Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20/11/2024, 00:08
Behavioral task
behavioral1
Sample
e15f3485aca4e9e55d821edbfd0baf911fd77d7e483192e9a812a9297bc0eb5a.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
e15f3485aca4e9e55d821edbfd0baf911fd77d7e483192e9a812a9297bc0eb5a.exe
-
Size
70KB
-
MD5
2f50c62ee770fb5e178dc0e5e0cff804
-
SHA1
944c092fe4f1a9582b19b3ca3a95539630cf7fdd
-
SHA256
e15f3485aca4e9e55d821edbfd0baf911fd77d7e483192e9a812a9297bc0eb5a
-
SHA512
7a07b015e07904008a8ceede470a687c20e8624a0c2cb1f3d07a48e0a708686433061691911ffb90ab1a55c979c53e72f7c1361d5f954cc6779be17d8dfd52cd
-
SSDEEP
1536:cvQBeOGtrYS3srx93UBWfwC6Ggnouy8HglW8waWny:chOmTsF93UYfwC6GIout3t7y
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 56 IoCs
resource yara_rule behavioral1/memory/2096-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1744-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1692-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2452-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2504-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2756-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2756-55-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2976-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2976-76-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2904-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2372-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2976-74-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2848-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3060-112-0x00000000005C0000-0x00000000005E7000-memory.dmp family_blackmoon behavioral1/memory/3060-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1820-122-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1820-120-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/296-132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3060-144-0x00000000005C0000-0x00000000005E7000-memory.dmp family_blackmoon behavioral1/memory/2676-143-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/332-142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/892-154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2708-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2232-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1796-206-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/628-216-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/408-224-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/408-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/576-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/576-235-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2492-255-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2480-264-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1272-281-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2100-299-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2452-307-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1604-314-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2832-369-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/708-407-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1188-420-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/536-433-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1908-446-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2156-515-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2204-535-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2396-557-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2884-606-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1792-609-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2716-614-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1808-633-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2556-820-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2492-1046-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2824-1133-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1992-1171-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/304-1198-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2952-1217-0x00000000005C0000-0x00000000005E7000-memory.dmp family_blackmoon behavioral1/memory/1956-1311-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2088-1322-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1744 rxffrxl.exe 2452 1hnhtn.exe 1692 pdpdd.exe 2504 frrfxlf.exe 2756 9vjjj.exe 2848 flllxrx.exe 2976 7bhbtn.exe 2904 vdvjd.exe 2372 ddjdd.exe 2676 xrfflxf.exe 3060 tbntnt.exe 1820 bbnhbh.exe 296 dvpvj.exe 332 btnbhh.exe 892 pdpvj.exe 1052 nnhtnt.exe 2036 jjjdd.exe 1224 rlxlrxl.exe 2232 3thtbh.exe 2708 tbtbnb.exe 1796 nbnbbb.exe 628 fxfrrxf.exe 408 btnhth.exe 576 jppjj.exe 2672 3jjvj.exe 2492 nnnhbn.exe 2480 pdppv.exe 2292 rxfflll.exe 1272 bhntth.exe 2096 vdjdv.exe 2100 rrlfrxl.exe 2452 vpdpv.exe 1604 9jdjd.exe 1600 3nhnhn.exe 2132 ttttbn.exe 2856 jvppj.exe 2884 flflfrr.exe 2716 nbbbnt.exe 2836 nnhntn.exe 1436 djvvv.exe 2636 flfrxxf.exe 2832 rxxrrfr.exe 3056 hnhtbn.exe 2240 jvdvp.exe 2628 fxxrxrr.exe 852 rrxxfxr.exe 2908 btbntt.exe 708 vdpdp.exe 488 jdjvj.exe 1188 fxllrlr.exe 1704 1nbbhb.exe 536 pvdjd.exe 2168 vjppj.exe 1908 frfrffl.exe 1140 nnnbnh.exe 2956 5jjpp.exe 1952 jpvdd.exe 2068 fllflll.exe 688 nbhthb.exe 1576 tbnhhb.exe 3000 3dvdv.exe 564 xflfxfx.exe 940 thbhhb.exe 1860 btnhtn.exe -
resource yara_rule behavioral1/memory/2096-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2096-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000012117-8.dat upx behavioral1/files/0x00070000000186ea-20.dat upx behavioral1/memory/2452-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1744-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1692-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000186ee-29.dat upx behavioral1/memory/2452-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000186fd-36.dat upx behavioral1/files/0x0007000000018728-47.dat upx behavioral1/memory/2504-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018784-58.dat upx behavioral1/memory/2756-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2976-69-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001878f-67.dat upx behavioral1/memory/2904-80-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195c5-95.dat upx behavioral1/files/0x0005000000019609-104.dat upx behavioral1/memory/2372-88-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000001925e-87.dat upx behavioral1/files/0x00060000000187a5-78.dat upx behavioral1/memory/2848-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001960b-114.dat upx behavioral1/memory/3060-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001960d-123.dat upx behavioral1/memory/1820-122-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001960f-134.dat upx behavioral1/memory/332-133-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/296-132-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3060-144-0x00000000005C0000-0x00000000005E7000-memory.dmp upx behavioral1/memory/332-142-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019611-141.dat upx behavioral1/memory/892-154-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019613-155.dat upx behavioral1/files/0x0005000000019615-162.dat upx behavioral1/files/0x0005000000019617-173.dat upx behavioral1/memory/1224-172-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019619-180.dat upx behavioral1/memory/2708-192-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001961b-191.dat upx behavioral1/memory/2232-190-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001961d-199.dat upx behavioral1/files/0x000f000000018676-207.dat upx behavioral1/memory/628-216-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001961f-217.dat upx behavioral1/files/0x0005000000019621-228.dat upx behavioral1/memory/408-227-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019622-238.dat upx behavioral1/memory/576-237-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/576-234-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0005000000019623-245.dat upx behavioral1/memory/2492-247-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019625-256.dat upx behavioral1/memory/2492-255-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019667-266.dat upx behavioral1/memory/2480-264-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000196af-273.dat upx behavioral1/files/0x00050000000196b1-282.dat upx behavioral1/memory/1272-281-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001977d-290.dat upx behavioral1/memory/2100-299-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000197f8-300.dat upx behavioral1/memory/2452-307-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxllrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnttth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxxllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllfxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlfxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxllrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2096 wrote to memory of 1744 2096 e15f3485aca4e9e55d821edbfd0baf911fd77d7e483192e9a812a9297bc0eb5a.exe 30 PID 2096 wrote to memory of 1744 2096 e15f3485aca4e9e55d821edbfd0baf911fd77d7e483192e9a812a9297bc0eb5a.exe 30 PID 2096 wrote to memory of 1744 2096 e15f3485aca4e9e55d821edbfd0baf911fd77d7e483192e9a812a9297bc0eb5a.exe 30 PID 2096 wrote to memory of 1744 2096 e15f3485aca4e9e55d821edbfd0baf911fd77d7e483192e9a812a9297bc0eb5a.exe 30 PID 1744 wrote to memory of 2452 1744 rxffrxl.exe 31 PID 1744 wrote to memory of 2452 1744 rxffrxl.exe 31 PID 1744 wrote to memory of 2452 1744 rxffrxl.exe 31 PID 1744 wrote to memory of 2452 1744 rxffrxl.exe 31 PID 2452 wrote to memory of 1692 2452 1hnhtn.exe 32 PID 2452 wrote to memory of 1692 2452 1hnhtn.exe 32 PID 2452 wrote to memory of 1692 2452 1hnhtn.exe 32 PID 2452 wrote to memory of 1692 2452 1hnhtn.exe 32 PID 1692 wrote to memory of 2504 1692 pdpdd.exe 33 PID 1692 wrote to memory of 2504 1692 pdpdd.exe 33 PID 1692 wrote to memory of 2504 1692 pdpdd.exe 33 PID 1692 wrote to memory of 2504 1692 pdpdd.exe 33 PID 2504 wrote to memory of 2756 2504 frrfxlf.exe 34 PID 2504 wrote to memory of 2756 2504 frrfxlf.exe 34 PID 2504 wrote to memory of 2756 2504 frrfxlf.exe 34 PID 2504 wrote to memory of 2756 2504 frrfxlf.exe 34 PID 2756 wrote to memory of 2848 2756 9vjjj.exe 35 PID 2756 wrote to memory of 2848 2756 9vjjj.exe 35 PID 2756 wrote to memory of 2848 2756 9vjjj.exe 35 PID 2756 wrote to memory of 2848 2756 9vjjj.exe 35 PID 2848 wrote to memory of 2976 2848 flllxrx.exe 36 PID 2848 wrote to memory of 2976 2848 flllxrx.exe 36 PID 2848 wrote to memory of 2976 2848 flllxrx.exe 36 PID 2848 wrote to memory of 2976 2848 flllxrx.exe 36 PID 2976 wrote to memory of 2904 2976 7bhbtn.exe 37 PID 2976 wrote to memory of 2904 2976 7bhbtn.exe 37 PID 2976 wrote to memory of 2904 2976 7bhbtn.exe 37 PID 2976 wrote to memory of 2904 2976 7bhbtn.exe 37 PID 2904 wrote to memory of 2372 2904 vdvjd.exe 38 PID 2904 wrote to memory of 2372 2904 vdvjd.exe 38 PID 2904 wrote to memory of 2372 2904 vdvjd.exe 38 PID 2904 wrote to memory of 2372 2904 vdvjd.exe 38 PID 2372 wrote to memory of 2676 2372 ddjdd.exe 39 PID 2372 wrote to memory of 2676 2372 ddjdd.exe 39 PID 2372 wrote to memory of 2676 2372 ddjdd.exe 39 PID 2372 wrote to memory of 2676 2372 ddjdd.exe 39 PID 2676 wrote to memory of 3060 2676 xrfflxf.exe 40 PID 2676 wrote to memory of 3060 2676 xrfflxf.exe 40 PID 2676 wrote to memory of 3060 2676 xrfflxf.exe 40 PID 2676 wrote to memory of 3060 2676 xrfflxf.exe 40 PID 3060 wrote to memory of 1820 3060 tbntnt.exe 41 PID 3060 wrote to memory of 1820 3060 tbntnt.exe 41 PID 3060 wrote to memory of 1820 3060 tbntnt.exe 41 PID 3060 wrote to memory of 1820 3060 tbntnt.exe 41 PID 1820 wrote to memory of 296 1820 bbnhbh.exe 42 PID 1820 wrote to memory of 296 1820 bbnhbh.exe 42 PID 1820 wrote to memory of 296 1820 bbnhbh.exe 42 PID 1820 wrote to memory of 296 1820 bbnhbh.exe 42 PID 296 wrote to memory of 332 296 dvpvj.exe 43 PID 296 wrote to memory of 332 296 dvpvj.exe 43 PID 296 wrote to memory of 332 296 dvpvj.exe 43 PID 296 wrote to memory of 332 296 dvpvj.exe 43 PID 332 wrote to memory of 892 332 btnbhh.exe 44 PID 332 wrote to memory of 892 332 btnbhh.exe 44 PID 332 wrote to memory of 892 332 btnbhh.exe 44 PID 332 wrote to memory of 892 332 btnbhh.exe 44 PID 892 wrote to memory of 1052 892 pdpvj.exe 45 PID 892 wrote to memory of 1052 892 pdpvj.exe 45 PID 892 wrote to memory of 1052 892 pdpvj.exe 45 PID 892 wrote to memory of 1052 892 pdpvj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\e15f3485aca4e9e55d821edbfd0baf911fd77d7e483192e9a812a9297bc0eb5a.exe"C:\Users\Admin\AppData\Local\Temp\e15f3485aca4e9e55d821edbfd0baf911fd77d7e483192e9a812a9297bc0eb5a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\rxffrxl.exec:\rxffrxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
\??\c:\1hnhtn.exec:\1hnhtn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\pdpdd.exec:\pdpdd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\frrfxlf.exec:\frrfxlf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\9vjjj.exec:\9vjjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\flllxrx.exec:\flllxrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\7bhbtn.exec:\7bhbtn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\vdvjd.exec:\vdvjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\ddjdd.exec:\ddjdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\xrfflxf.exec:\xrfflxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\tbntnt.exec:\tbntnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\bbnhbh.exec:\bbnhbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\dvpvj.exec:\dvpvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:296 -
\??\c:\btnbhh.exec:\btnbhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:332 -
\??\c:\pdpvj.exec:\pdpvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:892 -
\??\c:\nnhtnt.exec:\nnhtnt.exe17⤵
- Executes dropped EXE
PID:1052 -
\??\c:\jjjdd.exec:\jjjdd.exe18⤵
- Executes dropped EXE
PID:2036 -
\??\c:\rlxlrxl.exec:\rlxlrxl.exe19⤵
- Executes dropped EXE
PID:1224 -
\??\c:\3thtbh.exec:\3thtbh.exe20⤵
- Executes dropped EXE
PID:2232 -
\??\c:\tbtbnb.exec:\tbtbnb.exe21⤵
- Executes dropped EXE
PID:2708 -
\??\c:\nbnbbb.exec:\nbnbbb.exe22⤵
- Executes dropped EXE
PID:1796 -
\??\c:\fxfrrxf.exec:\fxfrrxf.exe23⤵
- Executes dropped EXE
PID:628 -
\??\c:\btnhth.exec:\btnhth.exe24⤵
- Executes dropped EXE
PID:408 -
\??\c:\jppjj.exec:\jppjj.exe25⤵
- Executes dropped EXE
PID:576 -
\??\c:\3jjvj.exec:\3jjvj.exe26⤵
- Executes dropped EXE
PID:2672 -
\??\c:\nnnhbn.exec:\nnnhbn.exe27⤵
- Executes dropped EXE
PID:2492 -
\??\c:\pdppv.exec:\pdppv.exe28⤵
- Executes dropped EXE
PID:2480 -
\??\c:\rxfflll.exec:\rxfflll.exe29⤵
- Executes dropped EXE
PID:2292 -
\??\c:\bhntth.exec:\bhntth.exe30⤵
- Executes dropped EXE
PID:1272 -
\??\c:\vdjdv.exec:\vdjdv.exe31⤵
- Executes dropped EXE
PID:2096 -
\??\c:\rrlfrxl.exec:\rrlfrxl.exe32⤵
- Executes dropped EXE
PID:2100 -
\??\c:\vpdpv.exec:\vpdpv.exe33⤵
- Executes dropped EXE
PID:2452 -
\??\c:\9jdjd.exec:\9jdjd.exe34⤵
- Executes dropped EXE
PID:1604 -
\??\c:\3nhnhn.exec:\3nhnhn.exe35⤵
- Executes dropped EXE
PID:1600 -
\??\c:\ttttbn.exec:\ttttbn.exe36⤵
- Executes dropped EXE
PID:2132 -
\??\c:\jvppj.exec:\jvppj.exe37⤵
- Executes dropped EXE
PID:2856 -
\??\c:\flflfrr.exec:\flflfrr.exe38⤵
- Executes dropped EXE
PID:2884 -
\??\c:\nbbbnt.exec:\nbbbnt.exe39⤵
- Executes dropped EXE
PID:2716 -
\??\c:\nnhntn.exec:\nnhntn.exe40⤵
- Executes dropped EXE
PID:2836 -
\??\c:\djvvv.exec:\djvvv.exe41⤵
- Executes dropped EXE
PID:1436 -
\??\c:\flfrxxf.exec:\flfrxxf.exe42⤵
- Executes dropped EXE
PID:2636 -
\??\c:\rxxrrfr.exec:\rxxrrfr.exe43⤵
- Executes dropped EXE
PID:2832 -
\??\c:\hnhtbn.exec:\hnhtbn.exe44⤵
- Executes dropped EXE
PID:3056 -
\??\c:\jvdvp.exec:\jvdvp.exe45⤵
- Executes dropped EXE
PID:2240 -
\??\c:\fxxrxrr.exec:\fxxrxrr.exe46⤵
- Executes dropped EXE
PID:2628 -
\??\c:\rrxxfxr.exec:\rrxxfxr.exe47⤵
- Executes dropped EXE
PID:852 -
\??\c:\btbntt.exec:\btbntt.exe48⤵
- Executes dropped EXE
PID:2908 -
\??\c:\vdpdp.exec:\vdpdp.exe49⤵
- Executes dropped EXE
PID:708 -
\??\c:\jdjvj.exec:\jdjvj.exe50⤵
- Executes dropped EXE
PID:488 -
\??\c:\fxllrlr.exec:\fxllrlr.exe51⤵
- Executes dropped EXE
PID:1188 -
\??\c:\1nbbhb.exec:\1nbbhb.exe52⤵
- Executes dropped EXE
PID:1704 -
\??\c:\pvdjd.exec:\pvdjd.exe53⤵
- Executes dropped EXE
PID:536 -
\??\c:\vjppj.exec:\vjppj.exe54⤵
- Executes dropped EXE
PID:2168 -
\??\c:\frfrffl.exec:\frfrffl.exe55⤵
- Executes dropped EXE
PID:1908 -
\??\c:\nnnbnh.exec:\nnnbnh.exe56⤵
- Executes dropped EXE
PID:1140 -
\??\c:\5jjpp.exec:\5jjpp.exe57⤵
- Executes dropped EXE
PID:2956 -
\??\c:\jpvdd.exec:\jpvdd.exe58⤵
- Executes dropped EXE
PID:1952 -
\??\c:\fllflll.exec:\fllflll.exe59⤵
- Executes dropped EXE
PID:2068 -
\??\c:\nbhthb.exec:\nbhthb.exe60⤵
- Executes dropped EXE
PID:688 -
\??\c:\tbnhhb.exec:\tbnhhb.exe61⤵
- Executes dropped EXE
PID:1576 -
\??\c:\3dvdv.exec:\3dvdv.exe62⤵
- Executes dropped EXE
PID:3000 -
\??\c:\xflfxfx.exec:\xflfxfx.exe63⤵
- Executes dropped EXE
PID:564 -
\??\c:\thbhhb.exec:\thbhhb.exe64⤵
- Executes dropped EXE
PID:940 -
\??\c:\btnhtn.exec:\btnhtn.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1860 -
\??\c:\pdvpv.exec:\pdvpv.exe66⤵PID:2156
-
\??\c:\flrxlrr.exec:\flrxlrr.exe67⤵PID:1428
-
\??\c:\hhbnnh.exec:\hhbnnh.exe68⤵PID:340
-
\??\c:\jjjpv.exec:\jjjpv.exe69⤵PID:2204
-
\??\c:\vdvpj.exec:\vdvpj.exe70⤵PID:2292
-
\??\c:\rrrxlrf.exec:\rrrxlrf.exe71⤵PID:2288
-
\??\c:\5ntnht.exec:\5ntnht.exe72⤵PID:2228
-
\??\c:\hnhhtb.exec:\hnhhtb.exe73⤵PID:2396
-
\??\c:\9ppdd.exec:\9ppdd.exe74⤵PID:2368
-
\??\c:\jvjjp.exec:\jvjjp.exe75⤵PID:2092
-
\??\c:\rrlfxrr.exec:\rrlfxrr.exe76⤵PID:1976
-
\??\c:\nntttn.exec:\nntttn.exe77⤵PID:2824
-
\??\c:\jvdvv.exec:\jvdvv.exe78⤵PID:1792
-
\??\c:\pvddj.exec:\pvddj.exe79⤵PID:2132
-
\??\c:\llxllxr.exec:\llxllxr.exe80⤵PID:2764
-
\??\c:\hhtbnb.exec:\hhtbnb.exe81⤵PID:2884
-
\??\c:\hnhtnh.exec:\hnhtnh.exe82⤵PID:2716
-
\??\c:\jpjvd.exec:\jpjvd.exe83⤵PID:2724
-
\??\c:\fxrfrfx.exec:\fxrfrfx.exe84⤵PID:2604
-
\??\c:\1htbbh.exec:\1htbbh.exe85⤵PID:1808
-
\??\c:\ddvdv.exec:\ddvdv.exe86⤵PID:2668
-
\??\c:\lfxxlfl.exec:\lfxxlfl.exe87⤵PID:2080
-
\??\c:\rlflxfl.exec:\rlflxfl.exe88⤵PID:664
-
\??\c:\tttnnh.exec:\tttnnh.exe89⤵PID:1828
-
\??\c:\1vdvd.exec:\1vdvd.exe90⤵PID:1472
-
\??\c:\llxlfrx.exec:\llxlfrx.exe91⤵PID:2924
-
\??\c:\1xfxrfr.exec:\1xfxrfr.exe92⤵PID:584
-
\??\c:\hbttbh.exec:\hbttbh.exe93⤵PID:1144
-
\??\c:\djddj.exec:\djddj.exe94⤵PID:1724
-
\??\c:\rxllxrf.exec:\rxllxrf.exe95⤵PID:2432
-
\??\c:\tnhhth.exec:\tnhhth.exe96⤵PID:2044
-
\??\c:\3nhntb.exec:\3nhntb.exe97⤵PID:1008
-
\??\c:\pvpjv.exec:\pvpjv.exe98⤵PID:1908
-
\??\c:\7xffrlr.exec:\7xffrlr.exe99⤵PID:2000
-
\??\c:\lrrxlrr.exec:\lrrxlrr.exe100⤵PID:2232
-
\??\c:\bnbtnn.exec:\bnbtnn.exe101⤵PID:2540
-
\??\c:\5pjdp.exec:\5pjdp.exe102⤵PID:1980
-
\??\c:\3frrfrx.exec:\3frrfrx.exe103⤵PID:688
-
\??\c:\llrrxlr.exec:\llrrxlr.exe104⤵PID:1892
-
\??\c:\nhtbth.exec:\nhtbth.exe105⤵PID:3000
-
\??\c:\jvvjd.exec:\jvvjd.exe106⤵PID:2996
-
\??\c:\rxxxlxl.exec:\rxxxlxl.exe107⤵PID:940
-
\??\c:\hhhhbh.exec:\hhhhbh.exe108⤵PID:544
-
\??\c:\vjvvd.exec:\vjvvd.exe109⤵PID:2156
-
\??\c:\vvjvv.exec:\vvjvv.exe110⤵PID:1920
-
\??\c:\rxllllr.exec:\rxllllr.exe111⤵PID:2892
-
\??\c:\bhnhtn.exec:\bhnhtn.exe112⤵PID:1500
-
\??\c:\dvpvp.exec:\dvpvp.exe113⤵PID:2364
-
\??\c:\jpvpp.exec:\jpvpp.exe114⤵PID:1728
-
\??\c:\btntnb.exec:\btntnb.exe115⤵PID:2556
-
\??\c:\hntbtb.exec:\hntbtb.exe116⤵PID:280
-
\??\c:\5vdpd.exec:\5vdpd.exe117⤵PID:1596
-
\??\c:\lrrlxlr.exec:\lrrlxlr.exe118⤵PID:1936
-
\??\c:\thbhnn.exec:\thbhnn.exe119⤵PID:2800
-
\??\c:\5pvjj.exec:\5pvjj.exe120⤵PID:2752
-
\??\c:\rllfxrl.exec:\rllfxrl.exe121⤵PID:2756
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-