Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12-09-2024 19:58
Behavioral task
behavioral1
Sample
b5cfbc928c0827c718cb06b9c139e7c0N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
b5cfbc928c0827c718cb06b9c139e7c0N.exe
-
Size
297KB
-
MD5
b5cfbc928c0827c718cb06b9c139e7c0
-
SHA1
49ef46554a1a125093ef4b4953a010f6d55fe16b
-
SHA256
28d04411caf15cf0c311f67525fc833665a831a45f5e1f0ec9eb1420b5d5707b
-
SHA512
ce6ca083e4eefbd5b9d542e409d56398061f15417923c9823444f9715837331a2ae08062eb2ed9743e238f93f772734673fbfc0098521e6976d33ab6ad7ec8f7
-
SSDEEP
6144:ccm4FmowdHoSQkuObHq9ltAszBd+za/p1slTjZXvEQo9dftO3:K4wFHoSQkuUHk1zBR/pMT9XvEhdfS
Malware Config
Signatures
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/2236-13-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2648-10-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2108-31-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2788-27-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2872-47-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2728-58-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2572-68-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/3004-76-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1812-87-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2120-95-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/580-123-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1668-158-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2904-167-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1988-194-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/356-212-0x0000000000220000-0x0000000000254000-memory.dmp family_blackmoon behavioral1/memory/356-213-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1140-222-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2884-233-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1872-257-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2636-268-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2636-266-0x0000000000220000-0x0000000000254000-memory.dmp family_blackmoon behavioral1/memory/2484-286-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1912-307-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2556-345-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2628-352-0x00000000001C0000-0x00000000001F4000-memory.dmp family_blackmoon behavioral1/memory/836-372-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2396-379-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2136-432-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1996-446-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1700-505-0x0000000000220000-0x0000000000254000-memory.dmp family_blackmoon behavioral1/memory/1700-510-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1576-573-0x0000000000220000-0x0000000000254000-memory.dmp family_blackmoon behavioral1/memory/1576-575-0x0000000000220000-0x0000000000254000-memory.dmp family_blackmoon behavioral1/memory/1912-587-0x0000000000290000-0x00000000002C4000-memory.dmp family_blackmoon behavioral1/memory/2712-595-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2780-598-0x0000000000220000-0x0000000000254000-memory.dmp family_blackmoon behavioral1/memory/2568-622-0x0000000001B90000-0x0000000001BC4000-memory.dmp family_blackmoon behavioral1/memory/2076-669-0x0000000000220000-0x0000000000254000-memory.dmp family_blackmoon behavioral1/memory/1924-702-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1048-836-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2648-856-0x0000000000250000-0x0000000000284000-memory.dmp family_blackmoon behavioral1/memory/2584-904-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2456-942-0x00000000001C0000-0x00000000001F4000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2236 djvpp.exe 2788 lffrxll.exe 2108 3nttnn.exe 2872 1vjjp.exe 2728 lflxlxl.exe 2572 rlxlflx.exe 3004 jjdvj.exe 1812 ttbhbb.exe 2120 vvppd.exe 2076 rllrxlx.exe 292 7dpvj.exe 580 3xflfrf.exe 2876 5pjvd.exe 2848 ppvvp.exe 2856 nnhbtt.exe 1668 1lfflrr.exe 2904 nbhhtn.exe 1784 1lfrfll.exe 3020 vjdvv.exe 1988 nhtnnb.exe 1856 flrllfr.exe 356 hhtnnh.exe 1140 vpdpj.exe 1524 thbttt.exe 2884 3vppd.exe 1788 xfxxlxl.exe 1872 jjvvv.exe 2636 lxxxrfl.exe 2500 vvppd.exe 908 xfffxxx.exe 2484 jjjvj.exe 2648 xrlrlrf.exe 1912 hhttbb.exe 2708 jpddp.exe 2764 llrflxl.exe 2680 ppjpd.exe 2588 rxlllxf.exe 2828 nnnbtt.exe 2556 jjvdj.exe 2628 fxrxfrx.exe 2612 3rxrflf.exe 2056 7nbbhh.exe 836 1jpvv.exe 2396 9xfxlxr.exe 1456 1nhbbh.exe 744 9vvdp.exe 2984 rlxfxrf.exe 1164 bhhntt.exe 2432 jpddv.exe 2844 lllfrfr.exe 2624 llflxxf.exe 2136 hhbhht.exe 2856 dvpdp.exe 1996 llxlxlf.exe 2064 1bnbnn.exe 1076 1pjvd.exe 1508 ffrrflf.exe 1972 7rrrlxr.exe 696 bbtbhh.exe 1852 vvvpd.exe 988 lrxlffx.exe 2864 lfxlxff.exe 1520 tthbtb.exe 1700 3jdpv.exe -
resource yara_rule behavioral1/memory/2648-0-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x000b000000012282-5.dat upx behavioral1/memory/2236-13-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2648-10-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2648-6-0x00000000001B0000-0x00000000001E4000-memory.dmp upx behavioral1/files/0x00080000000173f4-20.dat upx behavioral1/files/0x0007000000017472-29.dat upx behavioral1/memory/2108-31-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2788-27-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0007000000017487-37.dat upx behavioral1/files/0x00070000000174a2-46.dat upx behavioral1/memory/2728-48-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2872-47-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2728-58-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0007000000017525-57.dat upx behavioral1/memory/2572-68-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0017000000018663-67.dat upx behavioral1/files/0x000f00000001866e-77.dat upx behavioral1/memory/3004-76-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1812-87-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0005000000019259-86.dat upx behavioral1/files/0x0005000000019263-96.dat upx behavioral1/memory/2120-95-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0005000000019266-105.dat upx behavioral1/files/0x0005000000019284-112.dat upx behavioral1/files/0x000500000001928c-124.dat upx behavioral1/memory/580-123-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0005000000019353-131.dat upx behavioral1/files/0x0005000000019356-140.dat upx behavioral1/files/0x003600000001706d-148.dat upx behavioral1/files/0x000500000001936b-159.dat upx behavioral1/memory/1668-158-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2904-167-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x000500000001937b-168.dat upx behavioral1/files/0x0005000000019397-176.dat upx behavioral1/memory/3020-177-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x00050000000193a5-186.dat upx behavioral1/files/0x0005000000019423-196.dat upx behavioral1/memory/1988-194-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0005000000019426-203.dat upx behavioral1/memory/356-212-0x0000000000220000-0x0000000000254000-memory.dmp upx behavioral1/files/0x0005000000019438-214.dat upx behavioral1/memory/356-213-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0005000000019442-223.dat upx behavioral1/memory/1140-222-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x000500000001944d-231.dat upx behavioral1/memory/2884-233-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0005000000019458-240.dat upx behavioral1/files/0x000500000001945c-249.dat upx behavioral1/memory/1872-257-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x000500000001946b-258.dat upx behavioral1/files/0x0005000000019259-267.dat upx behavioral1/memory/2636-268-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x000500000001946e-276.dat upx behavioral1/files/0x00050000000194ae-284.dat upx behavioral1/memory/2484-286-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x00050000000194c9-293.dat upx behavioral1/memory/1912-307-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2556-345-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/836-372-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2396-379-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2432-404-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2136-432-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1996-446-0x0000000000400000-0x0000000000434000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rflrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfrxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxfxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2648 wrote to memory of 2236 2648 b5cfbc928c0827c718cb06b9c139e7c0N.exe 30 PID 2648 wrote to memory of 2236 2648 b5cfbc928c0827c718cb06b9c139e7c0N.exe 30 PID 2648 wrote to memory of 2236 2648 b5cfbc928c0827c718cb06b9c139e7c0N.exe 30 PID 2648 wrote to memory of 2236 2648 b5cfbc928c0827c718cb06b9c139e7c0N.exe 30 PID 2236 wrote to memory of 2788 2236 djvpp.exe 31 PID 2236 wrote to memory of 2788 2236 djvpp.exe 31 PID 2236 wrote to memory of 2788 2236 djvpp.exe 31 PID 2236 wrote to memory of 2788 2236 djvpp.exe 31 PID 2788 wrote to memory of 2108 2788 lffrxll.exe 32 PID 2788 wrote to memory of 2108 2788 lffrxll.exe 32 PID 2788 wrote to memory of 2108 2788 lffrxll.exe 32 PID 2788 wrote to memory of 2108 2788 lffrxll.exe 32 PID 2108 wrote to memory of 2872 2108 3nttnn.exe 33 PID 2108 wrote to memory of 2872 2108 3nttnn.exe 33 PID 2108 wrote to memory of 2872 2108 3nttnn.exe 33 PID 2108 wrote to memory of 2872 2108 3nttnn.exe 33 PID 2872 wrote to memory of 2728 2872 1vjjp.exe 34 PID 2872 wrote to memory of 2728 2872 1vjjp.exe 34 PID 2872 wrote to memory of 2728 2872 1vjjp.exe 34 PID 2872 wrote to memory of 2728 2872 1vjjp.exe 34 PID 2728 wrote to memory of 2572 2728 lflxlxl.exe 35 PID 2728 wrote to memory of 2572 2728 lflxlxl.exe 35 PID 2728 wrote to memory of 2572 2728 lflxlxl.exe 35 PID 2728 wrote to memory of 2572 2728 lflxlxl.exe 35 PID 2572 wrote to memory of 3004 2572 rlxlflx.exe 36 PID 2572 wrote to memory of 3004 2572 rlxlflx.exe 36 PID 2572 wrote to memory of 3004 2572 rlxlflx.exe 36 PID 2572 wrote to memory of 3004 2572 rlxlflx.exe 36 PID 3004 wrote to memory of 1812 3004 jjdvj.exe 37 PID 3004 wrote to memory of 1812 3004 jjdvj.exe 37 PID 3004 wrote to memory of 1812 3004 jjdvj.exe 37 PID 3004 wrote to memory of 1812 3004 jjdvj.exe 37 PID 1812 wrote to memory of 2120 1812 ttbhbb.exe 38 PID 1812 wrote to memory of 2120 1812 ttbhbb.exe 38 PID 1812 wrote to memory of 2120 1812 ttbhbb.exe 38 PID 1812 wrote to memory of 2120 1812 ttbhbb.exe 38 PID 2120 wrote to memory of 2076 2120 vvppd.exe 39 PID 2120 wrote to memory of 2076 2120 vvppd.exe 39 PID 2120 wrote to memory of 2076 2120 vvppd.exe 39 PID 2120 wrote to memory of 2076 2120 vvppd.exe 39 PID 2076 wrote to memory of 292 2076 rllrxlx.exe 40 PID 2076 wrote to memory of 292 2076 rllrxlx.exe 40 PID 2076 wrote to memory of 292 2076 rllrxlx.exe 40 PID 2076 wrote to memory of 292 2076 rllrxlx.exe 40 PID 292 wrote to memory of 580 292 7dpvj.exe 41 PID 292 wrote to memory of 580 292 7dpvj.exe 41 PID 292 wrote to memory of 580 292 7dpvj.exe 41 PID 292 wrote to memory of 580 292 7dpvj.exe 41 PID 580 wrote to memory of 2876 580 3xflfrf.exe 42 PID 580 wrote to memory of 2876 580 3xflfrf.exe 42 PID 580 wrote to memory of 2876 580 3xflfrf.exe 42 PID 580 wrote to memory of 2876 580 3xflfrf.exe 42 PID 2876 wrote to memory of 2848 2876 5pjvd.exe 43 PID 2876 wrote to memory of 2848 2876 5pjvd.exe 43 PID 2876 wrote to memory of 2848 2876 5pjvd.exe 43 PID 2876 wrote to memory of 2848 2876 5pjvd.exe 43 PID 2848 wrote to memory of 2856 2848 ppvvp.exe 44 PID 2848 wrote to memory of 2856 2848 ppvvp.exe 44 PID 2848 wrote to memory of 2856 2848 ppvvp.exe 44 PID 2848 wrote to memory of 2856 2848 ppvvp.exe 44 PID 2856 wrote to memory of 1668 2856 nnhbtt.exe 45 PID 2856 wrote to memory of 1668 2856 nnhbtt.exe 45 PID 2856 wrote to memory of 1668 2856 nnhbtt.exe 45 PID 2856 wrote to memory of 1668 2856 nnhbtt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\b5cfbc928c0827c718cb06b9c139e7c0N.exe"C:\Users\Admin\AppData\Local\Temp\b5cfbc928c0827c718cb06b9c139e7c0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\djvpp.exec:\djvpp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\lffrxll.exec:\lffrxll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\3nttnn.exec:\3nttnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\1vjjp.exec:\1vjjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\lflxlxl.exec:\lflxlxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\rlxlflx.exec:\rlxlflx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\jjdvj.exec:\jjdvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\ttbhbb.exec:\ttbhbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\vvppd.exec:\vvppd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\rllrxlx.exec:\rllrxlx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\7dpvj.exec:\7dpvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:292 -
\??\c:\3xflfrf.exec:\3xflfrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:580 -
\??\c:\5pjvd.exec:\5pjvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\ppvvp.exec:\ppvvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\nnhbtt.exec:\nnhbtt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\1lfflrr.exec:\1lfflrr.exe17⤵
- Executes dropped EXE
PID:1668 -
\??\c:\nbhhtn.exec:\nbhhtn.exe18⤵
- Executes dropped EXE
PID:2904 -
\??\c:\1lfrfll.exec:\1lfrfll.exe19⤵
- Executes dropped EXE
PID:1784 -
\??\c:\vjdvv.exec:\vjdvv.exe20⤵
- Executes dropped EXE
PID:3020 -
\??\c:\nhtnnb.exec:\nhtnnb.exe21⤵
- Executes dropped EXE
PID:1988 -
\??\c:\flrllfr.exec:\flrllfr.exe22⤵
- Executes dropped EXE
PID:1856 -
\??\c:\hhtnnh.exec:\hhtnnh.exe23⤵
- Executes dropped EXE
PID:356 -
\??\c:\vpdpj.exec:\vpdpj.exe24⤵
- Executes dropped EXE
PID:1140 -
\??\c:\thbttt.exec:\thbttt.exe25⤵
- Executes dropped EXE
PID:1524 -
\??\c:\3vppd.exec:\3vppd.exe26⤵
- Executes dropped EXE
PID:2884 -
\??\c:\xfxxlxl.exec:\xfxxlxl.exe27⤵
- Executes dropped EXE
PID:1788 -
\??\c:\jjvvv.exec:\jjvvv.exe28⤵
- Executes dropped EXE
PID:1872 -
\??\c:\lxxxrfl.exec:\lxxxrfl.exe29⤵
- Executes dropped EXE
PID:2636 -
\??\c:\vvppd.exec:\vvppd.exe30⤵
- Executes dropped EXE
PID:2500 -
\??\c:\xfffxxx.exec:\xfffxxx.exe31⤵
- Executes dropped EXE
PID:908 -
\??\c:\jjjvj.exec:\jjjvj.exe32⤵
- Executes dropped EXE
PID:2484 -
\??\c:\xrlrlrf.exec:\xrlrlrf.exe33⤵
- Executes dropped EXE
PID:2648 -
\??\c:\hhttbb.exec:\hhttbb.exe34⤵
- Executes dropped EXE
PID:1912 -
\??\c:\jpddp.exec:\jpddp.exe35⤵
- Executes dropped EXE
PID:2708 -
\??\c:\llrflxl.exec:\llrflxl.exe36⤵
- Executes dropped EXE
PID:2764 -
\??\c:\ppjpd.exec:\ppjpd.exe37⤵
- Executes dropped EXE
PID:2680 -
\??\c:\rxlllxf.exec:\rxlllxf.exe38⤵
- Executes dropped EXE
PID:2588 -
\??\c:\nnnbtt.exec:\nnnbtt.exe39⤵
- Executes dropped EXE
PID:2828 -
\??\c:\jjvdj.exec:\jjvdj.exe40⤵
- Executes dropped EXE
PID:2556 -
\??\c:\fxrxfrx.exec:\fxrxfrx.exe41⤵
- Executes dropped EXE
PID:2628 -
\??\c:\3rxrflf.exec:\3rxrflf.exe42⤵
- Executes dropped EXE
PID:2612 -
\??\c:\7nbbhh.exec:\7nbbhh.exe43⤵
- Executes dropped EXE
PID:2056 -
\??\c:\1jpvv.exec:\1jpvv.exe44⤵
- Executes dropped EXE
PID:836 -
\??\c:\9xfxlxr.exec:\9xfxlxr.exe45⤵
- Executes dropped EXE
PID:2396 -
\??\c:\1nhbbh.exec:\1nhbbh.exe46⤵
- Executes dropped EXE
PID:1456 -
\??\c:\9vvdp.exec:\9vvdp.exe47⤵
- Executes dropped EXE
PID:744 -
\??\c:\rlxfxrf.exec:\rlxfxrf.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2984 -
\??\c:\bhhntt.exec:\bhhntt.exe49⤵
- Executes dropped EXE
PID:1164 -
\??\c:\jpddv.exec:\jpddv.exe50⤵
- Executes dropped EXE
PID:2432 -
\??\c:\lllfrfr.exec:\lllfrfr.exe51⤵
- Executes dropped EXE
PID:2844 -
\??\c:\llflxxf.exec:\llflxxf.exe52⤵
- Executes dropped EXE
PID:2624 -
\??\c:\hhbhht.exec:\hhbhht.exe53⤵
- Executes dropped EXE
PID:2136 -
\??\c:\dvpdp.exec:\dvpdp.exe54⤵
- Executes dropped EXE
PID:2856 -
\??\c:\llxlxlf.exec:\llxlxlf.exe55⤵
- Executes dropped EXE
PID:1996 -
\??\c:\1bnbnn.exec:\1bnbnn.exe56⤵
- Executes dropped EXE
PID:2064 -
\??\c:\1pjvd.exec:\1pjvd.exe57⤵
- Executes dropped EXE
PID:1076 -
\??\c:\ffrrflf.exec:\ffrrflf.exe58⤵
- Executes dropped EXE
PID:1508 -
\??\c:\7rrrlxr.exec:\7rrrlxr.exe59⤵
- Executes dropped EXE
PID:1972 -
\??\c:\bbtbhh.exec:\bbtbhh.exe60⤵
- Executes dropped EXE
PID:696 -
\??\c:\vvvpd.exec:\vvvpd.exe61⤵
- Executes dropped EXE
PID:1852 -
\??\c:\lrxlffx.exec:\lrxlffx.exe62⤵
- Executes dropped EXE
PID:988 -
\??\c:\lfxlxff.exec:\lfxlxff.exe63⤵
- Executes dropped EXE
PID:2864 -
\??\c:\tthbtb.exec:\tthbtb.exe64⤵
- Executes dropped EXE
PID:1520 -
\??\c:\3jdpv.exec:\3jdpv.exe65⤵
- Executes dropped EXE
PID:1700 -
\??\c:\jvjjj.exec:\jvjjj.exe66⤵PID:1524
-
\??\c:\rxlfxrr.exec:\rxlfxrr.exe67⤵PID:3068
-
\??\c:\nnnhnb.exec:\nnnhnb.exe68⤵PID:2212
-
\??\c:\9vjpd.exec:\9vjpd.exe69⤵PID:1544
-
\??\c:\9vpdj.exec:\9vpdj.exe70⤵PID:556
-
\??\c:\fxlrxfr.exec:\fxlrxfr.exe71⤵PID:2268
-
\??\c:\htthnt.exec:\htthnt.exe72⤵PID:2500
-
\??\c:\jjdjp.exec:\jjdjp.exe73⤵PID:1732
-
\??\c:\vvvdp.exec:\vvvdp.exe74⤵PID:2900
-
\??\c:\rlxxfll.exec:\rlxxfll.exe75⤵PID:1576
-
\??\c:\5nhtbh.exec:\5nhtbh.exe76⤵PID:2664
-
\??\c:\dddpj.exec:\dddpj.exe77⤵PID:1912
-
\??\c:\1djpd.exec:\1djpd.exe78⤵PID:2712
-
\??\c:\5ffxrff.exec:\5ffxrff.exe79⤵PID:2780
-
\??\c:\bthnbh.exec:\bthnbh.exe80⤵PID:2680
-
\??\c:\ppvdd.exec:\ppvdd.exe81⤵PID:2792
-
\??\c:\rllxxlx.exec:\rllxxlx.exe82⤵PID:2568
-
\??\c:\fxrfrxr.exec:\fxrfrxr.exe83⤵PID:2556
-
\??\c:\tthntt.exec:\tthntt.exe84⤵PID:2148
-
\??\c:\7jdjv.exec:\7jdjv.exe85⤵PID:1624
-
\??\c:\xrllxlr.exec:\xrllxlr.exe86⤵PID:2196
-
\??\c:\rrllrrf.exec:\rrllrrf.exe87⤵PID:2316
-
\??\c:\hhnnnt.exec:\hhnnnt.exe88⤵PID:904
-
\??\c:\jdppv.exec:\jdppv.exe89⤵PID:2076
-
\??\c:\lrrxflx.exec:\lrrxflx.exe90⤵PID:1728
-
\??\c:\tbhtht.exec:\tbhtht.exe91⤵PID:2324
-
\??\c:\pppvj.exec:\pppvj.exe92⤵PID:2260
-
\??\c:\9rllrxl.exec:\9rllrxl.exe93⤵PID:2336
-
\??\c:\ttntbt.exec:\ttntbt.exe94⤵PID:1924
-
\??\c:\nhbhnn.exec:\nhbhnn.exe95⤵PID:2140
-
\??\c:\ffrrffr.exec:\ffrrffr.exe96⤵PID:444
-
\??\c:\xlxflfl.exec:\xlxflfl.exe97⤵PID:2964
-
\??\c:\tttbtn.exec:\tttbtn.exe98⤵PID:1488
-
\??\c:\ddvdp.exec:\ddvdp.exe99⤵PID:1512
-
\??\c:\rrfrxlx.exec:\rrfrxlx.exe100⤵
- System Location Discovery: System Language Discovery
PID:1076 -
\??\c:\xrlxflf.exec:\xrlxflf.exe101⤵PID:3020
-
\??\c:\ttbhhh.exec:\ttbhhh.exe102⤵PID:1680
-
\??\c:\dddjv.exec:\dddjv.exe103⤵PID:896
-
\??\c:\llxxflx.exec:\llxxflx.exe104⤵PID:624
-
\??\c:\9lxxrrx.exec:\9lxxrrx.exe105⤵PID:988
-
\??\c:\ntbtbt.exec:\ntbtbt.exe106⤵PID:2864
-
\??\c:\lrrlrxl.exec:\lrrlrxl.exe107⤵PID:1336
-
\??\c:\hbthnt.exec:\hbthnt.exe108⤵PID:1700
-
\??\c:\vvpdp.exec:\vvpdp.exe109⤵PID:1524
-
\??\c:\pjdvj.exec:\pjdvj.exe110⤵PID:2100
-
\??\c:\lfxfllx.exec:\lfxfllx.exe111⤵PID:2212
-
\??\c:\5bnntn.exec:\5bnntn.exe112⤵PID:1544
-
\??\c:\btbtbh.exec:\btbtbh.exe113⤵PID:2636
-
\??\c:\dvpjp.exec:\dvpjp.exe114⤵PID:2128
-
\??\c:\lfxlfrl.exec:\lfxlfrl.exe115⤵PID:1048
-
\??\c:\7htnbb.exec:\7htnbb.exe116⤵PID:1732
-
\??\c:\pdjjp.exec:\pdjjp.exe117⤵PID:2160
-
\??\c:\dvdvp.exec:\dvdvp.exe118⤵PID:2648
-
\??\c:\3rflrrx.exec:\3rflrrx.exe119⤵
- System Location Discovery: System Language Discovery
PID:2664 -
\??\c:\nbhhtb.exec:\nbhhtb.exe120⤵
- System Location Discovery: System Language Discovery
PID:2812 -
\??\c:\ddvdp.exec:\ddvdp.exe121⤵PID:2740
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-