Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/03/2025, 19:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4802dcc7e09a05cb13c2312de9aeefeeda2e3adb31a64221268d60f4e6f22967.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
4802dcc7e09a05cb13c2312de9aeefeeda2e3adb31a64221268d60f4e6f22967.exe
-
Size
458KB
-
MD5
784872ea17556eb59718107706d52b98
-
SHA1
626bbdd4366e12b055edcfcb944181a17e35d44c
-
SHA256
4802dcc7e09a05cb13c2312de9aeefeeda2e3adb31a64221268d60f4e6f22967
-
SHA512
5369e2b0ae1bbd0476e99e0e2723c1eb20456e137924e3e4bbd56aaf74055381367169398f18e3b2a29d0b895ef04471fedded5a8505a028f7771f6c027a129f
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe5:q7Tc2NYHUrAwfMp3CD5
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/2432-561-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2264-535-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2284-459-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2284-458-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2276-451-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1044-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-412-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1784-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-320-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2396-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/896-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/944-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/408-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1608-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1644-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1996-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1388-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1860-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1312-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3052-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1772-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1356-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2312-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2100-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-598-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1244-660-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1992-699-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1160-718-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2392-773-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2900-794-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2504-808-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1564-853-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-879-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2708-910-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2432-1110-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2312 llfflrf.exe 1356 hnbbhn.exe 2292 rrfxfxl.exe 2804 ddvjp.exe 2736 1xrrrrl.exe 2756 3nhntb.exe 1772 7fxfflx.exe 2612 tbbnhn.exe 3052 pjjjv.exe 2644 btnnbh.exe 1312 1lffffl.exe 1860 hbnhnt.exe 1388 lfflxxf.exe 1996 rffxflr.exe 1224 vvpvj.exe 1156 vvvdp.exe 1644 7tnntb.exe 2692 9jvdp.exe 568 rllxlrx.exe 2236 tnhthh.exe 1608 7ffrlrl.exe 408 lxrxlrx.exe 1684 vppvp.exe 944 3vpjp.exe 896 9bnnbb.exe 1104 3jvpp.exe 2528 xrfxflx.exe 2548 dvpvd.exe 1052 btbbnt.exe 2996 jdppv.exe 2524 3lllffr.exe 2396 5ttbnt.exe 1564 djdpv.exe 2688 3xfxxfl.exe 2704 ttthnn.exe 2816 nhtttn.exe 2720 1pjdj.exe 2852 1jvpp.exe 2920 rxxlxxl.exe 1784 rflrfxl.exe 2708 nhbbtt.exe 2672 dvjvd.exe 2164 dpddj.exe 2768 xrxxffl.exe 984 xlxxxfr.exe 1480 nnnbbb.exe 2912 ttbhhh.exe 1312 djvpv.exe 2364 1flfllr.exe 1620 5frlxfl.exe 2424 bbthtb.exe 2012 thbhbh.exe 2088 vpddp.exe 1044 jvjdp.exe 2276 xrffxxf.exe 2284 nhtthn.exe 692 bnbbbt.exe 952 9vppv.exe 2924 rfxxxff.exe 2232 xrllxfr.exe 2116 hbbhbb.exe 2328 nhtbbh.exe 1080 7vjdj.exe 1616 xrrrrxl.exe -
resource yara_rule behavioral1/memory/2432-561-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-535-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1080-496-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1044-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1784-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/896-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/896-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/944-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/408-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1224-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1388-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1860-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1312-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1772-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-55-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2804-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1356-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-686-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1160-718-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-786-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2504-808-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1564-853-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-1032-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1948-1046-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-1059-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-1124-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nhntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7thntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1fllxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2100 wrote to memory of 2312 2100 4802dcc7e09a05cb13c2312de9aeefeeda2e3adb31a64221268d60f4e6f22967.exe 30 PID 2100 wrote to memory of 2312 2100 4802dcc7e09a05cb13c2312de9aeefeeda2e3adb31a64221268d60f4e6f22967.exe 30 PID 2100 wrote to memory of 2312 2100 4802dcc7e09a05cb13c2312de9aeefeeda2e3adb31a64221268d60f4e6f22967.exe 30 PID 2100 wrote to memory of 2312 2100 4802dcc7e09a05cb13c2312de9aeefeeda2e3adb31a64221268d60f4e6f22967.exe 30 PID 2312 wrote to memory of 1356 2312 llfflrf.exe 31 PID 2312 wrote to memory of 1356 2312 llfflrf.exe 31 PID 2312 wrote to memory of 1356 2312 llfflrf.exe 31 PID 2312 wrote to memory of 1356 2312 llfflrf.exe 31 PID 1356 wrote to memory of 2292 1356 hnbbhn.exe 32 PID 1356 wrote to memory of 2292 1356 hnbbhn.exe 32 PID 1356 wrote to memory of 2292 1356 hnbbhn.exe 32 PID 1356 wrote to memory of 2292 1356 hnbbhn.exe 32 PID 2292 wrote to memory of 2804 2292 rrfxfxl.exe 33 PID 2292 wrote to memory of 2804 2292 rrfxfxl.exe 33 PID 2292 wrote to memory of 2804 2292 rrfxfxl.exe 33 PID 2292 wrote to memory of 2804 2292 rrfxfxl.exe 33 PID 2804 wrote to memory of 2736 2804 ddvjp.exe 34 PID 2804 wrote to memory of 2736 2804 ddvjp.exe 34 PID 2804 wrote to memory of 2736 2804 ddvjp.exe 34 PID 2804 wrote to memory of 2736 2804 ddvjp.exe 34 PID 2736 wrote to memory of 2756 2736 1xrrrrl.exe 35 PID 2736 wrote to memory of 2756 2736 1xrrrrl.exe 35 PID 2736 wrote to memory of 2756 2736 1xrrrrl.exe 35 PID 2736 wrote to memory of 2756 2736 1xrrrrl.exe 35 PID 2756 wrote to memory of 1772 2756 3nhntb.exe 36 PID 2756 wrote to memory of 1772 2756 3nhntb.exe 36 PID 2756 wrote to memory of 1772 2756 3nhntb.exe 36 PID 2756 wrote to memory of 1772 2756 3nhntb.exe 36 PID 1772 wrote to memory of 2612 1772 7fxfflx.exe 37 PID 1772 wrote to memory of 2612 1772 7fxfflx.exe 37 PID 1772 wrote to memory of 2612 1772 7fxfflx.exe 37 PID 1772 wrote to memory of 2612 1772 7fxfflx.exe 37 PID 2612 wrote to memory of 3052 2612 tbbnhn.exe 38 PID 2612 wrote to memory of 3052 2612 tbbnhn.exe 38 PID 2612 wrote to memory of 3052 2612 tbbnhn.exe 38 PID 2612 wrote to memory of 3052 2612 tbbnhn.exe 38 PID 3052 wrote to memory of 2644 3052 pjjjv.exe 39 PID 3052 wrote to memory of 2644 3052 pjjjv.exe 39 PID 3052 wrote to memory of 2644 3052 pjjjv.exe 39 PID 3052 wrote to memory of 2644 3052 pjjjv.exe 39 PID 2644 wrote to memory of 1312 2644 btnnbh.exe 40 PID 2644 wrote to memory of 1312 2644 btnnbh.exe 40 PID 2644 wrote to memory of 1312 2644 btnnbh.exe 40 PID 2644 wrote to memory of 1312 2644 btnnbh.exe 40 PID 1312 wrote to memory of 1860 1312 1lffffl.exe 41 PID 1312 wrote to memory of 1860 1312 1lffffl.exe 41 PID 1312 wrote to memory of 1860 1312 1lffffl.exe 41 PID 1312 wrote to memory of 1860 1312 1lffffl.exe 41 PID 1860 wrote to memory of 1388 1860 hbnhnt.exe 42 PID 1860 wrote to memory of 1388 1860 hbnhnt.exe 42 PID 1860 wrote to memory of 1388 1860 hbnhnt.exe 42 PID 1860 wrote to memory of 1388 1860 hbnhnt.exe 42 PID 1388 wrote to memory of 1996 1388 lfflxxf.exe 43 PID 1388 wrote to memory of 1996 1388 lfflxxf.exe 43 PID 1388 wrote to memory of 1996 1388 lfflxxf.exe 43 PID 1388 wrote to memory of 1996 1388 lfflxxf.exe 43 PID 1996 wrote to memory of 1224 1996 rffxflr.exe 44 PID 1996 wrote to memory of 1224 1996 rffxflr.exe 44 PID 1996 wrote to memory of 1224 1996 rffxflr.exe 44 PID 1996 wrote to memory of 1224 1996 rffxflr.exe 44 PID 1224 wrote to memory of 1156 1224 vvpvj.exe 45 PID 1224 wrote to memory of 1156 1224 vvpvj.exe 45 PID 1224 wrote to memory of 1156 1224 vvpvj.exe 45 PID 1224 wrote to memory of 1156 1224 vvpvj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\4802dcc7e09a05cb13c2312de9aeefeeda2e3adb31a64221268d60f4e6f22967.exe"C:\Users\Admin\AppData\Local\Temp\4802dcc7e09a05cb13c2312de9aeefeeda2e3adb31a64221268d60f4e6f22967.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\llfflrf.exec:\llfflrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\hnbbhn.exec:\hnbbhn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
\??\c:\rrfxfxl.exec:\rrfxfxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\ddvjp.exec:\ddvjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\1xrrrrl.exec:\1xrrrrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\3nhntb.exec:\3nhntb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\7fxfflx.exec:\7fxfflx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
\??\c:\tbbnhn.exec:\tbbnhn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\pjjjv.exec:\pjjjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\btnnbh.exec:\btnnbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\1lffffl.exec:\1lffffl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\hbnhnt.exec:\hbnhnt.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\lfflxxf.exec:\lfflxxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\rffxflr.exec:\rffxflr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\vvpvj.exec:\vvpvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
\??\c:\vvvdp.exec:\vvvdp.exe17⤵
- Executes dropped EXE
PID:1156 -
\??\c:\7tnntb.exec:\7tnntb.exe18⤵
- Executes dropped EXE
PID:1644 -
\??\c:\9jvdp.exec:\9jvdp.exe19⤵
- Executes dropped EXE
PID:2692 -
\??\c:\rllxlrx.exec:\rllxlrx.exe20⤵
- Executes dropped EXE
PID:568 -
\??\c:\tnhthh.exec:\tnhthh.exe21⤵
- Executes dropped EXE
PID:2236 -
\??\c:\7ffrlrl.exec:\7ffrlrl.exe22⤵
- Executes dropped EXE
PID:1608 -
\??\c:\lxrxlrx.exec:\lxrxlrx.exe23⤵
- Executes dropped EXE
PID:408 -
\??\c:\vppvp.exec:\vppvp.exe24⤵
- Executes dropped EXE
PID:1684 -
\??\c:\3vpjp.exec:\3vpjp.exe25⤵
- Executes dropped EXE
PID:944 -
\??\c:\9bnnbb.exec:\9bnnbb.exe26⤵
- Executes dropped EXE
PID:896 -
\??\c:\3jvpp.exec:\3jvpp.exe27⤵
- Executes dropped EXE
PID:1104 -
\??\c:\xrfxflx.exec:\xrfxflx.exe28⤵
- Executes dropped EXE
PID:2528 -
\??\c:\dvpvd.exec:\dvpvd.exe29⤵
- Executes dropped EXE
PID:2548 -
\??\c:\btbbnt.exec:\btbbnt.exe30⤵
- Executes dropped EXE
PID:1052 -
\??\c:\jdppv.exec:\jdppv.exe31⤵
- Executes dropped EXE
PID:2996 -
\??\c:\3lllffr.exec:\3lllffr.exe32⤵
- Executes dropped EXE
PID:2524 -
\??\c:\5ttbnt.exec:\5ttbnt.exe33⤵
- Executes dropped EXE
PID:2396 -
\??\c:\djdpv.exec:\djdpv.exe34⤵
- Executes dropped EXE
PID:1564 -
\??\c:\3xfxxfl.exec:\3xfxxfl.exe35⤵
- Executes dropped EXE
PID:2688 -
\??\c:\ttthnn.exec:\ttthnn.exe36⤵
- Executes dropped EXE
PID:2704 -
\??\c:\nhtttn.exec:\nhtttn.exe37⤵
- Executes dropped EXE
PID:2816 -
\??\c:\1pjdj.exec:\1pjdj.exe38⤵
- Executes dropped EXE
PID:2720 -
\??\c:\1jvpp.exec:\1jvpp.exe39⤵
- Executes dropped EXE
PID:2852 -
\??\c:\rxxlxxl.exec:\rxxlxxl.exe40⤵
- Executes dropped EXE
PID:2920 -
\??\c:\rflrfxl.exec:\rflrfxl.exe41⤵
- Executes dropped EXE
PID:1784 -
\??\c:\nhbbtt.exec:\nhbbtt.exe42⤵
- Executes dropped EXE
PID:2708 -
\??\c:\dvjvd.exec:\dvjvd.exe43⤵
- Executes dropped EXE
PID:2672 -
\??\c:\dpddj.exec:\dpddj.exe44⤵
- Executes dropped EXE
PID:2164 -
\??\c:\xrxxffl.exec:\xrxxffl.exe45⤵
- Executes dropped EXE
PID:2768 -
\??\c:\xlxxxfr.exec:\xlxxxfr.exe46⤵
- Executes dropped EXE
PID:984 -
\??\c:\nnnbbb.exec:\nnnbbb.exe47⤵
- Executes dropped EXE
PID:1480 -
\??\c:\ttbhhh.exec:\ttbhhh.exe48⤵
- Executes dropped EXE
PID:2912 -
\??\c:\djvpv.exec:\djvpv.exe49⤵
- Executes dropped EXE
PID:1312 -
\??\c:\1flfllr.exec:\1flfllr.exe50⤵
- Executes dropped EXE
PID:2364 -
\??\c:\5frlxfl.exec:\5frlxfl.exe51⤵
- Executes dropped EXE
PID:1620 -
\??\c:\bbthtb.exec:\bbthtb.exe52⤵
- Executes dropped EXE
PID:2424 -
\??\c:\thbhbh.exec:\thbhbh.exe53⤵
- Executes dropped EXE
PID:2012 -
\??\c:\vpddp.exec:\vpddp.exe54⤵
- Executes dropped EXE
PID:2088 -
\??\c:\jvjdp.exec:\jvjdp.exe55⤵
- Executes dropped EXE
PID:1044 -
\??\c:\xrffxxf.exec:\xrffxxf.exe56⤵
- Executes dropped EXE
PID:2276 -
\??\c:\nhtthn.exec:\nhtthn.exe57⤵
- Executes dropped EXE
PID:2284 -
\??\c:\bnbbbt.exec:\bnbbbt.exe58⤵
- Executes dropped EXE
PID:692 -
\??\c:\9vppv.exec:\9vppv.exe59⤵
- Executes dropped EXE
PID:952 -
\??\c:\rfxxxff.exec:\rfxxxff.exe60⤵
- Executes dropped EXE
PID:2924 -
\??\c:\xrllxfr.exec:\xrllxfr.exe61⤵
- Executes dropped EXE
PID:2232 -
\??\c:\hbbhbb.exec:\hbbhbb.exe62⤵
- Executes dropped EXE
PID:2116 -
\??\c:\nhtbbh.exec:\nhtbbh.exe63⤵
- Executes dropped EXE
PID:2328 -
\??\c:\7vjdj.exec:\7vjdj.exe64⤵
- Executes dropped EXE
PID:1080 -
\??\c:\xrrrrxl.exec:\xrrrrxl.exe65⤵
- Executes dropped EXE
PID:1616 -
\??\c:\lxrxlrf.exec:\lxrxlrf.exe66⤵PID:760
-
\??\c:\1tnbhn.exec:\1tnbhn.exe67⤵PID:740
-
\??\c:\btnntt.exec:\btnntt.exe68⤵PID:2296
-
\??\c:\dvddj.exec:\dvddj.exe69⤵PID:2264
-
\??\c:\pjdpj.exec:\pjdpj.exe70⤵PID:2016
-
\??\c:\rffxxrx.exec:\rffxxrx.exe71⤵PID:1944
-
\??\c:\nhbbhh.exec:\nhbbhh.exe72⤵PID:352
-
\??\c:\nnbthb.exec:\nnbthb.exe73⤵PID:2432
-
\??\c:\vpjjv.exec:\vpjjv.exe74⤵PID:2884
-
\??\c:\5vvpv.exec:\5vvpv.exe75⤵PID:2540
-
\??\c:\5xlxrfr.exec:\5xlxrfr.exe76⤵PID:2372
-
\??\c:\frlxfxx.exec:\frlxfxx.exe77⤵PID:2388
-
\??\c:\7hbbnt.exec:\7hbbnt.exe78⤵PID:2060
-
\??\c:\dvjjv.exec:\dvjjv.exe79⤵PID:2796
-
\??\c:\fxrxflf.exec:\fxrxflf.exe80⤵PID:2740
-
\??\c:\1ntttt.exec:\1ntttt.exe81⤵PID:2456
-
\??\c:\vvvvd.exec:\vvvvd.exe82⤵PID:2632
-
\??\c:\1pddp.exec:\1pddp.exe83⤵PID:2872
-
\??\c:\rrllxxr.exec:\rrllxxr.exe84⤵PID:2756
-
\??\c:\tnbbnt.exec:\tnbbnt.exe85⤵PID:1772
-
\??\c:\rlxfffr.exec:\rlxfffr.exe86⤵PID:1688
-
\??\c:\hththn.exec:\hththn.exe87⤵PID:3024
-
\??\c:\jvjjp.exec:\jvjjp.exe88⤵PID:3036
-
\??\c:\5rffflr.exec:\5rffflr.exe89⤵PID:1244
-
\??\c:\hthbhh.exec:\hthbhh.exe90⤵PID:1468
-
\??\c:\7dppd.exec:\7dppd.exe91⤵
- System Location Discovery: System Language Discovery
PID:3016 -
\??\c:\jdvvj.exec:\jdvvj.exe92⤵PID:1700
-
\??\c:\rrflxfr.exec:\rrflxfr.exe93⤵PID:1852
-
\??\c:\3nhbnt.exec:\3nhbnt.exe94⤵PID:2000
-
\??\c:\dvjjv.exec:\dvjjv.exe95⤵PID:1992
-
\??\c:\5jddj.exec:\5jddj.exe96⤵PID:1428
-
\??\c:\bbbbnn.exec:\bbbbnn.exe97⤵PID:1432
-
\??\c:\7bntbh.exec:\7bntbh.exe98⤵PID:1160
-
\??\c:\vjvvj.exec:\vjvvj.exe99⤵PID:388
-
\??\c:\jdpdp.exec:\jdpdp.exe100⤵PID:476
-
\??\c:\lxrlxxf.exec:\lxrlxxf.exe101⤵PID:2052
-
\??\c:\nhbhnt.exec:\nhbhnt.exe102⤵PID:692
-
\??\c:\vjpvd.exec:\vjpvd.exe103⤵PID:1300
-
\??\c:\9djvd.exec:\9djvd.exe104⤵PID:1492
-
\??\c:\7lxfxfl.exec:\7lxfxfl.exe105⤵PID:680
-
\??\c:\hbhhnt.exec:\hbhhnt.exe106⤵PID:2216
-
\??\c:\pdjdv.exec:\pdjdv.exe107⤵PID:2392
-
\??\c:\rlfrffr.exec:\rlfrffr.exe108⤵PID:1580
-
\??\c:\bnbthb.exec:\bnbthb.exe109⤵PID:1616
-
\??\c:\jjdjv.exec:\jjdjv.exe110⤵PID:2900
-
\??\c:\5jvpd.exec:\5jvpd.exe111⤵PID:2280
-
\??\c:\bnbthn.exec:\bnbthn.exe112⤵PID:2504
-
\??\c:\vvppd.exec:\vvppd.exe113⤵PID:2036
-
\??\c:\lffflrx.exec:\lffflrx.exe114⤵PID:292
-
\??\c:\5xxrfxf.exec:\5xxrfxf.exe115⤵PID:1036
-
\??\c:\bbttbt.exec:\bbttbt.exe116⤵PID:2676
-
\??\c:\9lffxfx.exec:\9lffxfx.exe117⤵PID:2100
-
\??\c:\9nhbbn.exec:\9nhbbn.exe118⤵PID:3044
-
\??\c:\vvjpv.exec:\vvjpv.exe119⤵
- System Location Discovery: System Language Discovery
PID:2536 -
\??\c:\xllrxxl.exec:\xllrxxl.exe120⤵PID:1564
-
\??\c:\btttnn.exec:\btttnn.exe121⤵PID:2440
-
\??\c:\5dvvd.exec:\5dvvd.exe122⤵PID:2864
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-