:\3dvpj.exec:\3dvpj.exe120⤵PID:1656
-
\??\c:\9llrrxf.exec:\9llrrxf.exe121⤵PID:2072
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-