Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 08:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2b3abc7bd204182229353eb14d3c46fa0bb1013879b6621072612a22f1a63ea1N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
2b3abc7bd204182229353eb14d3c46fa0bb1013879b6621072612a22f1a63ea1N.exe
-
Size
455KB
-
MD5
02f0f3f5f0518f0b7efa6df356b34a30
-
SHA1
cb528f8d4a8572603b8bed76d50c0cc316a9ce45
-
SHA256
2b3abc7bd204182229353eb14d3c46fa0bb1013879b6621072612a22f1a63ea1
-
SHA512
a553cd050aff53624f1103455a9b4e7d666401676c7fe14142d3a134fbc7fe62d82784ad049e69dc7e8d63643745a72748c96b7b5174fca512de26b9f2d3143e
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbew:q7Tc2NYHUrAwfMp3CDw
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/3024-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1968-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3052-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2516-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/320-122-0x0000000000340000-0x000000000036A000-memory.dmp family_blackmoon behavioral1/memory/320-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2156-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/592-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2024-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/696-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1720-214-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1720-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2084-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2068-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-293-0x0000000077630000-0x000000007774F000-memory.dmp family_blackmoon behavioral1/memory/2744-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1932-402-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2148-421-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1488-453-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/864-485-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2828-492-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/588-542-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1844-548-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2720-632-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/684-663-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1624-709-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1944-723-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-738-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1248-771-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1072-799-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1512-972-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1008-1055-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2352-1058-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon behavioral1/memory/2880-1156-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2472-1193-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3068 dvvdj.exe 1856 7xxxllr.exe 2804 rflxrfl.exe 1968 jdvdv.exe 2848 ffxxffx.exe 2624 1vpvd.exe 2504 rlflfll.exe 2788 jdpdp.exe 1732 llfrrxl.exe 3052 7vdjv.exe 2516 7xfxrfl.exe 320 jdpjd.exe 1876 7lxlxlx.exe 2156 ddvjv.exe 592 fxrrllf.exe 2024 pppvd.exe 1920 7llxfrx.exe 1080 5pjjp.exe 2656 xxrrflr.exe 3008 dvvdp.exe 696 9llrlfr.exe 1720 pjdpv.exe 2956 jjvpp.exe 1428 pvjjp.exe 2212 llfrlrf.exe 2284 vvvvj.exe 588 ffxffll.exe 2084 5tntnt.exe 904 7pvdj.exe 2068 ddvpj.exe 2124 fxrxrxr.exe 2556 vvvjd.exe 2540 lfflxfx.exe 2708 3vjjp.exe 2920 fxrflxf.exe 2904 bnhhhn.exe 2744 dvppv.exe 2736 ddvdv.exe 2976 3xxxlxf.exe 2644 3httnt.exe 2672 vvppp.exe 2788 dvjvp.exe 3056 xffrxlx.exe 3060 bhttnn.exe 704 jjvdp.exe 1932 9dvdd.exe 1724 xrflrxf.exe 1528 bbttbb.exe 2148 bthhnt.exe 2588 jdvdv.exe 3040 xrlrxfr.exe 1484 nhtthh.exe 1944 nnhhtb.exe 1488 pjdjd.exe 576 rfxfxxf.exe 1224 bhbnth.exe 2940 dvvdv.exe 1436 ddpjd.exe 864 rxfxffr.exe 2828 5bntbh.exe 892 vvvjd.exe 2304 7lxfrfx.exe 1008 lrrlxrr.exe 2448 tbbhtb.exe -
resource yara_rule behavioral1/memory/3024-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/320-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/320-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/592-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1080-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/696-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/696-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1488-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/892-493-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/588-542-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-550-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-632-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/684-663-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-671-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-684-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-709-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-723-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-908-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-921-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-946-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-953-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1512-972-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/648-1023-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1008-1055-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-1058-0x0000000000530000-0x000000000055A000-memory.dmp upx behavioral1/memory/1500-1111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-1174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1124-1212-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lxxlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xflxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rrrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nhnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nnthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htthtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3024 wrote to memory of 3068 3024 2b3abc7bd204182229353eb14d3c46fa0bb1013879b6621072612a22f1a63ea1N.exe 30 PID 3024 wrote to memory of 3068 3024 2b3abc7bd204182229353eb14d3c46fa0bb1013879b6621072612a22f1a63ea1N.exe 30 PID 3024 wrote to memory of 3068 3024 2b3abc7bd204182229353eb14d3c46fa0bb1013879b6621072612a22f1a63ea1N.exe 30 PID 3024 wrote to memory of 3068 3024 2b3abc7bd204182229353eb14d3c46fa0bb1013879b6621072612a22f1a63ea1N.exe 30 PID 3068 wrote to memory of 1856 3068 dvvdj.exe 31 PID 3068 wrote to memory of 1856 3068 dvvdj.exe 31 PID 3068 wrote to memory of 1856 3068 dvvdj.exe 31 PID 3068 wrote to memory of 1856 3068 dvvdj.exe 31 PID 1856 wrote to memory of 2804 1856 7xxxllr.exe 32 PID 1856 wrote to memory of 2804 1856 7xxxllr.exe 32 PID 1856 wrote to memory of 2804 1856 7xxxllr.exe 32 PID 1856 wrote to memory of 2804 1856 7xxxllr.exe 32 PID 2804 wrote to memory of 1968 2804 rflxrfl.exe 33 PID 2804 wrote to memory of 1968 2804 rflxrfl.exe 33 PID 2804 wrote to memory of 1968 2804 rflxrfl.exe 33 PID 2804 wrote to memory of 1968 2804 rflxrfl.exe 33 PID 1968 wrote to memory of 2848 1968 jdvdv.exe 34 PID 1968 wrote to memory of 2848 1968 jdvdv.exe 34 PID 1968 wrote to memory of 2848 1968 jdvdv.exe 34 PID 1968 wrote to memory of 2848 1968 jdvdv.exe 34 PID 2848 wrote to memory of 2624 2848 ffxxffx.exe 35 PID 2848 wrote to memory of 2624 2848 ffxxffx.exe 35 PID 2848 wrote to memory of 2624 2848 ffxxffx.exe 35 PID 2848 wrote to memory of 2624 2848 ffxxffx.exe 35 PID 2624 wrote to memory of 2504 2624 1vpvd.exe 36 PID 2624 wrote to memory of 2504 2624 1vpvd.exe 36 PID 2624 wrote to memory of 2504 2624 1vpvd.exe 36 PID 2624 wrote to memory of 2504 2624 1vpvd.exe 36 PID 2504 wrote to memory of 2788 2504 rlflfll.exe 37 PID 2504 wrote to memory of 2788 2504 rlflfll.exe 37 PID 2504 wrote to memory of 2788 2504 rlflfll.exe 37 PID 2504 wrote to memory of 2788 2504 rlflfll.exe 37 PID 2788 wrote to memory of 1732 2788 jdpdp.exe 38 PID 2788 wrote to memory of 1732 2788 jdpdp.exe 38 PID 2788 wrote to memory of 1732 2788 jdpdp.exe 38 PID 2788 wrote to memory of 1732 2788 jdpdp.exe 38 PID 1732 wrote to memory of 3052 1732 llfrrxl.exe 39 PID 1732 wrote to memory of 3052 1732 llfrrxl.exe 39 PID 1732 wrote to memory of 3052 1732 llfrrxl.exe 39 PID 1732 wrote to memory of 3052 1732 llfrrxl.exe 39 PID 3052 wrote to memory of 2516 3052 7vdjv.exe 40 PID 3052 wrote to memory of 2516 3052 7vdjv.exe 40 PID 3052 wrote to memory of 2516 3052 7vdjv.exe 40 PID 3052 wrote to memory of 2516 3052 7vdjv.exe 40 PID 2516 wrote to memory of 320 2516 7xfxrfl.exe 41 PID 2516 wrote to memory of 320 2516 7xfxrfl.exe 41 PID 2516 wrote to memory of 320 2516 7xfxrfl.exe 41 PID 2516 wrote to memory of 320 2516 7xfxrfl.exe 41 PID 320 wrote to memory of 1876 320 jdpjd.exe 42 PID 320 wrote to memory of 1876 320 jdpjd.exe 42 PID 320 wrote to memory of 1876 320 jdpjd.exe 42 PID 320 wrote to memory of 1876 320 jdpjd.exe 42 PID 1876 wrote to memory of 2156 1876 7lxlxlx.exe 43 PID 1876 wrote to memory of 2156 1876 7lxlxlx.exe 43 PID 1876 wrote to memory of 2156 1876 7lxlxlx.exe 43 PID 1876 wrote to memory of 2156 1876 7lxlxlx.exe 43 PID 2156 wrote to memory of 592 2156 ddvjv.exe 44 PID 2156 wrote to memory of 592 2156 ddvjv.exe 44 PID 2156 wrote to memory of 592 2156 ddvjv.exe 44 PID 2156 wrote to memory of 592 2156 ddvjv.exe 44 PID 592 wrote to memory of 2024 592 fxrrllf.exe 45 PID 592 wrote to memory of 2024 592 fxrrllf.exe 45 PID 592 wrote to memory of 2024 592 fxrrllf.exe 45 PID 592 wrote to memory of 2024 592 fxrrllf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b3abc7bd204182229353eb14d3c46fa0bb1013879b6621072612a22f1a63ea1N.exe"C:\Users\Admin\AppData\Local\Temp\2b3abc7bd204182229353eb14d3c46fa0bb1013879b6621072612a22f1a63ea1N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\dvvdj.exec:\dvvdj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\7xxxllr.exec:\7xxxllr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
\??\c:\rflxrfl.exec:\rflxrfl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\jdvdv.exec:\jdvdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\ffxxffx.exec:\ffxxffx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\1vpvd.exec:\1vpvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\rlflfll.exec:\rlflfll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\jdpdp.exec:\jdpdp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\llfrrxl.exec:\llfrrxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\7vdjv.exec:\7vdjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\7xfxrfl.exec:\7xfxrfl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\jdpjd.exec:\jdpjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\7lxlxlx.exec:\7lxlxlx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\ddvjv.exec:\ddvjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\fxrrllf.exec:\fxrrllf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:592 -
\??\c:\pppvd.exec:\pppvd.exe17⤵
- Executes dropped EXE
PID:2024 -
\??\c:\7llxfrx.exec:\7llxfrx.exe18⤵
- Executes dropped EXE
PID:1920 -
\??\c:\5pjjp.exec:\5pjjp.exe19⤵
- Executes dropped EXE
PID:1080 -
\??\c:\xxrrflr.exec:\xxrrflr.exe20⤵
- Executes dropped EXE
PID:2656 -
\??\c:\dvvdp.exec:\dvvdp.exe21⤵
- Executes dropped EXE
PID:3008 -
\??\c:\9llrlfr.exec:\9llrlfr.exe22⤵
- Executes dropped EXE
PID:696 -
\??\c:\pjdpv.exec:\pjdpv.exe23⤵
- Executes dropped EXE
PID:1720 -
\??\c:\jjvpp.exec:\jjvpp.exe24⤵
- Executes dropped EXE
PID:2956 -
\??\c:\pvjjp.exec:\pvjjp.exe25⤵
- Executes dropped EXE
PID:1428 -
\??\c:\llfrlrf.exec:\llfrlrf.exe26⤵
- Executes dropped EXE
PID:2212 -
\??\c:\vvvvj.exec:\vvvvj.exe27⤵
- Executes dropped EXE
PID:2284 -
\??\c:\ffxffll.exec:\ffxffll.exe28⤵
- Executes dropped EXE
PID:588 -
\??\c:\5tntnt.exec:\5tntnt.exe29⤵
- Executes dropped EXE
PID:2084 -
\??\c:\7pvdj.exec:\7pvdj.exe30⤵
- Executes dropped EXE
PID:904 -
\??\c:\ddvpj.exec:\ddvpj.exe31⤵
- Executes dropped EXE
PID:2068 -
\??\c:\fxrxrxr.exec:\fxrxrxr.exe32⤵
- Executes dropped EXE
PID:2124 -
\??\c:\tnbttb.exec:\tnbttb.exe33⤵PID:1472
-
\??\c:\vvvjd.exec:\vvvjd.exe34⤵
- Executes dropped EXE
PID:2556 -
\??\c:\lfflxfx.exec:\lfflxfx.exe35⤵
- Executes dropped EXE
PID:2540 -
\??\c:\3vjjp.exec:\3vjjp.exe36⤵
- Executes dropped EXE
PID:2708 -
\??\c:\fxrflxf.exec:\fxrflxf.exe37⤵
- Executes dropped EXE
PID:2920 -
\??\c:\bnhhhn.exec:\bnhhhn.exe38⤵
- Executes dropped EXE
PID:2904 -
\??\c:\dvppv.exec:\dvppv.exe39⤵
- Executes dropped EXE
PID:2744 -
\??\c:\ddvdv.exec:\ddvdv.exe40⤵
- Executes dropped EXE
PID:2736 -
\??\c:\3xxxlxf.exec:\3xxxlxf.exe41⤵
- Executes dropped EXE
PID:2976 -
\??\c:\3httnt.exec:\3httnt.exe42⤵
- Executes dropped EXE
PID:2644 -
\??\c:\vvppp.exec:\vvppp.exe43⤵
- Executes dropped EXE
PID:2672 -
\??\c:\dvjvp.exec:\dvjvp.exe44⤵
- Executes dropped EXE
PID:2788 -
\??\c:\xffrxlx.exec:\xffrxlx.exe45⤵
- Executes dropped EXE
PID:3056 -
\??\c:\bhttnn.exec:\bhttnn.exe46⤵
- Executes dropped EXE
PID:3060 -
\??\c:\jjvdp.exec:\jjvdp.exe47⤵
- Executes dropped EXE
PID:704 -
\??\c:\9dvdd.exec:\9dvdd.exe48⤵
- Executes dropped EXE
PID:1932 -
\??\c:\xrflrxf.exec:\xrflrxf.exe49⤵
- Executes dropped EXE
PID:1724 -
\??\c:\bbttbb.exec:\bbttbb.exe50⤵
- Executes dropped EXE
PID:1528 -
\??\c:\bthhnt.exec:\bthhnt.exe51⤵
- Executes dropped EXE
PID:2148 -
\??\c:\jdvdv.exec:\jdvdv.exe52⤵
- Executes dropped EXE
PID:2588 -
\??\c:\xrlrxfr.exec:\xrlrxfr.exe53⤵
- Executes dropped EXE
PID:3040 -
\??\c:\nhtthh.exec:\nhtthh.exe54⤵
- Executes dropped EXE
PID:1484 -
\??\c:\nnhhtb.exec:\nnhhtb.exe55⤵
- Executes dropped EXE
PID:1944 -
\??\c:\pjdjd.exec:\pjdjd.exe56⤵
- Executes dropped EXE
PID:1488 -
\??\c:\rfxfxxf.exec:\rfxfxxf.exe57⤵
- Executes dropped EXE
PID:576 -
\??\c:\bhbnth.exec:\bhbnth.exe58⤵
- Executes dropped EXE
PID:1224 -
\??\c:\dvvdv.exec:\dvvdv.exe59⤵
- Executes dropped EXE
PID:2940 -
\??\c:\ddpjd.exec:\ddpjd.exe60⤵
- Executes dropped EXE
PID:1436 -
\??\c:\rxfxffr.exec:\rxfxffr.exe61⤵
- Executes dropped EXE
PID:864 -
\??\c:\5bntbh.exec:\5bntbh.exe62⤵
- Executes dropped EXE
PID:2828 -
\??\c:\vvvjd.exec:\vvvjd.exe63⤵
- Executes dropped EXE
PID:892 -
\??\c:\7lxfrfx.exec:\7lxfrfx.exe64⤵
- Executes dropped EXE
PID:2304 -
\??\c:\lrrlxrr.exec:\lrrlxrr.exe65⤵
- Executes dropped EXE
PID:1008 -
\??\c:\tbbhtb.exec:\tbbhtb.exe66⤵
- Executes dropped EXE
PID:2448 -
\??\c:\djdjp.exec:\djdjp.exe67⤵PID:2332
-
\??\c:\fxrrxxl.exec:\fxrrxxl.exe68⤵PID:2532
-
\??\c:\hbntbh.exec:\hbntbh.exe69⤵PID:372
-
\??\c:\hhbhtt.exec:\hhbhtt.exe70⤵PID:588
-
\??\c:\5jddp.exec:\5jddp.exe71⤵PID:1844
-
\??\c:\rrlrffr.exec:\rrlrffr.exe72⤵PID:2972
-
\??\c:\nthhbh.exec:\nthhbh.exe73⤵PID:2016
-
\??\c:\bbtbtn.exec:\bbtbtn.exe74⤵PID:1568
-
\??\c:\pvdjv.exec:\pvdjv.exe75⤵PID:1472
-
\??\c:\xxrxlfl.exec:\xxrxlfl.exe76⤵PID:2580
-
\??\c:\tthtnt.exec:\tthtnt.exe77⤵PID:1752
-
\??\c:\9nntht.exec:\9nntht.exe78⤵PID:2728
-
\??\c:\5dpjj.exec:\5dpjj.exe79⤵PID:2864
-
\??\c:\rrlxrfl.exec:\rrlxrfl.exe80⤵PID:1968
-
\??\c:\nhbntb.exec:\nhbntb.exe81⤵PID:2752
-
\??\c:\bnhhhn.exec:\bnhhhn.exe82⤵PID:2744
-
\??\c:\jjdjv.exec:\jjdjv.exe83⤵PID:2912
-
\??\c:\ffxrfxl.exec:\ffxrfxl.exe84⤵PID:2720
-
\??\c:\1thhbh.exec:\1thhbh.exe85⤵PID:2756
-
\??\c:\bttbnt.exec:\bttbnt.exe86⤵PID:2680
-
\??\c:\5jjpv.exec:\5jjpv.exe87⤵PID:1984
-
\??\c:\xlflfrf.exec:\xlflfrf.exe88⤵PID:2152
-
\??\c:\nhhbhn.exec:\nhhbhn.exe89⤵PID:684
-
\??\c:\3bbnbb.exec:\3bbnbb.exe90⤵PID:3060
-
\??\c:\vpjvv.exec:\vpjvv.exe91⤵PID:2516
-
\??\c:\rrlrfrf.exec:\rrlrfrf.exe92⤵PID:2168
-
\??\c:\btnthn.exec:\btnthn.exe93⤵PID:1592
-
\??\c:\nhbnht.exec:\nhbnht.exe94⤵PID:2148
-
\??\c:\pdddp.exec:\pdddp.exe95⤵PID:1512
-
\??\c:\fxxlxrf.exec:\fxxlxrf.exe96⤵PID:1624
-
\??\c:\thtbhn.exec:\thtbhn.exe97⤵PID:1880
-
\??\c:\btnnbb.exec:\btnnbb.exe98⤵PID:1944
-
\??\c:\jjjpv.exec:\jjjpv.exe99⤵PID:1324
-
\??\c:\xflxffr.exec:\xflxffr.exe100⤵PID:576
-
\??\c:\nbnntt.exec:\nbnntt.exe101⤵PID:2704
-
\??\c:\ntntnt.exec:\ntntnt.exe102⤵PID:2996
-
\??\c:\vpvvv.exec:\vpvvv.exe103⤵PID:976
-
\??\c:\xxlrxll.exec:\xxlrxll.exe104⤵PID:2600
-
\??\c:\hhbnhh.exec:\hhbnhh.exe105⤵PID:1284
-
\??\c:\5bntbh.exec:\5bntbh.exe106⤵PID:1248
-
\??\c:\ddpvj.exec:\ddpvj.exe107⤵PID:916
-
\??\c:\llflxlr.exec:\llflxlr.exe108⤵PID:2352
-
\??\c:\xrfflxl.exec:\xrfflxl.exe109⤵PID:2224
-
\??\c:\nntbhh.exec:\nntbhh.exe110⤵PID:1072
-
\??\c:\vpddj.exec:\vpddj.exe111⤵PID:2180
-
\??\c:\lflxrfr.exec:\lflxrfr.exe112⤵PID:372
-
\??\c:\9nntht.exec:\9nntht.exe113⤵PID:912
-
\??\c:\dddjd.exec:\dddjd.exe114⤵PID:2700
-
\??\c:\3xrxlrx.exec:\3xrxlrx.exe115⤵PID:2096
-
\??\c:\ffxxfrx.exec:\ffxxfrx.exe116⤵PID:2196
-
\??\c:\ntnhhb.exec:\ntnhhb.exe117⤵PID:1672
-
\??\c:\jjdjd.exec:\jjdjd.exe118⤵PID:2520
-
\??\c:\lrllxxl.exec:\lrllxxl.exe119⤵PID:2372
-
\??\c:\9llxrrr.exec:\9llxrrr.exe120⤵PID:1924
-
\??\c:\ntnbtt.exec:\ntnbtt.exe121⤵PID:2340
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-