Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22/11/2024, 02:41
Behavioral task
behavioral1
Sample
9f0c69760c2084a1f8bb92b2157e9100587d645debda1380110884c5dc03f765.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
9f0c69760c2084a1f8bb92b2157e9100587d645debda1380110884c5dc03f765.exe
-
Size
332KB
-
MD5
4f001bc4c63a08351734145733b510fe
-
SHA1
4e1c3d7f0dab71dc6f9125de4d7d0ac35668cd3f
-
SHA256
9f0c69760c2084a1f8bb92b2157e9100587d645debda1380110884c5dc03f765
-
SHA512
9d321b019eee1549c80bb21c31b902427be69f1ad0f913ce918c6d53ba3d347f3499fcff05dc869c0c1600a9410d05b70141b5bc68e6a215a5e10f3e0506e248
-
SSDEEP
6144:vcm4FmowdHoStJdJIjaRleL42bL37BoTPkhu9gX5yGsTshQc8R0nxA5ij8+RC7tj:94wFHoStJdSjylh2b77BoTMA9gX59sT7
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/1800-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2100-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3052-21-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2380-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2800-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2752-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2928-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2952-74-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2952-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2748-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2608-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2444-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2780-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1112-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2600-146-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2600-142-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/692-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2024-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2476-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2112-187-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2112-189-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2028-193-0x00000000003B0000-0x00000000003D7000-memory.dmp family_blackmoon behavioral1/memory/2028-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2476-205-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2592-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1780-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2248-251-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2248-248-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2460-259-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2328-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2356-296-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2544-302-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2148-313-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2632-372-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2836-409-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1356-473-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1360-481-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/544-529-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1044-530-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2824-699-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2468-710-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1264-955-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1620-966-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1632-1003-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2928-1133-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2500-8628-0x0000000076FC0000-0x00000000770DF000-memory.dmp family_blackmoon behavioral1/memory/2500-10145-0x0000000076FC0000-0x00000000770DF000-memory.dmp family_blackmoon behavioral1/memory/2500-17379-0x0000000076EC0000-0x0000000076FBA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2100 xxllxfx.exe 3052 3ntbbb.exe 2380 ddvvp.exe 2800 jjdpd.exe 2752 fxxlxfx.exe 2928 dvjvj.exe 2620 7ffffrf.exe 2952 3htbhb.exe 2748 jdpvj.exe 2608 5tnhhb.exe 2444 vpppd.exe 2780 9lllflf.exe 1304 jjjpd.exe 2680 5rrfrxf.exe 1112 nnnbbn.exe 2600 5xxxxfr.exe 300 tbnnbt.exe 692 pdjjv.exe 2024 lfxlxfr.exe 2476 hbbhbh.exe 2112 ffrxxff.exe 2028 btttbh.exe 1980 ddpvp.exe 1360 nntbth.exe 2592 vvpdv.exe 1340 3llrllf.exe 288 tbnhth.exe 1780 rxrfrfl.exe 2248 jjvdj.exe 2460 rlfrrxr.exe 684 rrrrlfn.exe 2492 djvjv.exe 756 1llflxr.exe 1516 nnbthn.exe 2328 1vpvp.exe 2356 ddvpp.exe 2544 9rlrrfx.exe 1376 5bhtbh.exe 2148 jdpvp.exe 2540 vvvdj.exe 2480 fxlxrfr.exe 2760 nnnbnn.exe 2876 bbthht.exe 2868 jvvdp.exe 2744 rlffrxl.exe 2924 fflxlrf.exe 2620 btnntb.exe 2660 3ppvd.exe 1644 vvjdv.exe 2632 rxrxrrx.exe 2688 hbnhnn.exe 2396 7jdpp.exe 524 lxlrllr.exe 1972 xrffllr.exe 2788 9hbnnt.exe 2812 hhbthn.exe 268 pjvdj.exe 2836 fxxflrx.exe 480 hbntht.exe 2828 tntbnb.exe 1620 vpvjv.exe 1828 dvpvd.exe 692 xrxflrx.exe 1960 hbtnbh.exe -
resource yara_rule behavioral1/memory/1800-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000012118-5.dat upx behavioral1/memory/2100-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1800-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000800000001613e-18.dat upx behavioral1/memory/2100-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016210-25.dat upx behavioral1/memory/2380-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000164db-34.dat upx behavioral1/memory/2800-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000001659b-44.dat upx behavioral1/memory/2928-53-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2752-52-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016645-51.dat upx behavioral1/memory/2928-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000900000001686c-62.dat upx behavioral1/memory/2952-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000016ac1-69.dat upx behavioral1/memory/2952-78-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016de8-79.dat upx behavioral1/files/0x0006000000016eb8-86.dat upx behavioral1/memory/2748-87-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016edb-96.dat upx behavioral1/memory/2608-94-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2444-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001707c-104.dat upx behavioral1/files/0x00060000000173f3-114.dat upx behavioral1/memory/2780-112-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017400-121.dat upx behavioral1/memory/2680-122-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017403-129.dat upx behavioral1/memory/1112-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001746a-137.dat upx behavioral1/memory/2600-146-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017488-147.dat upx behavioral1/files/0x0009000000015e64-155.dat upx behavioral1/memory/692-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000174a6-162.dat upx behavioral1/files/0x00060000000174c3-172.dat upx behavioral1/memory/2024-171-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2476-178-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001757f-180.dat upx behavioral1/memory/2476-179-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0015000000018676-188.dat upx behavioral1/memory/2112-189-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018696-198.dat upx behavioral1/memory/2028-197-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018697-206.dat upx behavioral1/files/0x00050000000187a2-214.dat upx behavioral1/files/0x0006000000018c34-221.dat upx behavioral1/memory/2592-220-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018c44-228.dat upx behavioral1/files/0x0006000000018f65-235.dat upx behavioral1/files/0x000600000001904c-243.dat upx behavioral1/memory/1780-242-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2248-251-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000190e1-252.dat upx behavioral1/files/0x00050000000191d2-260.dat upx behavioral1/memory/2460-259-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000191f6-267.dat upx behavioral1/memory/2328-289-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2356-290-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2356-296-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2544-302-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxfxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lrrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bhhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffrllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1800 wrote to memory of 2100 1800 9f0c69760c2084a1f8bb92b2157e9100587d645debda1380110884c5dc03f765.exe 30 PID 1800 wrote to memory of 2100 1800 9f0c69760c2084a1f8bb92b2157e9100587d645debda1380110884c5dc03f765.exe 30 PID 1800 wrote to memory of 2100 1800 9f0c69760c2084a1f8bb92b2157e9100587d645debda1380110884c5dc03f765.exe 30 PID 1800 wrote to memory of 2100 1800 9f0c69760c2084a1f8bb92b2157e9100587d645debda1380110884c5dc03f765.exe 30 PID 2100 wrote to memory of 3052 2100 xxllxfx.exe 31 PID 2100 wrote to memory of 3052 2100 xxllxfx.exe 31 PID 2100 wrote to memory of 3052 2100 xxllxfx.exe 31 PID 2100 wrote to memory of 3052 2100 xxllxfx.exe 31 PID 3052 wrote to memory of 2380 3052 3ntbbb.exe 32 PID 3052 wrote to memory of 2380 3052 3ntbbb.exe 32 PID 3052 wrote to memory of 2380 3052 3ntbbb.exe 32 PID 3052 wrote to memory of 2380 3052 3ntbbb.exe 32 PID 2380 wrote to memory of 2800 2380 ddvvp.exe 33 PID 2380 wrote to memory of 2800 2380 ddvvp.exe 33 PID 2380 wrote to memory of 2800 2380 ddvvp.exe 33 PID 2380 wrote to memory of 2800 2380 ddvvp.exe 33 PID 2800 wrote to memory of 2752 2800 jjdpd.exe 34 PID 2800 wrote to memory of 2752 2800 jjdpd.exe 34 PID 2800 wrote to memory of 2752 2800 jjdpd.exe 34 PID 2800 wrote to memory of 2752 2800 jjdpd.exe 34 PID 2752 wrote to memory of 2928 2752 fxxlxfx.exe 35 PID 2752 wrote to memory of 2928 2752 fxxlxfx.exe 35 PID 2752 wrote to memory of 2928 2752 fxxlxfx.exe 35 PID 2752 wrote to memory of 2928 2752 fxxlxfx.exe 35 PID 2928 wrote to memory of 2620 2928 dvjvj.exe 36 PID 2928 wrote to memory of 2620 2928 dvjvj.exe 36 PID 2928 wrote to memory of 2620 2928 dvjvj.exe 36 PID 2928 wrote to memory of 2620 2928 dvjvj.exe 36 PID 2620 wrote to memory of 2952 2620 7ffffrf.exe 37 PID 2620 wrote to memory of 2952 2620 7ffffrf.exe 37 PID 2620 wrote to memory of 2952 2620 7ffffrf.exe 37 PID 2620 wrote to memory of 2952 2620 7ffffrf.exe 37 PID 2952 wrote to memory of 2748 2952 3htbhb.exe 38 PID 2952 wrote to memory of 2748 2952 3htbhb.exe 38 PID 2952 wrote to memory of 2748 2952 3htbhb.exe 38 PID 2952 wrote to memory of 2748 2952 3htbhb.exe 38 PID 2748 wrote to memory of 2608 2748 jdpvj.exe 39 PID 2748 wrote to memory of 2608 2748 jdpvj.exe 39 PID 2748 wrote to memory of 2608 2748 jdpvj.exe 39 PID 2748 wrote to memory of 2608 2748 jdpvj.exe 39 PID 2608 wrote to memory of 2444 2608 5tnhhb.exe 40 PID 2608 wrote to memory of 2444 2608 5tnhhb.exe 40 PID 2608 wrote to memory of 2444 2608 5tnhhb.exe 40 PID 2608 wrote to memory of 2444 2608 5tnhhb.exe 40 PID 2444 wrote to memory of 2780 2444 vpppd.exe 41 PID 2444 wrote to memory of 2780 2444 vpppd.exe 41 PID 2444 wrote to memory of 2780 2444 vpppd.exe 41 PID 2444 wrote to memory of 2780 2444 vpppd.exe 41 PID 2780 wrote to memory of 1304 2780 9lllflf.exe 42 PID 2780 wrote to memory of 1304 2780 9lllflf.exe 42 PID 2780 wrote to memory of 1304 2780 9lllflf.exe 42 PID 2780 wrote to memory of 1304 2780 9lllflf.exe 42 PID 1304 wrote to memory of 2680 1304 jjjpd.exe 43 PID 1304 wrote to memory of 2680 1304 jjjpd.exe 43 PID 1304 wrote to memory of 2680 1304 jjjpd.exe 43 PID 1304 wrote to memory of 2680 1304 jjjpd.exe 43 PID 2680 wrote to memory of 1112 2680 5rrfrxf.exe 44 PID 2680 wrote to memory of 1112 2680 5rrfrxf.exe 44 PID 2680 wrote to memory of 1112 2680 5rrfrxf.exe 44 PID 2680 wrote to memory of 1112 2680 5rrfrxf.exe 44 PID 1112 wrote to memory of 2600 1112 nnnbbn.exe 45 PID 1112 wrote to memory of 2600 1112 nnnbbn.exe 45 PID 1112 wrote to memory of 2600 1112 nnnbbn.exe 45 PID 1112 wrote to memory of 2600 1112 nnnbbn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\9f0c69760c2084a1f8bb92b2157e9100587d645debda1380110884c5dc03f765.exe"C:\Users\Admin\AppData\Local\Temp\9f0c69760c2084a1f8bb92b2157e9100587d645debda1380110884c5dc03f765.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\xxllxfx.exec:\xxllxfx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\3ntbbb.exec:\3ntbbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\ddvvp.exec:\ddvvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\jjdpd.exec:\jjdpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\fxxlxfx.exec:\fxxlxfx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\dvjvj.exec:\dvjvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\7ffffrf.exec:\7ffffrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\3htbhb.exec:\3htbhb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\jdpvj.exec:\jdpvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\5tnhhb.exec:\5tnhhb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\vpppd.exec:\vpppd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\9lllflf.exec:\9lllflf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\jjjpd.exec:\jjjpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
\??\c:\5rrfrxf.exec:\5rrfrxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\nnnbbn.exec:\nnnbbn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
\??\c:\5xxxxfr.exec:\5xxxxfr.exe17⤵
- Executes dropped EXE
PID:2600 -
\??\c:\tbnnbt.exec:\tbnnbt.exe18⤵
- Executes dropped EXE
PID:300 -
\??\c:\pdjjv.exec:\pdjjv.exe19⤵
- Executes dropped EXE
PID:692 -
\??\c:\lfxlxfr.exec:\lfxlxfr.exe20⤵
- Executes dropped EXE
PID:2024 -
\??\c:\hbbhbh.exec:\hbbhbh.exe21⤵
- Executes dropped EXE
PID:2476 -
\??\c:\ffrxxff.exec:\ffrxxff.exe22⤵
- Executes dropped EXE
PID:2112 -
\??\c:\btttbh.exec:\btttbh.exe23⤵
- Executes dropped EXE
PID:2028 -
\??\c:\ddpvp.exec:\ddpvp.exe24⤵
- Executes dropped EXE
PID:1980 -
\??\c:\nntbth.exec:\nntbth.exe25⤵
- Executes dropped EXE
PID:1360 -
\??\c:\vvpdv.exec:\vvpdv.exe26⤵
- Executes dropped EXE
PID:2592 -
\??\c:\3llrllf.exec:\3llrllf.exe27⤵
- Executes dropped EXE
PID:1340 -
\??\c:\tbnhth.exec:\tbnhth.exe28⤵
- Executes dropped EXE
PID:288 -
\??\c:\rxrfrfl.exec:\rxrfrfl.exe29⤵
- Executes dropped EXE
PID:1780 -
\??\c:\jjvdj.exec:\jjvdj.exe30⤵
- Executes dropped EXE
PID:2248 -
\??\c:\rlfrrxr.exec:\rlfrrxr.exe31⤵
- Executes dropped EXE
PID:2460 -
\??\c:\rrrrlfn.exec:\rrrrlfn.exe32⤵
- Executes dropped EXE
PID:684 -
\??\c:\djvjv.exec:\djvjv.exe33⤵
- Executes dropped EXE
PID:2492 -
\??\c:\1llflxr.exec:\1llflxr.exe34⤵
- Executes dropped EXE
PID:756 -
\??\c:\nnbthn.exec:\nnbthn.exe35⤵
- Executes dropped EXE
PID:1516 -
\??\c:\1vpvp.exec:\1vpvp.exe36⤵
- Executes dropped EXE
PID:2328 -
\??\c:\ddvpp.exec:\ddvpp.exe37⤵
- Executes dropped EXE
PID:2356 -
\??\c:\9rlrrfx.exec:\9rlrrfx.exe38⤵
- Executes dropped EXE
PID:2544 -
\??\c:\5bhtbh.exec:\5bhtbh.exe39⤵
- Executes dropped EXE
PID:1376 -
\??\c:\jdpvp.exec:\jdpvp.exe40⤵
- Executes dropped EXE
PID:2148 -
\??\c:\vvvdj.exec:\vvvdj.exe41⤵
- Executes dropped EXE
PID:2540 -
\??\c:\fxlxrfr.exec:\fxlxrfr.exe42⤵
- Executes dropped EXE
PID:2480 -
\??\c:\nnnbnn.exec:\nnnbnn.exe43⤵
- Executes dropped EXE
PID:2760 -
\??\c:\bbthht.exec:\bbthht.exe44⤵
- Executes dropped EXE
PID:2876 -
\??\c:\jvvdp.exec:\jvvdp.exe45⤵
- Executes dropped EXE
PID:2868 -
\??\c:\rlffrxl.exec:\rlffrxl.exe46⤵
- Executes dropped EXE
PID:2744 -
\??\c:\fflxlrf.exec:\fflxlrf.exe47⤵
- Executes dropped EXE
PID:2924 -
\??\c:\btnntb.exec:\btnntb.exe48⤵
- Executes dropped EXE
PID:2620 -
\??\c:\3ppvd.exec:\3ppvd.exe49⤵
- Executes dropped EXE
PID:2660 -
\??\c:\vvjdv.exec:\vvjdv.exe50⤵
- Executes dropped EXE
PID:1644 -
\??\c:\rxrxrrx.exec:\rxrxrrx.exe51⤵
- Executes dropped EXE
PID:2632 -
\??\c:\hbnhnn.exec:\hbnhnn.exe52⤵
- Executes dropped EXE
PID:2688 -
\??\c:\7jdpp.exec:\7jdpp.exe53⤵
- Executes dropped EXE
PID:2396 -
\??\c:\lxlrllr.exec:\lxlrllr.exe54⤵
- Executes dropped EXE
PID:524 -
\??\c:\xrffllr.exec:\xrffllr.exe55⤵
- Executes dropped EXE
PID:1972 -
\??\c:\9hbnnt.exec:\9hbnnt.exe56⤵
- Executes dropped EXE
PID:2788 -
\??\c:\hhbthn.exec:\hhbthn.exe57⤵
- Executes dropped EXE
PID:2812 -
\??\c:\pjvdj.exec:\pjvdj.exe58⤵
- Executes dropped EXE
PID:268 -
\??\c:\fxxflrx.exec:\fxxflrx.exe59⤵
- Executes dropped EXE
PID:2836 -
\??\c:\hbntht.exec:\hbntht.exe60⤵
- Executes dropped EXE
PID:480 -
\??\c:\tntbnb.exec:\tntbnb.exe61⤵
- Executes dropped EXE
PID:2828 -
\??\c:\vpvjv.exec:\vpvjv.exe62⤵
- Executes dropped EXE
PID:1620 -
\??\c:\dvpvd.exec:\dvpvd.exe63⤵
- Executes dropped EXE
PID:1828 -
\??\c:\xrxflrx.exec:\xrxflrx.exe64⤵
- Executes dropped EXE
PID:692 -
\??\c:\hbtnbh.exec:\hbtnbh.exe65⤵
- Executes dropped EXE
PID:1960 -
\??\c:\nhttbh.exec:\nhttbh.exe66⤵PID:2976
-
\??\c:\vpvvd.exec:\vpvvd.exe67⤵PID:2368
-
\??\c:\rlxrxxx.exec:\rlxrxxx.exe68⤵PID:1428
-
\??\c:\xrrfrxl.exec:\xrrfrxl.exe69⤵PID:2168
-
\??\c:\nhtbbh.exec:\nhtbbh.exe70⤵PID:1356
-
\??\c:\pjdpd.exec:\pjdpd.exe71⤵PID:1980
-
\??\c:\jjpdj.exec:\jjpdj.exe72⤵PID:1360
-
\??\c:\1rlxfrx.exec:\1rlxfrx.exe73⤵PID:2832
-
\??\c:\nnnnnh.exec:\nnnnnh.exe74⤵PID:616
-
\??\c:\tntbnb.exec:\tntbnb.exe75⤵PID:1784
-
\??\c:\jvpvd.exec:\jvpvd.exe76⤵PID:1100
-
\??\c:\llfrflr.exec:\llfrflr.exe77⤵PID:2300
-
\??\c:\9xlffff.exec:\9xlffff.exe78⤵PID:2416
-
\??\c:\ntnhht.exec:\ntnhht.exe79⤵PID:2840
-
\??\c:\1pjvv.exec:\1pjvv.exe80⤵PID:544
-
\??\c:\jpdjv.exec:\jpdjv.exe81⤵PID:1044
-
\??\c:\lffllrx.exec:\lffllrx.exe82⤵PID:1228
-
\??\c:\hbnhth.exec:\hbnhth.exe83⤵PID:2588
-
\??\c:\5hbbhn.exec:\5hbbhn.exe84⤵PID:1916
-
\??\c:\vvjpv.exec:\vvjpv.exe85⤵PID:1432
-
\??\c:\rlxflrl.exec:\rlxflrl.exe86⤵PID:1608
-
\??\c:\5rlrffl.exec:\5rlrffl.exe87⤵PID:3064
-
\??\c:\nnbhnt.exec:\nnbhnt.exe88⤵PID:2064
-
\??\c:\djjpd.exec:\djjpd.exe89⤵PID:3060
-
\??\c:\vdjpd.exec:\vdjpd.exe90⤵PID:2148
-
\??\c:\llfrffr.exec:\llfrffr.exe91⤵PID:2540
-
\??\c:\bbthtb.exec:\bbthtb.exe92⤵PID:2480
-
\??\c:\7hbnbh.exec:\7hbnbh.exe93⤵PID:2760
-
\??\c:\dddpd.exec:\dddpd.exe94⤵PID:2876
-
\??\c:\9fxllrr.exec:\9fxllrr.exe95⤵PID:2928
-
\??\c:\ffxlxlf.exec:\ffxlxlf.exe96⤵PID:2744
-
\??\c:\hnntth.exec:\hnntth.exe97⤵PID:2636
-
\??\c:\bbntnt.exec:\bbntnt.exe98⤵PID:2156
-
\??\c:\ppvjv.exec:\ppvjv.exe99⤵PID:2628
-
\??\c:\xfflrxf.exec:\xfflrxf.exe100⤵PID:1644
-
\??\c:\9frlrxr.exec:\9frlrxr.exe101⤵PID:2252
-
\??\c:\bttnbb.exec:\bttnbb.exe102⤵PID:2136
-
\??\c:\1nbhnb.exec:\1nbhnb.exe103⤵PID:1596
-
\??\c:\vpjdj.exec:\vpjdj.exe104⤵PID:560
-
\??\c:\rlxfflx.exec:\rlxfflx.exe105⤵PID:1972
-
\??\c:\rlfxllr.exec:\rlfxllr.exe106⤵PID:2788
-
\??\c:\hbtntn.exec:\hbtntn.exe107⤵PID:2812
-
\??\c:\bthhtt.exec:\bthhtt.exe108⤵PID:2012
-
\??\c:\9ddvp.exec:\9ddvp.exe109⤵PID:2824
-
\??\c:\1llxlfl.exec:\1llxlfl.exe110⤵PID:480
-
\??\c:\7nnhhb.exec:\7nnhhb.exe111⤵PID:532
-
\??\c:\nbnnnn.exec:\nbnnnn.exe112⤵PID:2040
-
\??\c:\7pjpv.exec:\7pjpv.exe113⤵PID:3056
-
\??\c:\fxlxlxr.exec:\fxlxlxr.exe114⤵PID:2468
-
\??\c:\rrflrfx.exec:\rrflrfx.exe115⤵PID:2436
-
\??\c:\bnhhhh.exec:\bnhhhh.exe116⤵PID:2420
-
\??\c:\vdpvv.exec:\vdpvv.exe117⤵PID:2568
-
\??\c:\jdvdj.exec:\jdvdj.exe118⤵PID:2028
-
\??\c:\lrllxrl.exec:\lrllxrl.exe119⤵PID:2224
-
\??\c:\ttntnn.exec:\ttntnn.exe120⤵PID:904
-
\??\c:\hbnnhh.exec:\hbnnhh.exe121⤵PID:600
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-