Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
27/02/2025, 02:54
Behavioral task
behavioral1
Sample
9e20ec5c0fca15d87bf1ab7ac0d25ca9d447decf9f5335c38fca3c4ee6487cfa.exe
Resource
win7-20241023-en
7 signatures
150 seconds
General
-
Target
9e20ec5c0fca15d87bf1ab7ac0d25ca9d447decf9f5335c38fca3c4ee6487cfa.exe
-
Size
91KB
-
MD5
e998f8d5decef98e24c038c41b59f7e8
-
SHA1
4a0e85ee2e1fd5dfdd74a3273f5a6a8a8a278697
-
SHA256
9e20ec5c0fca15d87bf1ab7ac0d25ca9d447decf9f5335c38fca3c4ee6487cfa
-
SHA512
1eaf4a160a7ef1b63f3866debb905861a46332a5770b451038414f08d5e3ca9608eedf5ce53272c56ea2b952e582b47d3a73bcd41e398c171dea91eb98cd2115
-
SSDEEP
1536:8vQBeOGtrYS3srx93UBWfwC6Ggnouy80fg3Cip8iXAsG5M0u5fVBY:8hOmTsF93UYfwC6GIout0fmCiiiXA6Ng
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral1/memory/1484-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1512-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/320-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1028-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2788-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2932-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2932-56-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2932-55-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2940-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2940-71-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2832-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2704-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1588-108-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/1588-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1856-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3000-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3044-147-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/596-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2112-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1940-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2424-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1776-224-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/1360-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1776-254-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/2120-262-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1520-268-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2080-279-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1748-292-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1908-303-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2836-315-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2836-314-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2888-321-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2916-327-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2812-334-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2988-340-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1932-373-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/868-401-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2428-422-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1208-426-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/2308-441-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2308-440-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1940-458-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1280-469-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1796-496-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2776-502-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1160-509-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2500-514-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/892-526-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2104-573-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/2932-584-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2988-600-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2508-627-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1388-639-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1952-690-0x0000000000260000-0x0000000000287000-memory.dmp family_blackmoon behavioral1/memory/2140-702-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2584-735-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/1792-757-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2968-824-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2836-830-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2736-873-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2864-879-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2000-10197-0x00000000777E0000-0x00000000778FF000-memory.dmp family_blackmoon behavioral1/memory/2000-12475-0x00000000776E0000-0x00000000777DA000-memory.dmp family_blackmoon behavioral1/memory/2000-12474-0x00000000777E0000-0x00000000778FF000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1512 pjvdj.exe 320 k82244.exe 1028 rlxlxfl.exe 2788 7lflrrf.exe 2824 bthnbb.exe 2932 thhbhh.exe 2700 k02288.exe 2940 ppddj.exe 2832 c262006.exe 2704 jdvvd.exe 1932 llffffr.exe 1588 7thhtn.exe 1856 a6440.exe 3000 lxllrrl.exe 548 hhttbb.exe 1704 1dppj.exe 3044 4800280.exe 2368 u462224.exe 1208 jppjj.exe 2180 866628.exe 596 rrflllr.exe 2112 04280.exe 1940 rlflxxl.exe 2424 7tttbb.exe 2956 864402.exe 2732 1btbhh.exe 1776 9ththb.exe 1360 822466.exe 2668 684484.exe 2592 5tnbnh.exe 1008 btnnbt.exe 2120 04288.exe 1520 flxxxrl.exe 1852 404800.exe 2080 864066.exe 2008 086244.exe 1748 nhtntn.exe 2596 c240006.exe 1908 62022.exe 2968 82262.exe 2836 a2662.exe 2888 dvjdp.exe 2916 1rlrllx.exe 2812 8268444.exe 2988 264626.exe 2748 u484040.exe 2712 nhnntt.exe 2928 rlxrlrx.exe 2768 pvjjj.exe 2508 080060.exe 1932 bbnnbn.exe 1920 3xffrxl.exe 3056 nbtnhn.exe 2984 dvddp.exe 1752 1frrxfr.exe 868 86440.exe 3036 flfrlll.exe 1928 g8664.exe 2156 vpjvv.exe 2428 2666484.exe 1208 a4860.exe 2256 tnbbnn.exe 2308 s4802.exe 1244 02680.exe -
resource yara_rule behavioral1/memory/1484-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1484-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000d000000012280-7.dat upx behavioral1/memory/1512-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000186f1-17.dat upx behavioral1/memory/320-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1028-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000186f4-23.dat upx behavioral1/memory/1028-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018704-33.dat upx behavioral1/files/0x0006000000018739-40.dat upx behavioral1/memory/2788-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018744-48.dat upx behavioral1/files/0x00050000000193df-66.dat upx behavioral1/files/0x00070000000193c4-59.dat upx behavioral1/memory/2932-58-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019451-74.dat upx behavioral1/memory/2832-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2940-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2832-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019458-84.dat upx behavioral1/memory/2704-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194a9-91.dat upx behavioral1/files/0x00050000000194b9-101.dat upx behavioral1/memory/1932-99-0x00000000001B0000-0x00000000001D7000-memory.dmp upx behavioral1/memory/1588-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194c9-109.dat upx behavioral1/files/0x00050000000194ee-117.dat upx behavioral1/memory/1856-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3000-126-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194f1-125.dat upx behavioral1/files/0x0005000000019502-133.dat upx behavioral1/files/0x0005000000019509-140.dat upx behavioral1/memory/3044-147-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001950e-148.dat upx behavioral1/files/0x0005000000019512-155.dat upx behavioral1/memory/1208-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001957e-163.dat upx behavioral1/files/0x000500000001958e-171.dat upx behavioral1/memory/596-177-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195ab-178.dat upx behavioral1/files/0x00050000000195f0-186.dat upx behavioral1/memory/2112-185-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1940-194-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000900000001755b-195.dat upx behavioral1/files/0x0005000000019621-202.dat upx behavioral1/memory/2424-201-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019623-209.dat upx behavioral1/files/0x0005000000019624-216.dat upx behavioral1/files/0x0005000000019625-225.dat upx behavioral1/memory/1776-224-0x00000000002A0000-0x00000000002C7000-memory.dmp upx behavioral1/files/0x0005000000019627-233.dat upx behavioral1/memory/1360-232-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019629-240.dat upx behavioral1/files/0x000500000001962b-247.dat upx behavioral1/files/0x000500000001962d-255.dat upx behavioral1/memory/2120-262-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1520-268-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2080-279-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1748-286-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1748-292-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1908-303-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2836-314-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2888-321-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rfrfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfllrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hbhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82828.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44284.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0806006.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4486408.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 604026.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1484 wrote to memory of 1512 1484 9e20ec5c0fca15d87bf1ab7ac0d25ca9d447decf9f5335c38fca3c4ee6487cfa.exe 31 PID 1484 wrote to memory of 1512 1484 9e20ec5c0fca15d87bf1ab7ac0d25ca9d447decf9f5335c38fca3c4ee6487cfa.exe 31 PID 1484 wrote to memory of 1512 1484 9e20ec5c0fca15d87bf1ab7ac0d25ca9d447decf9f5335c38fca3c4ee6487cfa.exe 31 PID 1484 wrote to memory of 1512 1484 9e20ec5c0fca15d87bf1ab7ac0d25ca9d447decf9f5335c38fca3c4ee6487cfa.exe 31 PID 1512 wrote to memory of 320 1512 pjvdj.exe 32 PID 1512 wrote to memory of 320 1512 pjvdj.exe 32 PID 1512 wrote to memory of 320 1512 pjvdj.exe 32 PID 1512 wrote to memory of 320 1512 pjvdj.exe 32 PID 320 wrote to memory of 1028 320 k82244.exe 33 PID 320 wrote to memory of 1028 320 k82244.exe 33 PID 320 wrote to memory of 1028 320 k82244.exe 33 PID 320 wrote to memory of 1028 320 k82244.exe 33 PID 1028 wrote to memory of 2788 1028 rlxlxfl.exe 34 PID 1028 wrote to memory of 2788 1028 rlxlxfl.exe 34 PID 1028 wrote to memory of 2788 1028 rlxlxfl.exe 34 PID 1028 wrote to memory of 2788 1028 rlxlxfl.exe 34 PID 2788 wrote to memory of 2824 2788 7lflrrf.exe 35 PID 2788 wrote to memory of 2824 2788 7lflrrf.exe 35 PID 2788 wrote to memory of 2824 2788 7lflrrf.exe 35 PID 2788 wrote to memory of 2824 2788 7lflrrf.exe 35 PID 2824 wrote to memory of 2932 2824 bthnbb.exe 36 PID 2824 wrote to memory of 2932 2824 bthnbb.exe 36 PID 2824 wrote to memory of 2932 2824 bthnbb.exe 36 PID 2824 wrote to memory of 2932 2824 bthnbb.exe 36 PID 2932 wrote to memory of 2700 2932 thhbhh.exe 37 PID 2932 wrote to memory of 2700 2932 thhbhh.exe 37 PID 2932 wrote to memory of 2700 2932 thhbhh.exe 37 PID 2932 wrote to memory of 2700 2932 thhbhh.exe 37 PID 2700 wrote to memory of 2940 2700 k02288.exe 38 PID 2700 wrote to memory of 2940 2700 k02288.exe 38 PID 2700 wrote to memory of 2940 2700 k02288.exe 38 PID 2700 wrote to memory of 2940 2700 k02288.exe 38 PID 2940 wrote to memory of 2832 2940 ppddj.exe 39 PID 2940 wrote to memory of 2832 2940 ppddj.exe 39 PID 2940 wrote to memory of 2832 2940 ppddj.exe 39 PID 2940 wrote to memory of 2832 2940 ppddj.exe 39 PID 2832 wrote to memory of 2704 2832 c262006.exe 40 PID 2832 wrote to memory of 2704 2832 c262006.exe 40 PID 2832 wrote to memory of 2704 2832 c262006.exe 40 PID 2832 wrote to memory of 2704 2832 c262006.exe 40 PID 2704 wrote to memory of 1932 2704 jdvvd.exe 41 PID 2704 wrote to memory of 1932 2704 jdvvd.exe 41 PID 2704 wrote to memory of 1932 2704 jdvvd.exe 41 PID 2704 wrote to memory of 1932 2704 jdvvd.exe 41 PID 1932 wrote to memory of 1588 1932 llffffr.exe 42 PID 1932 wrote to memory of 1588 1932 llffffr.exe 42 PID 1932 wrote to memory of 1588 1932 llffffr.exe 42 PID 1932 wrote to memory of 1588 1932 llffffr.exe 42 PID 1588 wrote to memory of 1856 1588 7thhtn.exe 43 PID 1588 wrote to memory of 1856 1588 7thhtn.exe 43 PID 1588 wrote to memory of 1856 1588 7thhtn.exe 43 PID 1588 wrote to memory of 1856 1588 7thhtn.exe 43 PID 1856 wrote to memory of 3000 1856 a6440.exe 44 PID 1856 wrote to memory of 3000 1856 a6440.exe 44 PID 1856 wrote to memory of 3000 1856 a6440.exe 44 PID 1856 wrote to memory of 3000 1856 a6440.exe 44 PID 3000 wrote to memory of 548 3000 lxllrrl.exe 45 PID 3000 wrote to memory of 548 3000 lxllrrl.exe 45 PID 3000 wrote to memory of 548 3000 lxllrrl.exe 45 PID 3000 wrote to memory of 548 3000 lxllrrl.exe 45 PID 548 wrote to memory of 1704 548 hhttbb.exe 46 PID 548 wrote to memory of 1704 548 hhttbb.exe 46 PID 548 wrote to memory of 1704 548 hhttbb.exe 46 PID 548 wrote to memory of 1704 548 hhttbb.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\9e20ec5c0fca15d87bf1ab7ac0d25ca9d447decf9f5335c38fca3c4ee6487cfa.exe"C:\Users\Admin\AppData\Local\Temp\9e20ec5c0fca15d87bf1ab7ac0d25ca9d447decf9f5335c38fca3c4ee6487cfa.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\pjvdj.exec:\pjvdj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\k82244.exec:\k82244.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\rlxlxfl.exec:\rlxlxfl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
\??\c:\7lflrrf.exec:\7lflrrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\bthnbb.exec:\bthnbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\thhbhh.exec:\thhbhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\k02288.exec:\k02288.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\ppddj.exec:\ppddj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\c262006.exec:\c262006.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\jdvvd.exec:\jdvvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\llffffr.exec:\llffffr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\7thhtn.exec:\7thhtn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\a6440.exec:\a6440.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
\??\c:\lxllrrl.exec:\lxllrrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\hhttbb.exec:\hhttbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
\??\c:\1dppj.exec:\1dppj.exe17⤵
- Executes dropped EXE
PID:1704 -
\??\c:\4800280.exec:\4800280.exe18⤵
- Executes dropped EXE
PID:3044 -
\??\c:\u462224.exec:\u462224.exe19⤵
- Executes dropped EXE
PID:2368 -
\??\c:\jppjj.exec:\jppjj.exe20⤵
- Executes dropped EXE
PID:1208 -
\??\c:\866628.exec:\866628.exe21⤵
- Executes dropped EXE
PID:2180 -
\??\c:\rrflllr.exec:\rrflllr.exe22⤵
- Executes dropped EXE
PID:596 -
\??\c:\04280.exec:\04280.exe23⤵
- Executes dropped EXE
PID:2112 -
\??\c:\rlflxxl.exec:\rlflxxl.exe24⤵
- Executes dropped EXE
PID:1940 -
\??\c:\7tttbb.exec:\7tttbb.exe25⤵
- Executes dropped EXE
PID:2424 -
\??\c:\864402.exec:\864402.exe26⤵
- Executes dropped EXE
PID:2956 -
\??\c:\1btbhh.exec:\1btbhh.exe27⤵
- Executes dropped EXE
PID:2732 -
\??\c:\9ththb.exec:\9ththb.exe28⤵
- Executes dropped EXE
PID:1776 -
\??\c:\822466.exec:\822466.exe29⤵
- Executes dropped EXE
PID:1360 -
\??\c:\684484.exec:\684484.exe30⤵
- Executes dropped EXE
PID:2668 -
\??\c:\5tnbnh.exec:\5tnbnh.exe31⤵
- Executes dropped EXE
PID:2592 -
\??\c:\btnnbt.exec:\btnnbt.exe32⤵
- Executes dropped EXE
PID:1008 -
\??\c:\04288.exec:\04288.exe33⤵
- Executes dropped EXE
PID:2120 -
\??\c:\flxxxrl.exec:\flxxxrl.exe34⤵
- Executes dropped EXE
PID:1520 -
\??\c:\404800.exec:\404800.exe35⤵
- Executes dropped EXE
PID:1852 -
\??\c:\864066.exec:\864066.exe36⤵
- Executes dropped EXE
PID:2080 -
\??\c:\086244.exec:\086244.exe37⤵
- Executes dropped EXE
PID:2008 -
\??\c:\nhtntn.exec:\nhtntn.exe38⤵
- Executes dropped EXE
PID:1748 -
\??\c:\c240006.exec:\c240006.exe39⤵
- Executes dropped EXE
PID:2596 -
\??\c:\62022.exec:\62022.exe40⤵
- Executes dropped EXE
PID:1908 -
\??\c:\82262.exec:\82262.exe41⤵
- Executes dropped EXE
PID:2968 -
\??\c:\a2662.exec:\a2662.exe42⤵
- Executes dropped EXE
PID:2836 -
\??\c:\dvjdp.exec:\dvjdp.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2888 -
\??\c:\1rlrllx.exec:\1rlrllx.exe44⤵
- Executes dropped EXE
PID:2916 -
\??\c:\8268444.exec:\8268444.exe45⤵
- Executes dropped EXE
PID:2812 -
\??\c:\264626.exec:\264626.exe46⤵
- Executes dropped EXE
PID:2988 -
\??\c:\u484040.exec:\u484040.exe47⤵
- Executes dropped EXE
PID:2748 -
\??\c:\nhnntt.exec:\nhnntt.exe48⤵
- Executes dropped EXE
PID:2712 -
\??\c:\rlxrlrx.exec:\rlxrlrx.exe49⤵
- Executes dropped EXE
PID:2928 -
\??\c:\pvjjj.exec:\pvjjj.exe50⤵
- Executes dropped EXE
PID:2768 -
\??\c:\080060.exec:\080060.exe51⤵
- Executes dropped EXE
PID:2508 -
\??\c:\bbnnbn.exec:\bbnnbn.exe52⤵
- Executes dropped EXE
PID:1932 -
\??\c:\3xffrxl.exec:\3xffrxl.exe53⤵
- Executes dropped EXE
PID:1920 -
\??\c:\nbtnhn.exec:\nbtnhn.exe54⤵
- Executes dropped EXE
PID:3056 -
\??\c:\dvddp.exec:\dvddp.exe55⤵
- Executes dropped EXE
PID:2984 -
\??\c:\1frrxfr.exec:\1frrxfr.exe56⤵
- Executes dropped EXE
PID:1752 -
\??\c:\86440.exec:\86440.exe57⤵
- Executes dropped EXE
PID:868 -
\??\c:\flfrlll.exec:\flfrlll.exe58⤵
- Executes dropped EXE
PID:3036 -
\??\c:\g8664.exec:\g8664.exe59⤵
- Executes dropped EXE
PID:1928 -
\??\c:\vpjvv.exec:\vpjvv.exe60⤵
- Executes dropped EXE
PID:2156 -
\??\c:\2666484.exec:\2666484.exe61⤵
- Executes dropped EXE
PID:2428 -
\??\c:\a4860.exec:\a4860.exe62⤵
- Executes dropped EXE
PID:1208 -
\??\c:\tnbbnn.exec:\tnbbnn.exe63⤵
- Executes dropped EXE
PID:2256 -
\??\c:\s4802.exec:\s4802.exe64⤵
- Executes dropped EXE
PID:2308 -
\??\c:\02680.exec:\02680.exe65⤵
- Executes dropped EXE
PID:1244 -
\??\c:\pvvpj.exec:\pvvpj.exe66⤵PID:960
-
\??\c:\xlrflfl.exec:\xlrflfl.exe67⤵PID:1940
-
\??\c:\9lxffxx.exec:\9lxffxx.exe68⤵PID:1616
-
\??\c:\0428440.exec:\0428440.exe69⤵PID:1280
-
\??\c:\04406.exec:\04406.exe70⤵PID:1040
-
\??\c:\hbbbbh.exec:\hbbbbh.exe71⤵PID:956
-
\??\c:\w42200.exec:\w42200.exe72⤵PID:1772
-
\??\c:\xlrrrrr.exec:\xlrrrrr.exe73⤵PID:888
-
\??\c:\o806666.exec:\o806666.exe74⤵PID:1796
-
\??\c:\rlfrrrf.exec:\rlfrrrf.exe75⤵PID:2776
-
\??\c:\608024.exec:\608024.exe76⤵PID:1160
-
\??\c:\i644000.exec:\i644000.exe77⤵PID:2500
-
\??\c:\1dpvv.exec:\1dpvv.exe78⤵PID:2880
-
\??\c:\080684.exec:\080684.exe79⤵PID:2624
-
\??\c:\m8662.exec:\m8662.exe80⤵PID:892
-
\??\c:\264066.exec:\264066.exe81⤵PID:1852
-
\??\c:\20888.exec:\20888.exe82⤵PID:2080
-
\??\c:\8622284.exec:\8622284.exe83⤵PID:2008
-
\??\c:\q20680.exec:\q20680.exe84⤵PID:580
-
\??\c:\vppdd.exec:\vppdd.exe85⤵PID:2612
-
\??\c:\vpdvv.exec:\vpdvv.exe86⤵PID:2884
-
\??\c:\xxfxxxx.exec:\xxfxxxx.exe87⤵PID:2440
-
\??\c:\48040.exec:\48040.exe88⤵PID:2104
-
\??\c:\rrlxlll.exec:\rrlxlll.exe89⤵PID:780
-
\??\c:\086284.exec:\086284.exe90⤵PID:2932
-
\??\c:\rlxxfff.exec:\rlxxfff.exe91⤵PID:2820
-
\??\c:\nbhhhh.exec:\nbhhhh.exe92⤵PID:2812
-
\??\c:\426688.exec:\426688.exe93⤵PID:2988
-
\??\c:\k68022.exec:\k68022.exe94⤵PID:2936
-
\??\c:\2646880.exec:\2646880.exe95⤵PID:2736
-
\??\c:\264066.exec:\264066.exe96⤵PID:2928
-
\??\c:\480688.exec:\480688.exe97⤵PID:1804
-
\??\c:\i202406.exec:\i202406.exe98⤵PID:2508
-
\??\c:\8800886.exec:\8800886.exe99⤵PID:1316
-
\??\c:\lxlfllr.exec:\lxlfllr.exe100⤵PID:1388
-
\??\c:\280424.exec:\280424.exe101⤵PID:2432
-
\??\c:\thhtnh.exec:\thhtnh.exe102⤵PID:2588
-
\??\c:\hnbtbt.exec:\hnbtbt.exe103⤵PID:1992
-
\??\c:\48640.exec:\48640.exe104⤵PID:3008
-
\??\c:\1thhbh.exec:\1thhbh.exe105⤵PID:2980
-
\??\c:\rflffff.exec:\rflffff.exe106⤵PID:1304
-
\??\c:\vjvvv.exec:\vjvvv.exe107⤵PID:1912
-
\??\c:\0422406.exec:\0422406.exe108⤵PID:1960
-
\??\c:\04226.exec:\04226.exe109⤵PID:2140
-
\??\c:\8606806.exec:\8606806.exe110⤵PID:1952
-
\??\c:\s8624.exec:\s8624.exe111⤵PID:2228
-
\??\c:\08844.exec:\08844.exe112⤵PID:2580
-
\??\c:\86002.exec:\86002.exe113⤵PID:1204
-
\??\c:\3rllxxl.exec:\3rllxxl.exe114⤵PID:960
-
\??\c:\nbhhtn.exec:\nbhhtn.exe115⤵PID:1820
-
\??\c:\xxflxxx.exec:\xxflxxx.exe116⤵PID:928
-
\??\c:\jvdvv.exec:\jvdvv.exe117⤵PID:1280
-
\??\c:\2682440.exec:\2682440.exe118⤵PID:2584
-
\??\c:\hhbhnn.exec:\hhbhnn.exe119⤵PID:1556
-
\??\c:\9jppv.exec:\9jppv.exe120⤵PID:1772
-
\??\c:\20888.exec:\20888.exe121⤵PID:840
-
\??\c:\i822824.exec:\i822824.exe122⤵PID:1792
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-