Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 00:59
Static task
static1
Behavioral task
behavioral1
Sample
745fc305fb8a9429dcf042c5a9d409897df76187d3ac112446d1f6bee53ba87e.exe
Resource
win7-20240903-en
General
-
Target
745fc305fb8a9429dcf042c5a9d409897df76187d3ac112446d1f6bee53ba87e.exe
-
Size
456KB
-
MD5
077d40d43e799d020472eb47983000c4
-
SHA1
877ff8c579668c854c403118e31a2f26c09f1d2f
-
SHA256
745fc305fb8a9429dcf042c5a9d409897df76187d3ac112446d1f6bee53ba87e
-
SHA512
0f5f8fac7ed4dcca1591464898f2a864f79f1a1aad6445dc1ec69ec1cbc899b9776bb9531d00713fa00183012ef42cd34f90d6d528cb9a8bbc57f2b2b021b28b
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRwK:q7Tc2NYHUrAwfMp3CDRwK
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 39 IoCs
Processes:
resource yara_rule behavioral1/memory/2892-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1312-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2192-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/988-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1532-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/912-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2100-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1952-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2440-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1296-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2492-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/640-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2468-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/448-222-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1356-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1040-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1772-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/780-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-348-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1504-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2312-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-418-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2284-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-459-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2060-473-0x0000000001C70000-0x0000000001C9A000-memory.dmp family_blackmoon behavioral1/memory/2060-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1144-489-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/588-521-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1508-543-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2732-608-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1628-638-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1972-647-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2936-676-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1412-705-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
9hbbhh.exepdppv.exe9pdvv.exevpddv.exethnttb.exevpdjp.exebthntt.exepvddd.exexfrfxfr.exehthhtn.exedvppv.exe3bbbbb.exedpjjj.exelflrrrf.exe3htnnh.exedjvvp.exexlrlffl.exethhhnh.exerlrrlff.exenbhnhn.exe1rlfllr.exehtnntt.exevvjvv.exeffllxfr.exepjpjj.exe9rxfxff.exevjvvv.exe3rxxffl.exetntttt.exe7nhnnn.exerlrlfxf.exe9ntnnt.exexlxxfxf.exehnhtnn.exe9pjpd.exe5lfrxxf.exentnnbh.exedvjdd.exerrlrffx.exefxfflff.exe9hbbnt.exejvddd.exexxrlrxf.exe3rxxxxf.exe9bnnnn.exejdjpj.exe9xrlrxf.exehthnnn.exejdpjj.exejvdjj.exe9rlxrfx.exe7thbbt.exe1hhhth.exevpdvv.exellflxxf.exettnhnn.exeddvvj.exepjvvd.exefxxrrrl.exetnbtbt.exebtbbnn.exejjppp.exe9rllrxf.exe9lrxfll.exepid Process 2772 9hbbhh.exe 2904 pdppv.exe 2644 9pdvv.exe 2632 vpddv.exe 1312 thnttb.exe 2192 vpdjp.exe 988 bthntt.exe 912 pvddd.exe 1532 xfrfxfr.exe 2100 hthhtn.exe 3028 dvppv.exe 2608 3bbbbb.exe 2940 dpjjj.exe 1952 lflrrrf.exe 2296 3htnnh.exe 2440 djvvp.exe 1296 xlrlffl.exe 2492 thhhnh.exe 640 rlrrlff.exe 2468 nbhnhn.exe 1820 1rlfllr.exe 1800 htnntt.exe 448 vvjvv.exe 3032 ffllxfr.exe 1356 pjpjj.exe 1040 9rxfxff.exe 2364 vjvvv.exe 1684 3rxxffl.exe 1668 tntttt.exe 1772 7nhnnn.exe 2900 rlrlfxf.exe 2744 9ntnnt.exe 1808 xlxxfxf.exe 2684 hnhtnn.exe 2616 9pjpd.exe 2820 5lfrxxf.exe 536 ntnnbh.exe 780 dvjdd.exe 1088 rrlrffx.exe 1504 fxfflff.exe 2336 9hbbnt.exe 2136 jvddd.exe 2312 xxrlrxf.exe 3024 3rxxxxf.exe 2868 9bnnnn.exe 856 jdjpj.exe 2940 9xrlrxf.exe 2716 hthnnn.exe 1288 jdpjj.exe 2504 jvdjj.exe 1412 9rlxrfx.exe 2284 7thbbt.exe 2460 1hhhth.exe 2112 vpdvv.exe 2476 llflxxf.exe 2060 ttnhnn.exe 2500 ddvvj.exe 1144 pjvvd.exe 2588 fxxrrrl.exe 1492 tnbtbt.exe 3032 btbbnn.exe 692 jjppp.exe 588 9rllrxf.exe 2544 9lrxfll.exe -
Processes:
resource yara_rule behavioral1/memory/2892-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1312-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/988-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1532-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/912-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1296-160-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/1296-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/640-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1356-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1040-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1772-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1808-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/780-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/780-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1504-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-418-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-459-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2476-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1144-489-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/588-521-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-556-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/1504-631-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-638-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1972-647-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2936-676-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/1412-705-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
vjvpv.exennhttb.exevpjpv.exe9lrllfl.exejdppv.exe1rxrxxf.exefrlxxxr.exe5ddjj.exehbnnnt.exetnbtbt.exeffllrrf.exehbtbth.exennthth.exe3dppv.exelxfrfrl.exebthntn.exe9jvjj.exetthntt.exepjjpj.exentnnbh.exennhntb.exelfxxflr.exexffxlrf.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lrllfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rxrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlxxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ddjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffllrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnthth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfrfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffxlrf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
745fc305fb8a9429dcf042c5a9d409897df76187d3ac112446d1f6bee53ba87e.exe9hbbhh.exepdppv.exe9pdvv.exevpddv.exethnttb.exevpdjp.exebthntt.exepvddd.exexfrfxfr.exehthhtn.exedvppv.exe3bbbbb.exedpjjj.exelflrrrf.exe3htnnh.exedescription pid Process procid_target PID 2892 wrote to memory of 2772 2892 745fc305fb8a9429dcf042c5a9d409897df76187d3ac112446d1f6bee53ba87e.exe 30 PID 2892 wrote to memory of 2772 2892 745fc305fb8a9429dcf042c5a9d409897df76187d3ac112446d1f6bee53ba87e.exe 30 PID 2892 wrote to memory of 2772 2892 745fc305fb8a9429dcf042c5a9d409897df76187d3ac112446d1f6bee53ba87e.exe 30 PID 2892 wrote to memory of 2772 2892 745fc305fb8a9429dcf042c5a9d409897df76187d3ac112446d1f6bee53ba87e.exe 30 PID 2772 wrote to memory of 2904 2772 9hbbhh.exe 31 PID 2772 wrote to memory of 2904 2772 9hbbhh.exe 31 PID 2772 wrote to memory of 2904 2772 9hbbhh.exe 31 PID 2772 wrote to memory of 2904 2772 9hbbhh.exe 31 PID 2904 wrote to memory of 2644 2904 pdppv.exe 32 PID 2904 wrote to memory of 2644 2904 pdppv.exe 32 PID 2904 wrote to memory of 2644 2904 pdppv.exe 32 PID 2904 wrote to memory of 2644 2904 pdppv.exe 32 PID 2644 wrote to memory of 2632 2644 9pdvv.exe 33 PID 2644 wrote to memory of 2632 2644 9pdvv.exe 33 PID 2644 wrote to memory of 2632 2644 9pdvv.exe 33 PID 2644 wrote to memory of 2632 2644 9pdvv.exe 33 PID 2632 wrote to memory of 1312 2632 vpddv.exe 34 PID 2632 wrote to memory of 1312 2632 vpddv.exe 34 PID 2632 wrote to memory of 1312 2632 vpddv.exe 34 PID 2632 wrote to memory of 1312 2632 vpddv.exe 34 PID 1312 wrote to memory of 2192 1312 thnttb.exe 35 PID 1312 wrote to memory of 2192 1312 thnttb.exe 35 PID 1312 wrote to memory of 2192 1312 thnttb.exe 35 PID 1312 wrote to memory of 2192 1312 thnttb.exe 35 PID 2192 wrote to memory of 988 2192 vpdjp.exe 36 PID 2192 wrote to memory of 988 2192 vpdjp.exe 36 PID 2192 wrote to memory of 988 2192 vpdjp.exe 36 PID 2192 wrote to memory of 988 2192 vpdjp.exe 36 PID 988 wrote to memory of 912 988 bthntt.exe 37 PID 988 wrote to memory of 912 988 bthntt.exe 37 PID 988 wrote to memory of 912 988 bthntt.exe 37 PID 988 wrote to memory of 912 988 bthntt.exe 37 PID 912 wrote to memory of 1532 912 pvddd.exe 38 PID 912 wrote to memory of 1532 912 pvddd.exe 38 PID 912 wrote to memory of 1532 912 pvddd.exe 38 PID 912 wrote to memory of 1532 912 pvddd.exe 38 PID 1532 wrote to memory of 2100 1532 xfrfxfr.exe 39 PID 1532 wrote to memory of 2100 1532 xfrfxfr.exe 39 PID 1532 wrote to memory of 2100 1532 xfrfxfr.exe 39 PID 1532 wrote to memory of 2100 1532 xfrfxfr.exe 39 PID 2100 wrote to memory of 3028 2100 hthhtn.exe 40 PID 2100 wrote to memory of 3028 2100 hthhtn.exe 40 PID 2100 wrote to memory of 3028 2100 hthhtn.exe 40 PID 2100 wrote to memory of 3028 2100 hthhtn.exe 40 PID 3028 wrote to memory of 2608 3028 dvppv.exe 41 PID 3028 wrote to memory of 2608 3028 dvppv.exe 41 PID 3028 wrote to memory of 2608 3028 dvppv.exe 41 PID 3028 wrote to memory of 2608 3028 dvppv.exe 41 PID 2608 wrote to memory of 2940 2608 3bbbbb.exe 42 PID 2608 wrote to memory of 2940 2608 3bbbbb.exe 42 PID 2608 wrote to memory of 2940 2608 3bbbbb.exe 42 PID 2608 wrote to memory of 2940 2608 3bbbbb.exe 42 PID 2940 wrote to memory of 1952 2940 dpjjj.exe 43 PID 2940 wrote to memory of 1952 2940 dpjjj.exe 43 PID 2940 wrote to memory of 1952 2940 dpjjj.exe 43 PID 2940 wrote to memory of 1952 2940 dpjjj.exe 43 PID 1952 wrote to memory of 2296 1952 lflrrrf.exe 44 PID 1952 wrote to memory of 2296 1952 lflrrrf.exe 44 PID 1952 wrote to memory of 2296 1952 lflrrrf.exe 44 PID 1952 wrote to memory of 2296 1952 lflrrrf.exe 44 PID 2296 wrote to memory of 2440 2296 3htnnh.exe 45 PID 2296 wrote to memory of 2440 2296 3htnnh.exe 45 PID 2296 wrote to memory of 2440 2296 3htnnh.exe 45 PID 2296 wrote to memory of 2440 2296 3htnnh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\745fc305fb8a9429dcf042c5a9d409897df76187d3ac112446d1f6bee53ba87e.exe"C:\Users\Admin\AppData\Local\Temp\745fc305fb8a9429dcf042c5a9d409897df76187d3ac112446d1f6bee53ba87e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\9hbbhh.exec:\9hbbhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\pdppv.exec:\pdppv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\9pdvv.exec:\9pdvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\vpddv.exec:\vpddv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\thnttb.exec:\thnttb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\vpdjp.exec:\vpdjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\bthntt.exec:\bthntt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
\??\c:\pvddd.exec:\pvddd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
\??\c:\xfrfxfr.exec:\xfrfxfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\hthhtn.exec:\hthhtn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\dvppv.exec:\dvppv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\3bbbbb.exec:\3bbbbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\dpjjj.exec:\dpjjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\lflrrrf.exec:\lflrrrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\3htnnh.exec:\3htnnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\djvvp.exec:\djvvp.exe17⤵
- Executes dropped EXE
PID:2440 -
\??\c:\xlrlffl.exec:\xlrlffl.exe18⤵
- Executes dropped EXE
PID:1296 -
\??\c:\thhhnh.exec:\thhhnh.exe19⤵
- Executes dropped EXE
PID:2492 -
\??\c:\rlrrlff.exec:\rlrrlff.exe20⤵
- Executes dropped EXE
PID:640 -
\??\c:\nbhnhn.exec:\nbhnhn.exe21⤵
- Executes dropped EXE
PID:2468 -
\??\c:\1rlfllr.exec:\1rlfllr.exe22⤵
- Executes dropped EXE
PID:1820 -
\??\c:\htnntt.exec:\htnntt.exe23⤵
- Executes dropped EXE
PID:1800 -
\??\c:\vvjvv.exec:\vvjvv.exe24⤵
- Executes dropped EXE
PID:448 -
\??\c:\ffllxfr.exec:\ffllxfr.exe25⤵
- Executes dropped EXE
PID:3032 -
\??\c:\pjpjj.exec:\pjpjj.exe26⤵
- Executes dropped EXE
PID:1356 -
\??\c:\9rxfxff.exec:\9rxfxff.exe27⤵
- Executes dropped EXE
PID:1040 -
\??\c:\vjvvv.exec:\vjvvv.exe28⤵
- Executes dropped EXE
PID:2364 -
\??\c:\3rxxffl.exec:\3rxxffl.exe29⤵
- Executes dropped EXE
PID:1684 -
\??\c:\tntttt.exec:\tntttt.exe30⤵
- Executes dropped EXE
PID:1668 -
\??\c:\7nhnnn.exec:\7nhnnn.exe31⤵
- Executes dropped EXE
PID:1772 -
\??\c:\rlrlfxf.exec:\rlrlfxf.exe32⤵
- Executes dropped EXE
PID:2900 -
\??\c:\9ntnnt.exec:\9ntnnt.exe33⤵
- Executes dropped EXE
PID:2744 -
\??\c:\xlxxfxf.exec:\xlxxfxf.exe34⤵
- Executes dropped EXE
PID:1808 -
\??\c:\hnhtnn.exec:\hnhtnn.exe35⤵
- Executes dropped EXE
PID:2684 -
\??\c:\9pjpd.exec:\9pjpd.exe36⤵
- Executes dropped EXE
PID:2616 -
\??\c:\5lfrxxf.exec:\5lfrxxf.exe37⤵
- Executes dropped EXE
PID:2820 -
\??\c:\ntnnbh.exec:\ntnnbh.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:536 -
\??\c:\dvjdd.exec:\dvjdd.exe39⤵
- Executes dropped EXE
PID:780 -
\??\c:\rrlrffx.exec:\rrlrffx.exe40⤵
- Executes dropped EXE
PID:1088 -
\??\c:\fxfflff.exec:\fxfflff.exe41⤵
- Executes dropped EXE
PID:1504 -
\??\c:\9hbbnt.exec:\9hbbnt.exe42⤵
- Executes dropped EXE
PID:2336 -
\??\c:\jvddd.exec:\jvddd.exe43⤵
- Executes dropped EXE
PID:2136 -
\??\c:\xxrlrxf.exec:\xxrlrxf.exe44⤵
- Executes dropped EXE
PID:2312 -
\??\c:\3rxxxxf.exec:\3rxxxxf.exe45⤵
- Executes dropped EXE
PID:3024 -
\??\c:\9bnnnn.exec:\9bnnnn.exe46⤵
- Executes dropped EXE
PID:2868 -
\??\c:\jdjpj.exec:\jdjpj.exe47⤵
- Executes dropped EXE
PID:856 -
\??\c:\9xrlrxf.exec:\9xrlrxf.exe48⤵
- Executes dropped EXE
PID:2940 -
\??\c:\hthnnn.exec:\hthnnn.exe49⤵
- Executes dropped EXE
PID:2716 -
\??\c:\jdpjj.exec:\jdpjj.exe50⤵
- Executes dropped EXE
PID:1288 -
\??\c:\jvdjj.exec:\jvdjj.exe51⤵
- Executes dropped EXE
PID:2504 -
\??\c:\9rlxrfx.exec:\9rlxrfx.exe52⤵
- Executes dropped EXE
PID:1412 -
\??\c:\7thbbt.exec:\7thbbt.exe53⤵
- Executes dropped EXE
PID:2284 -
\??\c:\1hhhth.exec:\1hhhth.exe54⤵
- Executes dropped EXE
PID:2460 -
\??\c:\vpdvv.exec:\vpdvv.exe55⤵
- Executes dropped EXE
PID:2112 -
\??\c:\llflxxf.exec:\llflxxf.exe56⤵
- Executes dropped EXE
PID:2476 -
\??\c:\ttnhnn.exec:\ttnhnn.exe57⤵
- Executes dropped EXE
PID:2060 -
\??\c:\ddvvj.exec:\ddvvj.exe58⤵
- Executes dropped EXE
PID:2500 -
\??\c:\pjvvd.exec:\pjvvd.exe59⤵
- Executes dropped EXE
PID:1144 -
\??\c:\fxxrrrl.exec:\fxxrrrl.exe60⤵
- Executes dropped EXE
PID:2588 -
\??\c:\tnbtbt.exec:\tnbtbt.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1492 -
\??\c:\btbbnn.exec:\btbbnn.exe62⤵
- Executes dropped EXE
PID:3032 -
\??\c:\jjppp.exec:\jjppp.exe63⤵
- Executes dropped EXE
PID:692 -
\??\c:\9rllrxf.exec:\9rllrxf.exe64⤵
- Executes dropped EXE
PID:588 -
\??\c:\9lrxfll.exec:\9lrxfll.exe65⤵
- Executes dropped EXE
PID:2544 -
\??\c:\5htbhh.exec:\5htbhh.exe66⤵PID:1048
-
\??\c:\vdppv.exec:\vdppv.exe67⤵PID:1508
-
\??\c:\9frlxrx.exec:\9frlxrx.exe68⤵PID:1064
-
\??\c:\1rrrrrl.exec:\1rrrrrl.exe69⤵PID:2896
-
\??\c:\3tbttt.exec:\3tbttt.exe70⤵PID:1720
-
\??\c:\jvvvv.exec:\jvvvv.exe71⤵PID:2328
-
\??\c:\lfxxfxl.exec:\lfxxfxl.exe72⤵PID:2832
-
\??\c:\xxlrxxl.exec:\xxlrxxl.exe73⤵PID:2640
-
\??\c:\nnbnbt.exec:\nnbnbt.exe74⤵PID:2732
-
\??\c:\3vppp.exec:\3vppp.exe75⤵PID:1828
-
\??\c:\7jvvv.exec:\7jvvv.exe76⤵PID:2188
-
\??\c:\xrffxxf.exec:\xrffxxf.exe77⤵PID:2480
-
\??\c:\tnhhtn.exec:\tnhhtn.exe78⤵PID:536
-
\??\c:\9vjpv.exec:\9vjpv.exe79⤵PID:988
-
\??\c:\lxxlxfl.exec:\lxxlxfl.exe80⤵PID:2080
-
\??\c:\5fxxfff.exec:\5fxxfff.exe81⤵PID:1504
-
\??\c:\ntnthb.exec:\ntnthb.exe82⤵PID:1628
-
\??\c:\5pjjj.exec:\5pjjj.exe83⤵PID:1972
-
\??\c:\ddvpv.exec:\ddvpv.exe84⤵PID:2100
-
\??\c:\llfxfxf.exec:\llfxfxf.exe85⤵PID:2608
-
\??\c:\bntnnn.exec:\bntnnn.exe86⤵PID:2924
-
\??\c:\vpdvd.exec:\vpdvd.exe87⤵PID:2936
-
\??\c:\dvppv.exec:\dvppv.exe88⤵PID:2940
-
\??\c:\5fllfff.exec:\5fllfff.exe89⤵PID:1836
-
\??\c:\nttnth.exec:\nttnth.exe90⤵PID:1288
-
\??\c:\dppjd.exec:\dppjd.exe91⤵PID:2512
-
\??\c:\9pvvj.exec:\9pvvj.exe92⤵PID:1412
-
\??\c:\rlxrxxf.exec:\rlxrxxf.exe93⤵PID:2316
-
\??\c:\tnnbnt.exec:\tnnbnt.exe94⤵PID:2276
-
\??\c:\5jvvd.exec:\5jvvd.exe95⤵PID:2304
-
\??\c:\7jjvd.exec:\7jjvd.exe96⤵PID:2076
-
\??\c:\lllxflx.exec:\lllxflx.exe97⤵PID:2060
-
\??\c:\llllxff.exec:\llllxff.exe98⤵PID:2500
-
\??\c:\1hhnth.exec:\1hhnth.exe99⤵PID:1760
-
\??\c:\vjpjd.exec:\vjpjd.exe100⤵PID:3060
-
\??\c:\dvppd.exec:\dvppd.exe101⤵PID:968
-
\??\c:\9rfflrf.exec:\9rfflrf.exe102⤵PID:1108
-
\??\c:\nnnthn.exec:\nnnthn.exe103⤵PID:2096
-
\??\c:\nnbbth.exec:\nnbbth.exe104⤵PID:2520
-
\??\c:\ddddp.exec:\ddddp.exe105⤵PID:1040
-
\??\c:\llllrrf.exec:\llllrrf.exe106⤵PID:1332
-
\??\c:\hnntbb.exec:\hnntbb.exe107⤵PID:2228
-
\??\c:\nnhntb.exec:\nnhntb.exe108⤵
- System Location Discovery: System Language Discovery
PID:2628 -
\??\c:\vdddp.exec:\vdddp.exe109⤵PID:2828
-
\??\c:\rlxfllx.exec:\rlxfllx.exe110⤵PID:3000
-
\??\c:\5hbhbh.exec:\5hbhbh.exe111⤵PID:2792
-
\??\c:\pjpvd.exec:\pjpvd.exe112⤵PID:2808
-
\??\c:\vdddj.exec:\vdddj.exe113⤵PID:2692
-
\??\c:\5frllrx.exec:\5frllrx.exe114⤵PID:2816
-
\??\c:\xrrxlrf.exec:\xrrxlrf.exe115⤵PID:1556
-
\??\c:\hhbtbb.exec:\hhbtbb.exe116⤵PID:2196
-
\??\c:\dvpvp.exec:\dvpvp.exe117⤵PID:320
-
\??\c:\fffrxlx.exec:\fffrxlx.exe118⤵PID:1872
-
\??\c:\1thhhh.exec:\1thhhh.exe119⤵PID:1876
-
\??\c:\9vpdj.exec:\9vpdj.exe120⤵PID:2948
-
\??\c:\vpjpd.exec:\vpjpd.exe121⤵PID:2604
-
\??\c:\llflrxl.exec:\llflrxl.exe122⤵PID:3016
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-