Analysis
- max time kernel
150s - max time network
122s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system - submitted
27/01/2025, 04:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3ce66a1fbd937f66e09dd930ff9810085df5c2cfcbf73b7222e2fd72e375be79.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
- Target 3ce66a1fbd937f66e09dd930ff9810085df5c2cfcbf73b7222e2fd72e375be79.exe
- Size 454KB
- Sample250127-et8dmszph1
- SHA256 3ce66a1fbd937f66e09dd930ff9810085df5c2cfcbf73b7222e2fd72e375be79
- MD5 21d16acc93c32a23b0a5aa83751aa8c3
- SHA1 f23f918f5dc1efde30b924715fced1333ebe8337
- SHA512 6208ec9b0c0c7dd64333e48ac540833b7a1abb479d36133dd08ecd0bf68fb48092efa7930cec4e96deb55477d27e53354cf54116b9c3b4120f78a3cd1c62d2af
- SSDEEP 6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbea:q7Tc2NYHUrAwfMp3CDa
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Blackmoon family
- Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/2900-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2492-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2288-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-44-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2760-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-82-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2172-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3044-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1884-119-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1968-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1884-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1708-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1568-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1204-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1032-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/564-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2100-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2440-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2036-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2336-429-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1204-460-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/1724-498-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1952-517-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-644-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1800-844-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-869-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-894-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1740-944-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1728-947-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2384-1177-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2716-1190-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1568-1232-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 2900 jjjjp.exe 2492 rlffrrr.exe 2288 tnhhtb.exe 2760 tnhntb.exe 2720 9ppdj.exe 2772 xlrlfxl.exe 2588 bbnnhh.exe 2172 lfflrrx.exe 2628 jdjpd.exe 2612 rxrfxlf.exe 3044 jpjpd.exe 1884 lxxlxlf.exe 1968 jddvj.exe 1568 vpjvj.exe 1708 5rrxfrx.exe 2344 vpjjv.exe 848 ttnthh.exe 1204 pjvdj.exe 1360 bbbnbn.exe 2972 ppddj.exe 1732 hbbhnn.exe 480 vppvj.exe 1032 rlrxffr.exe 2168 btbbbt.exe 444 xxrfrrx.exe 2792 fffrlxx.exe 564 thbbbh.exe 1780 9rfflrf.exe 2228 3pjpv.exe 2104 frlrllr.exe 888 tnhhnb.exe 2956 tbbtbh.exe 2296 9jpjj.exe 2100 fxrlxlf.exe 2220 tnhtbn.exe 1528 dppvj.exe 2440 1rllrrl.exe 2280 xlxfflx.exe 2720 hthnbb.exe 2796 pjjpv.exe 2732 llxflxl.exe 2764 5fffrrx.exe 2604 7tbhtb.exe 2716 jjjvp.exe 2628 rrlxrfl.exe 2996 btnthh.exe 2396 pjdjv.exe 2036 ppjjp.exe 1420 rlfflrx.exe 1672 nhtbhb.exe 236 hbhntb.exe 2336 pjvdj.exe 680 7rfxffl.exe 1472 xrllxrx.exe 1656 5bhbhh.exe 2856 dvddd.exe 1204 9dvpp.exe 2892 lxllxxl.exe 1588 bbttbb.exe 988 pjdpd.exe 1732 jdppv.exe 2188 rfrlrll.exe 1724 tnhnbh.exe 2412 9htnnh.exe -
resource yara_rule behavioral1/memory/2900-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1884-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1568-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1204-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1032-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/564-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-273-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2956-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-294-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2100-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-498-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-517-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1312-580-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-599-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-631-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-644-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-711-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/756-718-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1360-731-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/480-756-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-807-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1800-844-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-869-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-894-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-944-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-1073-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1568-1232-0x00000000005C0000-0x00000000005EA000-memory.dmp upx behavioral1/memory/2984-1267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-1280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/812-1305-0x0000000000400000-0x000000000042A000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxfrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxxlfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxfrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nhttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btthtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rllllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrfllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffflxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrfrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlflxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2380 wrote to memory of 2900 2380 3ce66a1fbd937f66e09dd930ff9810085df5c2cfcbf73b7222e2fd72e375be79.exe 30 PID 2380 wrote to memory of 2900 2380 3ce66a1fbd937f66e09dd930ff9810085df5c2cfcbf73b7222e2fd72e375be79.exe 30 PID 2380 wrote to memory of 2900 2380 3ce66a1fbd937f66e09dd930ff9810085df5c2cfcbf73b7222e2fd72e375be79.exe 30 PID 2380 wrote to memory of 2900 2380 3ce66a1fbd937f66e09dd930ff9810085df5c2cfcbf73b7222e2fd72e375be79.exe 30 PID 2900 wrote to memory of 2492 2900 jjjjp.exe 31 PID 2900 wrote to memory of 2492 2900 jjjjp.exe 31 PID 2900 wrote to memory of 2492 2900 jjjjp.exe 31 PID 2900 wrote to memory of 2492 2900 jjjjp.exe 31 PID 2492 wrote to memory of 2288 2492 rlffrrr.exe 32 PID 2492 wrote to memory of 2288 2492 rlffrrr.exe 32 PID 2492 wrote to memory of 2288 2492 rlffrrr.exe 32 PID 2492 wrote to memory of 2288 2492 rlffrrr.exe 32 PID 2288 wrote to memory of 2760 2288 tnhhtb.exe 33 PID 2288 wrote to memory of 2760 2288 tnhhtb.exe 33 PID 2288 wrote to memory of 2760 2288 tnhhtb.exe 33 PID 2288 wrote to memory of 2760 2288 tnhhtb.exe 33 PID 2760 wrote to memory of 2720 2760 tnhntb.exe 34 PID 2760 wrote to memory of 2720 2760 tnhntb.exe 34 PID 2760 wrote to memory of 2720 2760 tnhntb.exe 34 PID 2760 wrote to memory of 2720 2760 tnhntb.exe 34 PID 2720 wrote to memory of 2772 2720 9ppdj.exe 35 PID 2720 wrote to memory of 2772 2720 9ppdj.exe 35 PID 2720 wrote to memory of 2772 2720 9ppdj.exe 35 PID 2720 wrote to memory of 2772 2720 9ppdj.exe 35 PID 2772 wrote to memory of 2588 2772 xlrlfxl.exe 36 PID 2772 wrote to memory of 2588 2772 xlrlfxl.exe 36 PID 2772 wrote to memory of 2588 2772 xlrlfxl.exe 36 PID 2772 wrote to memory of 2588 2772 xlrlfxl.exe 36 PID 2588 wrote to memory of 2172 2588 bbnnhh.exe 37 PID 2588 wrote to memory of 2172 2588 bbnnhh.exe 37 PID 2588 wrote to memory of 2172 2588 bbnnhh.exe 37 PID 2588 wrote to memory of 2172 2588 bbnnhh.exe 37 PID 2172 wrote to memory of 2628 2172 lfflrrx.exe 38 PID 2172 wrote to memory of 2628 2172 lfflrrx.exe 38 PID 2172 wrote to memory of 2628 2172 lfflrrx.exe 38 PID 2172 wrote to memory of 2628 2172 lfflrrx.exe 38 PID 2628 wrote to memory of 2612 2628 jdjpd.exe 39 PID 2628 wrote to memory of 2612 2628 jdjpd.exe 39 PID 2628 wrote to memory of 2612 2628 jdjpd.exe 39 PID 2628 wrote to memory of 2612 2628 jdjpd.exe 39 PID 2612 wrote to memory of 3044 2612 rxrfxlf.exe 40 PID 2612 wrote to memory of 3044 2612 rxrfxlf.exe 40 PID 2612 wrote to memory of 3044 2612 rxrfxlf.exe 40 PID 2612 wrote to memory of 3044 2612 rxrfxlf.exe 40 PID 3044 wrote to memory of 1884 3044 jpjpd.exe 41 PID 3044 wrote to memory of 1884 3044 jpjpd.exe 41 PID 3044 wrote to memory of 1884 3044 jpjpd.exe 41 PID 3044 wrote to memory of 1884 3044 jpjpd.exe 41 PID 1884 wrote to memory of 1968 1884 lxxlxlf.exe 42 PID 1884 wrote to memory of 1968 1884 lxxlxlf.exe 42 PID 1884 wrote to memory of 1968 1884 lxxlxlf.exe 42 PID 1884 wrote to memory of 1968 1884 lxxlxlf.exe 42 PID 1968 wrote to memory of 1568 1968 jddvj.exe 43 PID 1968 wrote to memory of 1568 1968 jddvj.exe 43 PID 1968 wrote to memory of 1568 1968 jddvj.exe 43 PID 1968 wrote to memory of 1568 1968 jddvj.exe 43 PID 1568 wrote to memory of 1708 1568 vpjvj.exe 44 PID 1568 wrote to memory of 1708 1568 vpjvj.exe 44 PID 1568 wrote to memory of 1708 1568 vpjvj.exe 44 PID 1568 wrote to memory of 1708 1568 vpjvj.exe 44 PID 1708 wrote to memory of 2344 1708 5rrxfrx.exe 45 PID 1708 wrote to memory of 2344 1708 5rrxfrx.exe 45 PID 1708 wrote to memory of 2344 1708 5rrxfrx.exe 45 PID 1708 wrote to memory of 2344 1708 5rrxfrx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ce66a1fbd937f66e09dd930ff9810085df5c2cfcbf73b7222e2fd72e375be79.exe"C:\Users\Admin\AppData\Local\Temp\3ce66a1fbd937f66e09dd930ff9810085df5c2cfcbf73b7222e2fd72e375be79.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\jjjjp.exec:\jjjjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\rlffrrr.exec:\rlffrrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\tnhhtb.exec:\tnhhtb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\tnhntb.exec:\tnhntb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\9ppdj.exec:\9ppdj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\xlrlfxl.exec:\xlrlfxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\bbnnhh.exec:\bbnnhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\lfflrrx.exec:\lfflrrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\jdjpd.exec:\jdjpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\rxrfxlf.exec:\rxrfxlf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\jpjpd.exec:\jpjpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\lxxlxlf.exec:\lxxlxlf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\jddvj.exec:\jddvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\vpjvj.exec:\vpjvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
\??\c:\5rrxfrx.exec:\5rrxfrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\vpjjv.exec:\vpjjv.exe17⤵
- Executes dropped EXE
PID:2344 -
\??\c:\ttnthh.exec:\ttnthh.exe18⤵
- Executes dropped EXE
PID:848 -
\??\c:\pjvdj.exec:\pjvdj.exe19⤵
- Executes dropped EXE
PID:1204 -
\??\c:\bbbnbn.exec:\bbbnbn.exe20⤵
- Executes dropped EXE
PID:1360 -
\??\c:\ppddj.exec:\ppddj.exe21⤵
- Executes dropped EXE
PID:2972 -
\??\c:\hbbhnn.exec:\hbbhnn.exe22⤵
- Executes dropped EXE
PID:1732 -
\??\c:\vppvj.exec:\vppvj.exe23⤵
- Executes dropped EXE
PID:480 -
\??\c:\rlrxffr.exec:\rlrxffr.exe24⤵
- Executes dropped EXE
PID:1032 -
\??\c:\btbbbt.exec:\btbbbt.exe25⤵
- Executes dropped EXE
PID:2168 -
\??\c:\xxrfrrx.exec:\xxrfrrx.exe26⤵
- Executes dropped EXE
PID:444 -
\??\c:\fffrlxx.exec:\fffrlxx.exe27⤵
- Executes dropped EXE
PID:2792 -
\??\c:\thbbbh.exec:\thbbbh.exe28⤵
- Executes dropped EXE
PID:564 -
\??\c:\9rfflrf.exec:\9rfflrf.exe29⤵
- Executes dropped EXE
PID:1780 -
\??\c:\3pjpv.exec:\3pjpv.exe30⤵
- Executes dropped EXE
PID:2228 -
\??\c:\frlrllr.exec:\frlrllr.exe31⤵
- Executes dropped EXE
PID:2104 -
\??\c:\tnhhnb.exec:\tnhhnb.exe32⤵
- Executes dropped EXE
PID:888 -
\??\c:\tbbtbh.exec:\tbbtbh.exe33⤵
- Executes dropped EXE
PID:2956 -
\??\c:\9jpjj.exec:\9jpjj.exe34⤵
- Executes dropped EXE
PID:2296 -
\??\c:\fxrlxlf.exec:\fxrlxlf.exe35⤵
- Executes dropped EXE
PID:2100 -
\??\c:\tnhtbn.exec:\tnhtbn.exe36⤵
- Executes dropped EXE
PID:2220 -
\??\c:\dppvj.exec:\dppvj.exe37⤵
- Executes dropped EXE
PID:1528 -
\??\c:\1rllrrl.exec:\1rllrrl.exe38⤵
- Executes dropped EXE
PID:2440 -
\??\c:\xlxfflx.exec:\xlxfflx.exe39⤵
- Executes dropped EXE
PID:2280 -
\??\c:\hthnbb.exec:\hthnbb.exe40⤵
- Executes dropped EXE
PID:2720 -
\??\c:\pjjpv.exec:\pjjpv.exe41⤵
- Executes dropped EXE
PID:2796 -
\??\c:\llxflxl.exec:\llxflxl.exe42⤵
- Executes dropped EXE
PID:2732 -
\??\c:\5fffrrx.exec:\5fffrrx.exe43⤵
- Executes dropped EXE
PID:2764 -
\??\c:\7tbhtb.exec:\7tbhtb.exe44⤵
- Executes dropped EXE
PID:2604 -
\??\c:\jjjvp.exec:\jjjvp.exe45⤵
- Executes dropped EXE
PID:2716 -
\??\c:\rrlxrfl.exec:\rrlxrfl.exe46⤵
- Executes dropped EXE
PID:2628 -
\??\c:\btnthh.exec:\btnthh.exe47⤵
- Executes dropped EXE
PID:2996 -
\??\c:\pjdjv.exec:\pjdjv.exe48⤵
- Executes dropped EXE
PID:2396 -
\??\c:\ppjjp.exec:\ppjjp.exe49⤵
- Executes dropped EXE
PID:2036 -
\??\c:\rlfflrx.exec:\rlfflrx.exe50⤵
- Executes dropped EXE
PID:1420 -
\??\c:\nhtbhb.exec:\nhtbhb.exe51⤵
- Executes dropped EXE
PID:1672 -
\??\c:\hbhntb.exec:\hbhntb.exe52⤵
- Executes dropped EXE
PID:236 -
\??\c:\pjvdj.exec:\pjvdj.exe53⤵
- Executes dropped EXE
PID:2336 -
\??\c:\7rfxffl.exec:\7rfxffl.exe54⤵
- Executes dropped EXE
PID:680 -
\??\c:\xrllxrx.exec:\xrllxrx.exe55⤵
- Executes dropped EXE
PID:1472 -
\??\c:\5bhbhh.exec:\5bhbhh.exe56⤵
- Executes dropped EXE
PID:1656 -
\??\c:\dvddd.exec:\dvddd.exe57⤵
- Executes dropped EXE
PID:2856 -
\??\c:\9dvpp.exec:\9dvpp.exe58⤵
- Executes dropped EXE
PID:1204 -
\??\c:\lxllxxl.exec:\lxllxxl.exe59⤵
- Executes dropped EXE
PID:2892 -
\??\c:\bbttbb.exec:\bbttbb.exe60⤵
- Executes dropped EXE
PID:1588 -
\??\c:\pjdpd.exec:\pjdpd.exe61⤵
- Executes dropped EXE
PID:988 -
\??\c:\jdppv.exec:\jdppv.exe62⤵
- Executes dropped EXE
PID:1732 -
\??\c:\rfrlrll.exec:\rfrlrll.exe63⤵
- Executes dropped EXE
PID:2188 -
\??\c:\tnhnbh.exec:\tnhnbh.exe64⤵
- Executes dropped EXE
PID:1724 -
\??\c:\9htnnh.exec:\9htnnh.exe65⤵
- Executes dropped EXE
PID:2412 -
\??\c:\3jvpv.exec:\3jvpv.exe66⤵PID:2552
-
\??\c:\rfrrxlr.exec:\rfrrxlr.exe67⤵PID:1952
-
\??\c:\llxfrfl.exec:\llxfrfl.exe68⤵PID:1600
-
\??\c:\thnhnn.exec:\thnhnn.exe69⤵PID:2032
-
\??\c:\jjjjv.exec:\jjjjv.exe70⤵PID:2424
-
\??\c:\fxllxxl.exec:\fxllxxl.exe71⤵PID:1412
-
\??\c:\xxrfrrx.exec:\xxrfrrx.exe72⤵
- System Location Discovery: System Language Discovery
PID:3048 -
\??\c:\tnbbhn.exec:\tnbbhn.exe73⤵PID:2064
-
\??\c:\dpjpd.exec:\dpjpd.exe74⤵PID:1868
-
\??\c:\jdppv.exec:\jdppv.exe75⤵PID:1824
-
\??\c:\3rrfxfl.exec:\3rrfxfl.exe76⤵PID:2148
-
\??\c:\btbhhh.exec:\btbhhh.exe77⤵PID:1856
-
\??\c:\1bnbbb.exec:\1bnbbb.exe78⤵PID:1312
-
\??\c:\pppvd.exec:\pppvd.exe79⤵PID:1532
-
\??\c:\xlrlrrx.exec:\xlrlrrx.exe80⤵PID:2288
-
\??\c:\xxrxllx.exec:\xxrxllx.exe81⤵PID:1804
-
\??\c:\tnhttt.exec:\tnhttt.exe82⤵PID:2776
-
\??\c:\pjdjv.exec:\pjdjv.exe83⤵PID:2924
-
\??\c:\jvjjj.exec:\jvjjj.exe84⤵PID:2076
-
\??\c:\fxllrrx.exec:\fxllrrx.exe85⤵PID:2616
-
\??\c:\9tnnbh.exec:\9tnnbh.exe86⤵PID:2756
-
\??\c:\pjddj.exec:\pjddj.exe87⤵PID:2808
-
\??\c:\ppjjj.exec:\ppjjj.exe88⤵PID:2576
-
\??\c:\rrlxlrf.exec:\rrlxlrf.exe89⤵PID:2748
-
\??\c:\tntbhh.exec:\tntbhh.exe90⤵PID:1972
-
\??\c:\bbtthn.exec:\bbtthn.exe91⤵PID:3012
-
\??\c:\jdjjv.exec:\jdjjv.exe92⤵PID:1820
-
\??\c:\ffrxlrx.exec:\ffrxlrx.exe93⤵PID:2036
-
\??\c:\xlxlxxf.exec:\xlxlxxf.exe94⤵PID:1420
-
\??\c:\5hhntb.exec:\5hhntb.exe95⤵PID:1704
-
\??\c:\vdvdp.exec:\vdvdp.exe96⤵PID:236
-
\??\c:\dpddv.exec:\dpddv.exe97⤵PID:1380
-
\??\c:\5rlrxff.exec:\5rlrxff.exe98⤵PID:864
-
\??\c:\bhnnhn.exec:\bhnnhn.exe99⤵PID:2872
-
\??\c:\btnbhh.exec:\btnbhh.exe100⤵PID:756
-
\??\c:\pjdpd.exec:\pjdpd.exe101⤵PID:2856
-
\??\c:\lfxflrl.exec:\lfxflrl.exe102⤵PID:1360
-
\??\c:\3lfrrll.exec:\3lfrrll.exe103⤵PID:2892
-
\??\c:\btntbh.exec:\btntbh.exe104⤵PID:1588
-
\??\c:\jddvd.exec:\jddvd.exe105⤵PID:988
-
\??\c:\vpjdp.exec:\vpjdp.exe106⤵PID:480
-
\??\c:\rfxfrrx.exec:\rfxfrrx.exe107⤵PID:1032
-
\??\c:\5hhntb.exec:\5hhntb.exe108⤵PID:1576
-
\??\c:\bnbbhb.exec:\bnbbhb.exe109⤵PID:2412
-
\??\c:\dvppp.exec:\dvppp.exe110⤵PID:2552
-
\??\c:\rfllrlr.exec:\rfllrlr.exe111⤵PID:1952
-
\??\c:\xxrrfxf.exec:\xxrrfxf.exe112⤵PID:1600
-
\??\c:\3nbttb.exec:\3nbttb.exe113⤵PID:2156
-
\??\c:\dvppv.exec:\dvppv.exe114⤵PID:2328
-
\??\c:\dvpvd.exec:\dvpvd.exe115⤵PID:1412
-
\??\c:\flfrxxr.exec:\flfrxxr.exe116⤵PID:3048
-
\??\c:\nnbtbh.exec:\nnbtbh.exe117⤵PID:2064
-
\??\c:\ppddd.exec:\ppddd.exe118⤵PID:1868
-
\??\c:\pdvvd.exec:\pdvvd.exe119⤵PID:2472
-
\??\c:\xxllllr.exec:\xxllllr.exe120⤵PID:1800
-
\??\c:\xrlfxfl.exec:\xrlfxfl.exe121⤵PID:1856
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-