Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20/11/2024, 03:23
Behavioral task
behavioral1
Sample
1f8a88f830631bd075e61e917a002ba8c1105d27b208841453252467bfd48b47.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
1f8a88f830631bd075e61e917a002ba8c1105d27b208841453252467bfd48b47.exe
-
Size
97KB
-
MD5
25016851fe25c961431476e6efdbbe99
-
SHA1
29331be1629d1d4403f086e60415ab03e2a095b3
-
SHA256
1f8a88f830631bd075e61e917a002ba8c1105d27b208841453252467bfd48b47
-
SHA512
4d8628c90ed3bf9e3b31154781dd1bd8ece5d550721f945dba484ef5f401b4344094b9252af30077310ef563fb2e32aee16111af2caa949e273d699b7c2893ef
-
SSDEEP
3072:8hOmTsF93UYfwC6GIout0fmCiiiXA6mzgJ:8cm4FmowdHoSgWrXUgJ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 59 IoCs
resource yara_rule behavioral1/memory/1968-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2548-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1592-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1692-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1692-34-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2848-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2764-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2780-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2780-75-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/2652-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2652-84-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2668-91-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2668-95-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2444-103-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1260-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1260-109-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1260-113-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1652-127-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2788-122-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1652-132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1652-131-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2692-149-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/296-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1544-166-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2252-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2156-179-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2156-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2156-183-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1576-192-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/1576-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2112-199-0x0000000001B80000-0x0000000001BA7000-memory.dmp family_blackmoon behavioral1/memory/2244-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2040-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/900-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2892-264-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2548-290-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2684-296-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1488-302-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2948-308-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1912-320-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1488-319-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2736-337-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1312-350-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1300-392-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1236-398-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2936-404-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1608-415-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/1796-427-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1608-433-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2180-439-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2176-446-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2176-445-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2072-477-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2996-511-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1676-532-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3052-627-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/300-682-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2076-699-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2144-705-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2548 jdpdp.exe 1592 rfrllxf.exe 1692 ffrlxll.exe 2744 7dpdj.exe 2848 xfrxxrx.exe 2736 vdjvp.exe 2764 ppvdp.exe 2780 xfrrxrr.exe 2652 ffllfrx.exe 2668 pdppp.exe 2444 vvvpj.exe 1260 xfrlxrr.exe 2788 hbhhth.exe 1652 dppjv.exe 1940 xlfxlll.exe 2692 hnnnnb.exe 296 jpvvd.exe 1544 xfxxfxx.exe 2252 xlxrxrr.exe 2156 tbhnnn.exe 1576 3jpjd.exe 2112 rlxlxrf.exe 2072 bthtbn.exe 2244 vdpjv.exe 2040 djvvj.exe 848 rxlfrll.exe 1924 7thhnn.exe 900 rlrrllx.exe 2976 xxxrfrf.exe 2892 nhtbtb.exe 1800 vvvvd.exe 1744 flfflfl.exe 2528 fxrxxff.exe 2548 5nnhtt.exe 2684 pvpvv.exe 1488 lfrfrxr.exe 2948 5llffll.exe 2436 nnbtbb.exe 1912 vjddd.exe 2972 ddjjj.exe 2332 rrfxxff.exe 2736 hbnttb.exe 2852 jddpv.exe 1312 ddpdv.exe 2856 flfrxxl.exe 2636 bhbhtn.exe 1552 pdvvd.exe 3052 xrrrrll.exe 1532 rxlllxf.exe 1572 hnhhnb.exe 2924 9bnbnb.exe 1300 pjvvd.exe 1236 ppdpv.exe 2936 fffxrlf.exe 2360 ntbtbb.exe 1608 ttnbnb.exe 1428 dvvdj.exe 1796 llrxflr.exe 1156 xlffllr.exe 2180 tbhttn.exe 2176 pjjdd.exe 348 vdjdd.exe 1736 xlrlrrr.exe 2980 5bnhht.exe -
resource yara_rule behavioral1/memory/1968-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1968-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000b000000012029-9.dat upx behavioral1/memory/2548-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000160ae-17.dat upx behavioral1/memory/1592-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1592-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1692-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000160d5-27.dat upx behavioral1/files/0x0008000000016311-36.dat upx behavioral1/files/0x00070000000164b4-43.dat upx behavioral1/memory/2848-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000165b6-52.dat upx behavioral1/files/0x0007000000016652-58.dat upx behavioral1/files/0x0007000000016858-66.dat upx behavioral1/memory/2780-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2764-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2780-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016bfc-76.dat upx behavioral1/files/0x000500000001933e-88.dat upx behavioral1/memory/2668-87-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2652-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019346-96.dat upx behavioral1/memory/2668-95-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2444-103-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0005000000019384-105.dat upx behavioral1/memory/1260-107-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193a2-114.dat upx behavioral1/files/0x00050000000193af-124.dat upx behavioral1/memory/2788-123-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2788-122-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193c9-133.dat upx behavioral1/memory/1652-132-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193f8-142.dat upx behavioral1/memory/2692-141-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193fa-150.dat upx behavioral1/memory/2692-149-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019408-157.dat upx behavioral1/memory/1544-159-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/296-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019494-167.dat upx behavioral1/files/0x00050000000194a7-174.dat upx behavioral1/memory/2252-175-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194b4-185.dat upx behavioral1/memory/2156-184-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2112-196-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194d4-195.dat upx behavioral1/memory/1576-194-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194da-203.dat upx behavioral1/files/0x00050000000194e2-211.dat upx behavioral1/files/0x00050000000194ea-218.dat upx behavioral1/memory/2244-217-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194f2-227.dat upx behavioral1/memory/2040-225-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194f6-233.dat upx behavioral1/files/0x0008000000015e47-241.dat upx behavioral1/memory/900-249-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019501-248.dat upx behavioral1/files/0x0005000000019503-256.dat upx behavioral1/memory/2892-264-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019515-265.dat upx behavioral1/files/0x000500000001953a-272.dat upx behavioral1/memory/2548-290-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2684-296-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnntnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxrfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnthhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxlfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1968 wrote to memory of 2548 1968 1f8a88f830631bd075e61e917a002ba8c1105d27b208841453252467bfd48b47.exe 30 PID 1968 wrote to memory of 2548 1968 1f8a88f830631bd075e61e917a002ba8c1105d27b208841453252467bfd48b47.exe 30 PID 1968 wrote to memory of 2548 1968 1f8a88f830631bd075e61e917a002ba8c1105d27b208841453252467bfd48b47.exe 30 PID 1968 wrote to memory of 2548 1968 1f8a88f830631bd075e61e917a002ba8c1105d27b208841453252467bfd48b47.exe 30 PID 2548 wrote to memory of 1592 2548 jdpdp.exe 31 PID 2548 wrote to memory of 1592 2548 jdpdp.exe 31 PID 2548 wrote to memory of 1592 2548 jdpdp.exe 31 PID 2548 wrote to memory of 1592 2548 jdpdp.exe 31 PID 1592 wrote to memory of 1692 1592 rfrllxf.exe 32 PID 1592 wrote to memory of 1692 1592 rfrllxf.exe 32 PID 1592 wrote to memory of 1692 1592 rfrllxf.exe 32 PID 1592 wrote to memory of 1692 1592 rfrllxf.exe 32 PID 1692 wrote to memory of 2744 1692 ffrlxll.exe 33 PID 1692 wrote to memory of 2744 1692 ffrlxll.exe 33 PID 1692 wrote to memory of 2744 1692 ffrlxll.exe 33 PID 1692 wrote to memory of 2744 1692 ffrlxll.exe 33 PID 2744 wrote to memory of 2848 2744 7dpdj.exe 34 PID 2744 wrote to memory of 2848 2744 7dpdj.exe 34 PID 2744 wrote to memory of 2848 2744 7dpdj.exe 34 PID 2744 wrote to memory of 2848 2744 7dpdj.exe 34 PID 2848 wrote to memory of 2736 2848 xfrxxrx.exe 35 PID 2848 wrote to memory of 2736 2848 xfrxxrx.exe 35 PID 2848 wrote to memory of 2736 2848 xfrxxrx.exe 35 PID 2848 wrote to memory of 2736 2848 xfrxxrx.exe 35 PID 2736 wrote to memory of 2764 2736 vdjvp.exe 36 PID 2736 wrote to memory of 2764 2736 vdjvp.exe 36 PID 2736 wrote to memory of 2764 2736 vdjvp.exe 36 PID 2736 wrote to memory of 2764 2736 vdjvp.exe 36 PID 2764 wrote to memory of 2780 2764 ppvdp.exe 37 PID 2764 wrote to memory of 2780 2764 ppvdp.exe 37 PID 2764 wrote to memory of 2780 2764 ppvdp.exe 37 PID 2764 wrote to memory of 2780 2764 ppvdp.exe 37 PID 2780 wrote to memory of 2652 2780 xfrrxrr.exe 38 PID 2780 wrote to memory of 2652 2780 xfrrxrr.exe 38 PID 2780 wrote to memory of 2652 2780 xfrrxrr.exe 38 PID 2780 wrote to memory of 2652 2780 xfrrxrr.exe 38 PID 2652 wrote to memory of 2668 2652 ffllfrx.exe 39 PID 2652 wrote to memory of 2668 2652 ffllfrx.exe 39 PID 2652 wrote to memory of 2668 2652 ffllfrx.exe 39 PID 2652 wrote to memory of 2668 2652 ffllfrx.exe 39 PID 2668 wrote to memory of 2444 2668 pdppp.exe 40 PID 2668 wrote to memory of 2444 2668 pdppp.exe 40 PID 2668 wrote to memory of 2444 2668 pdppp.exe 40 PID 2668 wrote to memory of 2444 2668 pdppp.exe 40 PID 2444 wrote to memory of 1260 2444 vvvpj.exe 41 PID 2444 wrote to memory of 1260 2444 vvvpj.exe 41 PID 2444 wrote to memory of 1260 2444 vvvpj.exe 41 PID 2444 wrote to memory of 1260 2444 vvvpj.exe 41 PID 1260 wrote to memory of 2788 1260 xfrlxrr.exe 42 PID 1260 wrote to memory of 2788 1260 xfrlxrr.exe 42 PID 1260 wrote to memory of 2788 1260 xfrlxrr.exe 42 PID 1260 wrote to memory of 2788 1260 xfrlxrr.exe 42 PID 2788 wrote to memory of 1652 2788 hbhhth.exe 43 PID 2788 wrote to memory of 1652 2788 hbhhth.exe 43 PID 2788 wrote to memory of 1652 2788 hbhhth.exe 43 PID 2788 wrote to memory of 1652 2788 hbhhth.exe 43 PID 1652 wrote to memory of 1940 1652 dppjv.exe 44 PID 1652 wrote to memory of 1940 1652 dppjv.exe 44 PID 1652 wrote to memory of 1940 1652 dppjv.exe 44 PID 1652 wrote to memory of 1940 1652 dppjv.exe 44 PID 1940 wrote to memory of 2692 1940 xlfxlll.exe 45 PID 1940 wrote to memory of 2692 1940 xlfxlll.exe 45 PID 1940 wrote to memory of 2692 1940 xlfxlll.exe 45 PID 1940 wrote to memory of 2692 1940 xlfxlll.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f8a88f830631bd075e61e917a002ba8c1105d27b208841453252467bfd48b47.exe"C:\Users\Admin\AppData\Local\Temp\1f8a88f830631bd075e61e917a002ba8c1105d27b208841453252467bfd48b47.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\jdpdp.exec:\jdpdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\rfrllxf.exec:\rfrllxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
\??\c:\ffrlxll.exec:\ffrlxll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\7dpdj.exec:\7dpdj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\xfrxxrx.exec:\xfrxxrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\vdjvp.exec:\vdjvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\ppvdp.exec:\ppvdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\xfrrxrr.exec:\xfrrxrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\ffllfrx.exec:\ffllfrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\pdppp.exec:\pdppp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\vvvpj.exec:\vvvpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\xfrlxrr.exec:\xfrlxrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\hbhhth.exec:\hbhhth.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\dppjv.exec:\dppjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\xlfxlll.exec:\xlfxlll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\hnnnnb.exec:\hnnnnb.exe17⤵
- Executes dropped EXE
PID:2692 -
\??\c:\jpvvd.exec:\jpvvd.exe18⤵
- Executes dropped EXE
PID:296 -
\??\c:\xfxxfxx.exec:\xfxxfxx.exe19⤵
- Executes dropped EXE
PID:1544 -
\??\c:\xlxrxrr.exec:\xlxrxrr.exe20⤵
- Executes dropped EXE
PID:2252 -
\??\c:\tbhnnn.exec:\tbhnnn.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2156 -
\??\c:\3jpjd.exec:\3jpjd.exe22⤵
- Executes dropped EXE
PID:1576 -
\??\c:\rlxlxrf.exec:\rlxlxrf.exe23⤵
- Executes dropped EXE
PID:2112 -
\??\c:\bthtbn.exec:\bthtbn.exe24⤵
- Executes dropped EXE
PID:2072 -
\??\c:\vdpjv.exec:\vdpjv.exe25⤵
- Executes dropped EXE
PID:2244 -
\??\c:\djvvj.exec:\djvvj.exe26⤵
- Executes dropped EXE
PID:2040 -
\??\c:\rxlfrll.exec:\rxlfrll.exe27⤵
- Executes dropped EXE
PID:848 -
\??\c:\7thhnn.exec:\7thhnn.exe28⤵
- Executes dropped EXE
PID:1924 -
\??\c:\rlrrllx.exec:\rlrrllx.exe29⤵
- Executes dropped EXE
PID:900 -
\??\c:\xxxrfrf.exec:\xxxrfrf.exe30⤵
- Executes dropped EXE
PID:2976 -
\??\c:\nhtbtb.exec:\nhtbtb.exe31⤵
- Executes dropped EXE
PID:2892 -
\??\c:\vvvvd.exec:\vvvvd.exe32⤵
- Executes dropped EXE
PID:1800 -
\??\c:\flfflfl.exec:\flfflfl.exe33⤵
- Executes dropped EXE
PID:1744 -
\??\c:\fxrxxff.exec:\fxrxxff.exe34⤵
- Executes dropped EXE
PID:2528 -
\??\c:\5nnhtt.exec:\5nnhtt.exe35⤵
- Executes dropped EXE
PID:2548 -
\??\c:\pvpvv.exec:\pvpvv.exe36⤵
- Executes dropped EXE
PID:2684 -
\??\c:\lfrfrxr.exec:\lfrfrxr.exe37⤵
- Executes dropped EXE
PID:1488 -
\??\c:\5llffll.exec:\5llffll.exe38⤵
- Executes dropped EXE
PID:2948 -
\??\c:\nnbtbb.exec:\nnbtbb.exe39⤵
- Executes dropped EXE
PID:2436 -
\??\c:\vjddd.exec:\vjddd.exe40⤵
- Executes dropped EXE
PID:1912 -
\??\c:\ddjjj.exec:\ddjjj.exe41⤵
- Executes dropped EXE
PID:2972 -
\??\c:\rrfxxff.exec:\rrfxxff.exe42⤵
- Executes dropped EXE
PID:2332 -
\??\c:\hbnttb.exec:\hbnttb.exe43⤵
- Executes dropped EXE
PID:2736 -
\??\c:\jddpv.exec:\jddpv.exe44⤵
- Executes dropped EXE
PID:2852 -
\??\c:\ddpdv.exec:\ddpdv.exe45⤵
- Executes dropped EXE
PID:1312 -
\??\c:\flfrxxl.exec:\flfrxxl.exe46⤵
- Executes dropped EXE
PID:2856 -
\??\c:\bhbhtn.exec:\bhbhtn.exe47⤵
- Executes dropped EXE
PID:2636 -
\??\c:\pdvvd.exec:\pdvvd.exe48⤵
- Executes dropped EXE
PID:1552 -
\??\c:\xrrrrll.exec:\xrrrrll.exe49⤵
- Executes dropped EXE
PID:3052 -
\??\c:\rxlllxf.exec:\rxlllxf.exe50⤵
- Executes dropped EXE
PID:1532 -
\??\c:\hnhhnb.exec:\hnhhnb.exe51⤵
- Executes dropped EXE
PID:1572 -
\??\c:\9bnbnb.exec:\9bnbnb.exe52⤵
- Executes dropped EXE
PID:2924 -
\??\c:\pjvvd.exec:\pjvvd.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1300 -
\??\c:\ppdpv.exec:\ppdpv.exe54⤵
- Executes dropped EXE
PID:1236 -
\??\c:\fffxrlf.exec:\fffxrlf.exe55⤵
- Executes dropped EXE
PID:2936 -
\??\c:\ntbtbb.exec:\ntbtbb.exe56⤵
- Executes dropped EXE
PID:2360 -
\??\c:\ttnbnb.exec:\ttnbnb.exe57⤵
- Executes dropped EXE
PID:1608 -
\??\c:\dvvdj.exec:\dvvdj.exe58⤵
- Executes dropped EXE
PID:1428 -
\??\c:\llrxflr.exec:\llrxflr.exe59⤵
- Executes dropped EXE
PID:1796 -
\??\c:\xlffllr.exec:\xlffllr.exe60⤵
- Executes dropped EXE
PID:1156 -
\??\c:\tbhttn.exec:\tbhttn.exe61⤵
- Executes dropped EXE
PID:2180 -
\??\c:\pjjdd.exec:\pjjdd.exe62⤵
- Executes dropped EXE
PID:2176 -
\??\c:\vdjdd.exec:\vdjdd.exe63⤵
- Executes dropped EXE
PID:348 -
\??\c:\xlrlrrr.exec:\xlrlrrr.exe64⤵
- Executes dropped EXE
PID:1736 -
\??\c:\5bnhht.exec:\5bnhht.exe65⤵
- Executes dropped EXE
PID:2980 -
\??\c:\hnbbhb.exec:\hnbbhb.exe66⤵PID:2432
-
\??\c:\vpvjp.exec:\vpvjp.exe67⤵PID:1884
-
\??\c:\ppjjp.exec:\ppjjp.exe68⤵PID:2072
-
\??\c:\xffxffl.exec:\xffxffl.exe69⤵PID:1932
-
\??\c:\ffxxlfl.exec:\ffxxlfl.exe70⤵PID:1296
-
\??\c:\hnbtbb.exec:\hnbtbb.exe71⤵PID:2196
-
\??\c:\5vdpv.exec:\5vdpv.exe72⤵PID:1756
-
\??\c:\djvdp.exec:\djvdp.exe73⤵PID:1948
-
\??\c:\xffrxrx.exec:\xffrxrx.exe74⤵PID:760
-
\??\c:\rxlllfl.exec:\rxlllfl.exe75⤵PID:2996
-
\??\c:\nbtbhh.exec:\nbtbhh.exe76⤵PID:1808
-
\??\c:\vdvvj.exec:\vdvvj.exe77⤵PID:2992
-
\??\c:\vvpjv.exec:\vvpjv.exe78⤵PID:1676
-
\??\c:\xfrrrxl.exec:\xfrrrxl.exe79⤵PID:2380
-
\??\c:\lrlffxf.exec:\lrlffxf.exe80⤵PID:1620
-
\??\c:\1htttt.exec:\1htttt.exe81⤵PID:2528
-
\??\c:\vdvpv.exec:\vdvpv.exe82⤵PID:2548
-
\??\c:\9pppv.exec:\9pppv.exe83⤵PID:1936
-
\??\c:\rxrrxrx.exec:\rxrrxrx.exe84⤵PID:1592
-
\??\c:\flfxxxx.exec:\flfxxxx.exe85⤵PID:2452
-
\??\c:\ntnhnb.exec:\ntnhnb.exe86⤵PID:2712
-
\??\c:\pvppj.exec:\pvppj.exe87⤵PID:2812
-
\??\c:\pvddj.exec:\pvddj.exe88⤵PID:2708
-
\??\c:\5flxfxf.exec:\5flxfxf.exe89⤵PID:2848
-
\??\c:\1rxrxrr.exec:\1rxrxrr.exe90⤵PID:2332
-
\??\c:\3tbtnt.exec:\3tbtnt.exe91⤵PID:2632
-
\??\c:\hhtnnn.exec:\hhtnnn.exe92⤵PID:2780
-
\??\c:\5jjpv.exec:\5jjpv.exe93⤵
- System Location Discovery: System Language Discovery
PID:2824 -
\??\c:\rffffxx.exec:\rffffxx.exe94⤵PID:2856
-
\??\c:\fflxrxr.exec:\fflxrxr.exe95⤵PID:3048
-
\??\c:\1nnhbt.exec:\1nnhbt.exe96⤵PID:1552
-
\??\c:\ddjpv.exec:\ddjpv.exe97⤵PID:3052
-
\??\c:\jpvpp.exec:\jpvpp.exe98⤵PID:764
-
\??\c:\flxxxxx.exec:\flxxxxx.exe99⤵PID:1568
-
\??\c:\tnnhtb.exec:\tnnhtb.exe100⤵PID:1064
-
\??\c:\bbhhhb.exec:\bbhhhb.exe101⤵PID:2576
-
\??\c:\tbbnnb.exec:\tbbnnb.exe102⤵PID:1520
-
\??\c:\vdvjj.exec:\vdvjj.exe103⤵PID:1916
-
\??\c:\xxxrxfx.exec:\xxxrxfx.exe104⤵PID:2360
-
\??\c:\xfrlrrx.exec:\xfrlrrx.exe105⤵PID:1608
-
\??\c:\hntntn.exec:\hntntn.exe106⤵PID:300
-
\??\c:\tbhttb.exec:\tbhttb.exe107⤵PID:1904
-
\??\c:\pvvdv.exec:\pvvdv.exe108⤵PID:2152
-
\??\c:\9xfrrll.exec:\9xfrrll.exe109⤵PID:2076
-
\??\c:\xrlrxlr.exec:\xrlrxlr.exe110⤵PID:2144
-
\??\c:\hnbttt.exec:\hnbttt.exe111⤵PID:348
-
\??\c:\nthttn.exec:\nthttn.exe112⤵PID:2208
-
\??\c:\djjjp.exec:\djjjp.exe113⤵PID:1728
-
\??\c:\jjjpv.exec:\jjjpv.exe114⤵PID:304
-
\??\c:\lxlflfl.exec:\lxlflfl.exe115⤵PID:448
-
\??\c:\xxxlfxr.exec:\xxxlfxr.exe116⤵PID:2072
-
\??\c:\nthtbb.exec:\nthtbb.exe117⤵PID:2532
-
\??\c:\ppvvd.exec:\ppvvd.exe118⤵PID:1920
-
\??\c:\djpdd.exec:\djpdd.exe119⤵PID:2196
-
\??\c:\xrlxrll.exec:\xrlxrll.exe120⤵PID:1756
-
\??\c:\xfxrxrr.exec:\xfxrxrr.exe121⤵PID:1688
-
\??\c:\htbbnb.exec:\htbbnb.exe122⤵PID:2844
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-