Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/03/2025, 19:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
483f039b0f92eb151472b1176352cf11aec7467014e4336451153ea8424890bc.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
483f039b0f92eb151472b1176352cf11aec7467014e4336451153ea8424890bc.exe
-
Size
459KB
-
MD5
d64b05071ab0080438a78c78456565fd
-
SHA1
c017f81d2cb3e9ecb2db8faece9a1fcd7bd7cc9e
-
SHA256
483f039b0f92eb151472b1176352cf11aec7467014e4336451153ea8424890bc
-
SHA512
6191500fe8f025850fa0bddd969e29b04c6aee3ef9431dafb71abd32c8ad6a7537c1dbd28445397142c2e8633312a986214b674fb1b78132b9260da19a715cdb
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeG:q7Tc2NYHUrAwfMp3CDG
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 47 IoCs
resource yara_rule behavioral1/memory/2340-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2088-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1528-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2312-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-65-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2800-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1384-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2068-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1032-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1816-159-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2020-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2120-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2440-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1776-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1028-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2412-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1596-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1596-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1936-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-350-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2804-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-400-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1248-438-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1776-528-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/776-547-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-567-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1920-580-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2516-594-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1724-701-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1068-739-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-746-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1756-778-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2196-841-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1728-971-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1540-1032-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1044-1131-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2480-1136-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2084-1234-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2376-1240-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1896-1269-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2088 vjddj.exe 1808 ffllllr.exe 1528 hhbbhh.exe 2784 nhnthh.exe 2312 1lxflfl.exe 2792 7ttthh.exe 2556 7rxxfxx.exe 2800 lfrxfrf.exe 2684 pjvjp.exe 2544 3lxrxxf.exe 2952 7bhhtt.exe 1656 vjppv.exe 1384 9nbttb.exe 2068 htnbhh.exe 1608 rrlxlrl.exe 1816 jpddj.exe 1032 rflxxfl.exe 2020 hbbhtt.exe 380 frllflf.exe 2120 hbntht.exe 2384 pjvdd.exe 2440 7bntnn.exe 1004 vvjjp.exe 1756 5pdjd.exe 1280 rlfxffl.exe 1776 3pddp.exe 896 fxxflrx.exe 1028 hhhbbb.exe 2412 lfffxfr.exe 908 hhbhnn.exe 1672 9jjvj.exe 2488 ffxllrf.exe 1596 5bntbh.exe 1936 vvjpd.exe 2476 jdvdj.exe 2132 llrrfxf.exe 2872 1hnnhn.exe 1060 dvppd.exe 2688 dvddj.exe 2816 1frxlrr.exe 2812 7htbbh.exe 2804 5pvjj.exe 2576 9vppj.exe 2800 fxrrrxf.exe 2564 hhhnbb.exe 2612 9btbbh.exe 2544 jdjdv.exe 2960 fxrfrxl.exe 2296 3lxrrrr.exe 340 btntbh.exe 1704 3nbbhn.exe 1300 vvpvj.exe 2068 rflllfl.exe 1248 5xrlffl.exe 1816 5bthnb.exe 1164 ttnhbh.exe 1524 jdddp.exe 2832 ffllflx.exe 380 ttnbht.exe 1972 hhntnn.exe 2072 7dddj.exe 2852 vjddp.exe 2440 9rrxlrf.exe 1064 bthntb.exe -
resource yara_rule behavioral1/memory/2340-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1384-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1032-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1028-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1596-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1596-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1248-438-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-502-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-528-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/776-547-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-581-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-580-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-594-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1060-607-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-677-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-694-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1068-732-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1068-739-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-896-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-921-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-970-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1728-971-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-1070-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-1083-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-1108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-1176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-1190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-1240-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2044-1256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1896-1269-0x0000000000220000-0x000000000024A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfllxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nhttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tbhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ttnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bhhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxfflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rlfffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xlrrxf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2340 wrote to memory of 2088 2340 483f039b0f92eb151472b1176352cf11aec7467014e4336451153ea8424890bc.exe 30 PID 2340 wrote to memory of 2088 2340 483f039b0f92eb151472b1176352cf11aec7467014e4336451153ea8424890bc.exe 30 PID 2340 wrote to memory of 2088 2340 483f039b0f92eb151472b1176352cf11aec7467014e4336451153ea8424890bc.exe 30 PID 2340 wrote to memory of 2088 2340 483f039b0f92eb151472b1176352cf11aec7467014e4336451153ea8424890bc.exe 30 PID 2088 wrote to memory of 1808 2088 vjddj.exe 31 PID 2088 wrote to memory of 1808 2088 vjddj.exe 31 PID 2088 wrote to memory of 1808 2088 vjddj.exe 31 PID 2088 wrote to memory of 1808 2088 vjddj.exe 31 PID 1808 wrote to memory of 1528 1808 ffllllr.exe 32 PID 1808 wrote to memory of 1528 1808 ffllllr.exe 32 PID 1808 wrote to memory of 1528 1808 ffllllr.exe 32 PID 1808 wrote to memory of 1528 1808 ffllllr.exe 32 PID 1528 wrote to memory of 2784 1528 hhbbhh.exe 33 PID 1528 wrote to memory of 2784 1528 hhbbhh.exe 33 PID 1528 wrote to memory of 2784 1528 hhbbhh.exe 33 PID 1528 wrote to memory of 2784 1528 hhbbhh.exe 33 PID 2784 wrote to memory of 2312 2784 nhnthh.exe 34 PID 2784 wrote to memory of 2312 2784 nhnthh.exe 34 PID 2784 wrote to memory of 2312 2784 nhnthh.exe 34 PID 2784 wrote to memory of 2312 2784 nhnthh.exe 34 PID 2312 wrote to memory of 2792 2312 1lxflfl.exe 35 PID 2312 wrote to memory of 2792 2312 1lxflfl.exe 35 PID 2312 wrote to memory of 2792 2312 1lxflfl.exe 35 PID 2312 wrote to memory of 2792 2312 1lxflfl.exe 35 PID 2792 wrote to memory of 2556 2792 7ttthh.exe 36 PID 2792 wrote to memory of 2556 2792 7ttthh.exe 36 PID 2792 wrote to memory of 2556 2792 7ttthh.exe 36 PID 2792 wrote to memory of 2556 2792 7ttthh.exe 36 PID 2556 wrote to memory of 2800 2556 7rxxfxx.exe 37 PID 2556 wrote to memory of 2800 2556 7rxxfxx.exe 37 PID 2556 wrote to memory of 2800 2556 7rxxfxx.exe 37 PID 2556 wrote to memory of 2800 2556 7rxxfxx.exe 37 PID 2800 wrote to memory of 2684 2800 lfrxfrf.exe 38 PID 2800 wrote to memory of 2684 2800 lfrxfrf.exe 38 PID 2800 wrote to memory of 2684 2800 lfrxfrf.exe 38 PID 2800 wrote to memory of 2684 2800 lfrxfrf.exe 38 PID 2684 wrote to memory of 2544 2684 pjvjp.exe 39 PID 2684 wrote to memory of 2544 2684 pjvjp.exe 39 PID 2684 wrote to memory of 2544 2684 pjvjp.exe 39 PID 2684 wrote to memory of 2544 2684 pjvjp.exe 39 PID 2544 wrote to memory of 2952 2544 3lxrxxf.exe 40 PID 2544 wrote to memory of 2952 2544 3lxrxxf.exe 40 PID 2544 wrote to memory of 2952 2544 3lxrxxf.exe 40 PID 2544 wrote to memory of 2952 2544 3lxrxxf.exe 40 PID 2952 wrote to memory of 1656 2952 7bhhtt.exe 41 PID 2952 wrote to memory of 1656 2952 7bhhtt.exe 41 PID 2952 wrote to memory of 1656 2952 7bhhtt.exe 41 PID 2952 wrote to memory of 1656 2952 7bhhtt.exe 41 PID 1656 wrote to memory of 1384 1656 vjppv.exe 42 PID 1656 wrote to memory of 1384 1656 vjppv.exe 42 PID 1656 wrote to memory of 1384 1656 vjppv.exe 42 PID 1656 wrote to memory of 1384 1656 vjppv.exe 42 PID 1384 wrote to memory of 2068 1384 9nbttb.exe 43 PID 1384 wrote to memory of 2068 1384 9nbttb.exe 43 PID 1384 wrote to memory of 2068 1384 9nbttb.exe 43 PID 1384 wrote to memory of 2068 1384 9nbttb.exe 43 PID 2068 wrote to memory of 1608 2068 htnbhh.exe 44 PID 2068 wrote to memory of 1608 2068 htnbhh.exe 44 PID 2068 wrote to memory of 1608 2068 htnbhh.exe 44 PID 2068 wrote to memory of 1608 2068 htnbhh.exe 44 PID 1608 wrote to memory of 1816 1608 rrlxlrl.exe 45 PID 1608 wrote to memory of 1816 1608 rrlxlrl.exe 45 PID 1608 wrote to memory of 1816 1608 rrlxlrl.exe 45 PID 1608 wrote to memory of 1816 1608 rrlxlrl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\483f039b0f92eb151472b1176352cf11aec7467014e4336451153ea8424890bc.exe"C:\Users\Admin\AppData\Local\Temp\483f039b0f92eb151472b1176352cf11aec7467014e4336451153ea8424890bc.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\vjddj.exec:\vjddj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\ffllllr.exec:\ffllllr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\hhbbhh.exec:\hhbbhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\nhnthh.exec:\nhnthh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\1lxflfl.exec:\1lxflfl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\7ttthh.exec:\7ttthh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\7rxxfxx.exec:\7rxxfxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\lfrxfrf.exec:\lfrxfrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\pjvjp.exec:\pjvjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\3lxrxxf.exec:\3lxrxxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\7bhhtt.exec:\7bhhtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\vjppv.exec:\vjppv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\9nbttb.exec:\9nbttb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
\??\c:\htnbhh.exec:\htnbhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\rrlxlrl.exec:\rrlxlrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\jpddj.exec:\jpddj.exe17⤵
- Executes dropped EXE
PID:1816 -
\??\c:\rflxxfl.exec:\rflxxfl.exe18⤵
- Executes dropped EXE
PID:1032 -
\??\c:\hbbhtt.exec:\hbbhtt.exe19⤵
- Executes dropped EXE
PID:2020 -
\??\c:\frllflf.exec:\frllflf.exe20⤵
- Executes dropped EXE
PID:380 -
\??\c:\hbntht.exec:\hbntht.exe21⤵
- Executes dropped EXE
PID:2120 -
\??\c:\pjvdd.exec:\pjvdd.exe22⤵
- Executes dropped EXE
PID:2384 -
\??\c:\7bntnn.exec:\7bntnn.exe23⤵
- Executes dropped EXE
PID:2440 -
\??\c:\vvjjp.exec:\vvjjp.exe24⤵
- Executes dropped EXE
PID:1004 -
\??\c:\5pdjd.exec:\5pdjd.exe25⤵
- Executes dropped EXE
PID:1756 -
\??\c:\rlfxffl.exec:\rlfxffl.exe26⤵
- Executes dropped EXE
PID:1280 -
\??\c:\3pddp.exec:\3pddp.exe27⤵
- Executes dropped EXE
PID:1776 -
\??\c:\fxxflrx.exec:\fxxflrx.exe28⤵
- Executes dropped EXE
PID:896 -
\??\c:\hhhbbb.exec:\hhhbbb.exe29⤵
- Executes dropped EXE
PID:1028 -
\??\c:\lfffxfr.exec:\lfffxfr.exe30⤵
- Executes dropped EXE
PID:2412 -
\??\c:\hhbhnn.exec:\hhbhnn.exe31⤵
- Executes dropped EXE
PID:908 -
\??\c:\9jjvj.exec:\9jjvj.exe32⤵
- Executes dropped EXE
PID:1672 -
\??\c:\ffxllrf.exec:\ffxllrf.exe33⤵
- Executes dropped EXE
PID:2488 -
\??\c:\5bntbh.exec:\5bntbh.exe34⤵
- Executes dropped EXE
PID:1596 -
\??\c:\vvjpd.exec:\vvjpd.exe35⤵
- Executes dropped EXE
PID:1936 -
\??\c:\jdvdj.exec:\jdvdj.exe36⤵
- Executes dropped EXE
PID:2476 -
\??\c:\llrrfxf.exec:\llrrfxf.exe37⤵
- Executes dropped EXE
PID:2132 -
\??\c:\1hnnhn.exec:\1hnnhn.exe38⤵
- Executes dropped EXE
PID:2872 -
\??\c:\dvppd.exec:\dvppd.exe39⤵
- Executes dropped EXE
PID:1060 -
\??\c:\dvddj.exec:\dvddj.exe40⤵
- Executes dropped EXE
PID:2688 -
\??\c:\1frxlrr.exec:\1frxlrr.exe41⤵
- Executes dropped EXE
PID:2816 -
\??\c:\7htbbh.exec:\7htbbh.exe42⤵
- Executes dropped EXE
PID:2812 -
\??\c:\5pvjj.exec:\5pvjj.exe43⤵
- Executes dropped EXE
PID:2804 -
\??\c:\9vppj.exec:\9vppj.exe44⤵
- Executes dropped EXE
PID:2576 -
\??\c:\fxrrrxf.exec:\fxrrrxf.exe45⤵
- Executes dropped EXE
PID:2800 -
\??\c:\hhhnbb.exec:\hhhnbb.exe46⤵
- Executes dropped EXE
PID:2564 -
\??\c:\9btbbh.exec:\9btbbh.exe47⤵
- Executes dropped EXE
PID:2612 -
\??\c:\jdjdv.exec:\jdjdv.exe48⤵
- Executes dropped EXE
PID:2544 -
\??\c:\fxrfrxl.exec:\fxrfrxl.exe49⤵
- Executes dropped EXE
PID:2960 -
\??\c:\3lxrrrr.exec:\3lxrrrr.exe50⤵
- Executes dropped EXE
PID:2296 -
\??\c:\btntbh.exec:\btntbh.exe51⤵
- Executes dropped EXE
PID:340 -
\??\c:\3nbbhn.exec:\3nbbhn.exe52⤵
- Executes dropped EXE
PID:1704 -
\??\c:\vvpvj.exec:\vvpvj.exe53⤵
- Executes dropped EXE
PID:1300 -
\??\c:\rflllfl.exec:\rflllfl.exe54⤵
- Executes dropped EXE
PID:2068 -
\??\c:\5xrlffl.exec:\5xrlffl.exe55⤵
- Executes dropped EXE
PID:1248 -
\??\c:\5bthnb.exec:\5bthnb.exe56⤵
- Executes dropped EXE
PID:1816 -
\??\c:\ttnhbh.exec:\ttnhbh.exe57⤵
- Executes dropped EXE
PID:1164 -
\??\c:\jdddp.exec:\jdddp.exe58⤵
- Executes dropped EXE
PID:1524 -
\??\c:\ffllflx.exec:\ffllflx.exe59⤵
- Executes dropped EXE
PID:2832 -
\??\c:\ttnbht.exec:\ttnbht.exe60⤵
- Executes dropped EXE
PID:380 -
\??\c:\hhntnn.exec:\hhntnn.exe61⤵
- Executes dropped EXE
PID:1972 -
\??\c:\7dddj.exec:\7dddj.exe62⤵
- Executes dropped EXE
PID:2072 -
\??\c:\vjddp.exec:\vjddp.exe63⤵
- Executes dropped EXE
PID:2852 -
\??\c:\9rrxlrf.exec:\9rrxlrf.exe64⤵
- Executes dropped EXE
PID:2440 -
\??\c:\bthntb.exec:\bthntb.exe65⤵
- Executes dropped EXE
PID:1064 -
\??\c:\1dppj.exec:\1dppj.exe66⤵PID:2320
-
\??\c:\jvdjp.exec:\jvdjp.exe67⤵PID:1744
-
\??\c:\3rlxfrx.exec:\3rlxfrx.exe68⤵PID:1660
-
\??\c:\5tnthh.exec:\5tnthh.exe69⤵PID:1776
-
\??\c:\btntnn.exec:\btntnn.exe70⤵PID:896
-
\??\c:\jvddv.exec:\jvddv.exe71⤵PID:2352
-
\??\c:\vjdvv.exec:\vjdvv.exe72⤵PID:776
-
\??\c:\xxlfxfl.exec:\xxlfxfl.exe73⤵PID:352
-
\??\c:\btbhnt.exec:\btbhnt.exe74⤵PID:908
-
\??\c:\hbtthh.exec:\hbtthh.exe75⤵PID:2324
-
\??\c:\jdvdv.exec:\jdvdv.exe76⤵PID:1604
-
\??\c:\1frrxfl.exec:\1frrxfl.exe77⤵PID:1920
-
\??\c:\tnbtbt.exec:\tnbtbt.exe78⤵PID:1632
-
\??\c:\bthhbb.exec:\bthhbb.exe79⤵PID:2516
-
\??\c:\jdvvv.exec:\jdvvv.exe80⤵PID:2964
-
\??\c:\7pdjv.exec:\7pdjv.exe81⤵PID:2872
-
\??\c:\frffrrx.exec:\frffrrx.exe82⤵PID:1060
-
\??\c:\hbnntt.exec:\hbnntt.exe83⤵PID:2172
-
\??\c:\1hhtbh.exec:\1hhtbh.exe84⤵PID:2680
-
\??\c:\vjvvv.exec:\vjvvv.exe85⤵PID:2664
-
\??\c:\rlrrxxl.exec:\rlrrxxl.exe86⤵PID:2824
-
\??\c:\fxffllr.exec:\fxffllr.exe87⤵PID:2720
-
\??\c:\htnhnt.exec:\htnhnt.exe88⤵PID:2552
-
\??\c:\nhnthn.exec:\nhnthn.exe89⤵PID:2604
-
\??\c:\vpdvd.exec:\vpdvd.exe90⤵PID:3000
-
\??\c:\lfxrxrx.exec:\lfxrxrx.exe91⤵PID:2808
-
\??\c:\xxxfxxl.exec:\xxxfxxl.exe92⤵PID:1200
-
\??\c:\tnhnbh.exec:\tnhnbh.exe93⤵PID:2096
-
\??\c:\5jdpp.exec:\5jdpp.exe94⤵PID:2392
-
\??\c:\9flfffl.exec:\9flfffl.exe95⤵PID:1640
-
\??\c:\xfrlrrx.exec:\xfrlrrx.exe96⤵PID:1724
-
\??\c:\btnthb.exec:\btnthb.exe97⤵PID:2044
-
\??\c:\pjdjv.exec:\pjdjv.exe98⤵PID:1076
-
\??\c:\dvvdj.exec:\dvvdj.exe99⤵PID:1712
-
\??\c:\rlrxllr.exec:\rlrxllr.exe100⤵PID:2636
-
\??\c:\ththtb.exec:\ththtb.exe101⤵PID:2820
-
\??\c:\btbbhb.exec:\btbbhb.exe102⤵PID:1068
-
\??\c:\vjvvj.exec:\vjvvj.exe103⤵PID:2424
-
\??\c:\lfllxxl.exec:\lfllxxl.exe104⤵
- System Location Discovery: System Language Discovery
PID:2200 -
\??\c:\lxlrxrf.exec:\lxlrxrf.exe105⤵PID:608
-
\??\c:\tnnttt.exec:\tnnttt.exe106⤵PID:2336
-
\??\c:\pdvvd.exec:\pdvvd.exe107⤵PID:2004
-
\??\c:\3jddj.exec:\3jddj.exe108⤵PID:1756
-
\??\c:\rrlxllr.exec:\rrlxllr.exe109⤵PID:1296
-
\??\c:\bnbntb.exec:\bnbntb.exe110⤵PID:1556
-
\??\c:\nntttb.exec:\nntttb.exe111⤵PID:1340
-
\??\c:\3pddp.exec:\3pddp.exe112⤵PID:2484
-
\??\c:\1rrxflx.exec:\1rrxflx.exe113⤵PID:320
-
\??\c:\xrllffr.exec:\xrllffr.exe114⤵PID:996
-
\??\c:\tntnbt.exec:\tntnbt.exe115⤵PID:3036
-
\??\c:\1dvvv.exec:\1dvvv.exe116⤵PID:1504
-
\??\c:\ppdjv.exec:\ppdjv.exe117⤵PID:2168
-
\??\c:\lfrrffl.exec:\lfrrffl.exe118⤵PID:2196
-
\??\c:\5htttb.exec:\5htttb.exe119⤵PID:2088
-
\??\c:\bthbnt.exec:\bthbnt.exe120⤵PID:2388
-
\??\c:\dpddv.exec:\dpddv.exe121⤵PID:2160
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-