Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 03:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b4c3f8518c27782ae53a3e03f1b613f76f48b0e09386b9cac57a1745233a71a5.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
b4c3f8518c27782ae53a3e03f1b613f76f48b0e09386b9cac57a1745233a71a5.exe
-
Size
456KB
-
MD5
dc96d6a7edaefc3e2a9326960717e0a5
-
SHA1
c4dc229899816846fea37cb43050c58986d68e56
-
SHA256
b4c3f8518c27782ae53a3e03f1b613f76f48b0e09386b9cac57a1745233a71a5
-
SHA512
f22ade96126e35d2a11caaaf380670d23b5c0e3b3eea74acf89d9dd245ce31e8c463bd095278c58599198a8a08cc5c2127a629c9992c56e6d2fb43da780371fa
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRwB:q7Tc2NYHUrAwfMp3CDRwB
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2696-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2264-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2064-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-89-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1396-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1412-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-155-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1952-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/896-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2508-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2472-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/844-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/844-237-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/380-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1688-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-293-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2588-289-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2704-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1740-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1528-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1576-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1148-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-418-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-455-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-566-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3068-594-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2272-1286-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2520-1351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2548 3rllrxl.exe 2064 hthntn.exe 2264 jjdvj.exe 2760 xxrflrl.exe 2808 djvjp.exe 3068 rrrflff.exe 2800 hnnhnb.exe 2784 jdjvj.exe 2624 jdvvp.exe 2348 5bbhtb.exe 2012 7vjpd.exe 1396 1tnttn.exe 2904 7vpdp.exe 1412 hnhnbn.exe 2908 vjjjv.exe 2964 7htttt.exe 896 ddjvj.exe 1952 7pjpd.exe 1728 hhhhbh.exe 2580 3vjvj.exe 2508 rllrlxr.exe 1284 9xrxfrf.exe 2596 pjjpp.exe 2176 xrllrrx.exe 2472 ttnbhn.exe 844 rrlrffr.exe 380 3nbhnt.exe 1688 xrxxrxl.exe 680 nnhtth.exe 1752 rfxrffx.exe 2000 bhthbb.exe 2588 ffxlxfr.exe 2060 btnhbb.exe 2704 pjddp.exe 2760 5frrxxl.exe 1740 hbbnnt.exe 2052 1jdpj.exe 2716 9rlrlrl.exe 1528 3tnhth.exe 2660 3dvpp.exe 2636 jdvpv.exe 2644 rrrxfrl.exe 2844 bbtnhn.exe 2612 vpjjd.exe 1576 1lllrrf.exe 2672 fxrxxxf.exe 1148 tbnbtn.exe 1956 pvpdp.exe 656 rlfrrfr.exe 1404 nnhnbn.exe 2912 vdpdd.exe 2680 xfrllfx.exe 3036 bthbbn.exe 1904 jdddp.exe 1936 rfxrxxr.exe 1348 rlxrxxf.exe 2344 hthbtn.exe 2564 9pjjd.exe 444 rlllfrl.exe 1888 tththn.exe 2272 jjvvj.exe 352 lrlrlxl.exe 112 xxrrxrl.exe 1216 bbbthn.exe -
resource yara_rule behavioral1/memory/2696-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-89-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/1396-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1412-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/896-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/844-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/844-237-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/380-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-293-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2704-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1576-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1148-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-418-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1216-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-580-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-594-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1200-802-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-904-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/1712-924-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-1010-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1948-1205-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1952-1244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-1286-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1688-1324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-1351-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlrffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrllrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxfxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lrfxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlxrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnntbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrfllrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1btnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbtbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2696 wrote to memory of 2548 2696 b4c3f8518c27782ae53a3e03f1b613f76f48b0e09386b9cac57a1745233a71a5.exe 30 PID 2696 wrote to memory of 2548 2696 b4c3f8518c27782ae53a3e03f1b613f76f48b0e09386b9cac57a1745233a71a5.exe 30 PID 2696 wrote to memory of 2548 2696 b4c3f8518c27782ae53a3e03f1b613f76f48b0e09386b9cac57a1745233a71a5.exe 30 PID 2696 wrote to memory of 2548 2696 b4c3f8518c27782ae53a3e03f1b613f76f48b0e09386b9cac57a1745233a71a5.exe 30 PID 2548 wrote to memory of 2064 2548 3rllrxl.exe 31 PID 2548 wrote to memory of 2064 2548 3rllrxl.exe 31 PID 2548 wrote to memory of 2064 2548 3rllrxl.exe 31 PID 2548 wrote to memory of 2064 2548 3rllrxl.exe 31 PID 2064 wrote to memory of 2264 2064 hthntn.exe 32 PID 2064 wrote to memory of 2264 2064 hthntn.exe 32 PID 2064 wrote to memory of 2264 2064 hthntn.exe 32 PID 2064 wrote to memory of 2264 2064 hthntn.exe 32 PID 2264 wrote to memory of 2760 2264 jjdvj.exe 33 PID 2264 wrote to memory of 2760 2264 jjdvj.exe 33 PID 2264 wrote to memory of 2760 2264 jjdvj.exe 33 PID 2264 wrote to memory of 2760 2264 jjdvj.exe 33 PID 2760 wrote to memory of 2808 2760 xxrflrl.exe 34 PID 2760 wrote to memory of 2808 2760 xxrflrl.exe 34 PID 2760 wrote to memory of 2808 2760 xxrflrl.exe 34 PID 2760 wrote to memory of 2808 2760 xxrflrl.exe 34 PID 2808 wrote to memory of 3068 2808 djvjp.exe 35 PID 2808 wrote to memory of 3068 2808 djvjp.exe 35 PID 2808 wrote to memory of 3068 2808 djvjp.exe 35 PID 2808 wrote to memory of 3068 2808 djvjp.exe 35 PID 3068 wrote to memory of 2800 3068 rrrflff.exe 36 PID 3068 wrote to memory of 2800 3068 rrrflff.exe 36 PID 3068 wrote to memory of 2800 3068 rrrflff.exe 36 PID 3068 wrote to memory of 2800 3068 rrrflff.exe 36 PID 2800 wrote to memory of 2784 2800 hnnhnb.exe 37 PID 2800 wrote to memory of 2784 2800 hnnhnb.exe 37 PID 2800 wrote to memory of 2784 2800 hnnhnb.exe 37 PID 2800 wrote to memory of 2784 2800 hnnhnb.exe 37 PID 2784 wrote to memory of 2624 2784 jdjvj.exe 38 PID 2784 wrote to memory of 2624 2784 jdjvj.exe 38 PID 2784 wrote to memory of 2624 2784 jdjvj.exe 38 PID 2784 wrote to memory of 2624 2784 jdjvj.exe 38 PID 2624 wrote to memory of 2348 2624 jdvvp.exe 39 PID 2624 wrote to memory of 2348 2624 jdvvp.exe 39 PID 2624 wrote to memory of 2348 2624 jdvvp.exe 39 PID 2624 wrote to memory of 2348 2624 jdvvp.exe 39 PID 2348 wrote to memory of 2012 2348 5bbhtb.exe 40 PID 2348 wrote to memory of 2012 2348 5bbhtb.exe 40 PID 2348 wrote to memory of 2012 2348 5bbhtb.exe 40 PID 2348 wrote to memory of 2012 2348 5bbhtb.exe 40 PID 2012 wrote to memory of 1396 2012 7vjpd.exe 41 PID 2012 wrote to memory of 1396 2012 7vjpd.exe 41 PID 2012 wrote to memory of 1396 2012 7vjpd.exe 41 PID 2012 wrote to memory of 1396 2012 7vjpd.exe 41 PID 1396 wrote to memory of 2904 1396 1tnttn.exe 42 PID 1396 wrote to memory of 2904 1396 1tnttn.exe 42 PID 1396 wrote to memory of 2904 1396 1tnttn.exe 42 PID 1396 wrote to memory of 2904 1396 1tnttn.exe 42 PID 2904 wrote to memory of 1412 2904 7vpdp.exe 43 PID 2904 wrote to memory of 1412 2904 7vpdp.exe 43 PID 2904 wrote to memory of 1412 2904 7vpdp.exe 43 PID 2904 wrote to memory of 1412 2904 7vpdp.exe 43 PID 1412 wrote to memory of 2908 1412 hnhnbn.exe 44 PID 1412 wrote to memory of 2908 1412 hnhnbn.exe 44 PID 1412 wrote to memory of 2908 1412 hnhnbn.exe 44 PID 1412 wrote to memory of 2908 1412 hnhnbn.exe 44 PID 2908 wrote to memory of 2964 2908 vjjjv.exe 45 PID 2908 wrote to memory of 2964 2908 vjjjv.exe 45 PID 2908 wrote to memory of 2964 2908 vjjjv.exe 45 PID 2908 wrote to memory of 2964 2908 vjjjv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\b4c3f8518c27782ae53a3e03f1b613f76f48b0e09386b9cac57a1745233a71a5.exe"C:\Users\Admin\AppData\Local\Temp\b4c3f8518c27782ae53a3e03f1b613f76f48b0e09386b9cac57a1745233a71a5.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\3rllrxl.exec:\3rllrxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\hthntn.exec:\hthntn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\jjdvj.exec:\jjdvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\xxrflrl.exec:\xxrflrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\djvjp.exec:\djvjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\rrrflff.exec:\rrrflff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\hnnhnb.exec:\hnnhnb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\jdjvj.exec:\jdjvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\jdvvp.exec:\jdvvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\5bbhtb.exec:\5bbhtb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\7vjpd.exec:\7vjpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\1tnttn.exec:\1tnttn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
\??\c:\7vpdp.exec:\7vpdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\hnhnbn.exec:\hnhnbn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
\??\c:\vjjjv.exec:\vjjjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\7htttt.exec:\7htttt.exe17⤵
- Executes dropped EXE
PID:2964 -
\??\c:\ddjvj.exec:\ddjvj.exe18⤵
- Executes dropped EXE
PID:896 -
\??\c:\7pjpd.exec:\7pjpd.exe19⤵
- Executes dropped EXE
PID:1952 -
\??\c:\hhhhbh.exec:\hhhhbh.exe20⤵
- Executes dropped EXE
PID:1728 -
\??\c:\3vjvj.exec:\3vjvj.exe21⤵
- Executes dropped EXE
PID:2580 -
\??\c:\rllrlxr.exec:\rllrlxr.exe22⤵
- Executes dropped EXE
PID:2508 -
\??\c:\9xrxfrf.exec:\9xrxfrf.exe23⤵
- Executes dropped EXE
PID:1284 -
\??\c:\pjjpp.exec:\pjjpp.exe24⤵
- Executes dropped EXE
PID:2596 -
\??\c:\xrllrrx.exec:\xrllrrx.exe25⤵
- Executes dropped EXE
PID:2176 -
\??\c:\ttnbhn.exec:\ttnbhn.exe26⤵
- Executes dropped EXE
PID:2472 -
\??\c:\rrlrffr.exec:\rrlrffr.exe27⤵
- Executes dropped EXE
PID:844 -
\??\c:\3nbhnt.exec:\3nbhnt.exe28⤵
- Executes dropped EXE
PID:380 -
\??\c:\xrxxrxl.exec:\xrxxrxl.exe29⤵
- Executes dropped EXE
PID:1688 -
\??\c:\nnhtth.exec:\nnhtth.exe30⤵
- Executes dropped EXE
PID:680 -
\??\c:\rfxrffx.exec:\rfxrffx.exe31⤵
- Executes dropped EXE
PID:1752 -
\??\c:\bhthbb.exec:\bhthbb.exe32⤵
- Executes dropped EXE
PID:2000 -
\??\c:\ffxlxfr.exec:\ffxlxfr.exe33⤵
- Executes dropped EXE
PID:2588 -
\??\c:\btnhbb.exec:\btnhbb.exe34⤵
- Executes dropped EXE
PID:2060 -
\??\c:\pjddp.exec:\pjddp.exe35⤵
- Executes dropped EXE
PID:2704 -
\??\c:\5frrxxl.exec:\5frrxxl.exe36⤵
- Executes dropped EXE
PID:2760 -
\??\c:\hbbnnt.exec:\hbbnnt.exe37⤵
- Executes dropped EXE
PID:1740 -
\??\c:\1jdpj.exec:\1jdpj.exe38⤵
- Executes dropped EXE
PID:2052 -
\??\c:\9rlrlrl.exec:\9rlrlrl.exe39⤵
- Executes dropped EXE
PID:2716 -
\??\c:\3tnhth.exec:\3tnhth.exe40⤵
- Executes dropped EXE
PID:1528 -
\??\c:\3dvpp.exec:\3dvpp.exe41⤵
- Executes dropped EXE
PID:2660 -
\??\c:\jdvpv.exec:\jdvpv.exe42⤵
- Executes dropped EXE
PID:2636 -
\??\c:\rrrxfrl.exec:\rrrxfrl.exe43⤵
- Executes dropped EXE
PID:2644 -
\??\c:\bbtnhn.exec:\bbtnhn.exe44⤵
- Executes dropped EXE
PID:2844 -
\??\c:\vpjjd.exec:\vpjjd.exe45⤵
- Executes dropped EXE
PID:2612 -
\??\c:\1lllrrf.exec:\1lllrrf.exe46⤵
- Executes dropped EXE
PID:1576 -
\??\c:\fxrxxxf.exec:\fxrxxxf.exe47⤵
- Executes dropped EXE
PID:2672 -
\??\c:\tbnbtn.exec:\tbnbtn.exe48⤵
- Executes dropped EXE
PID:1148 -
\??\c:\pvpdp.exec:\pvpdp.exe49⤵
- Executes dropped EXE
PID:1956 -
\??\c:\rlfrrfr.exec:\rlfrrfr.exe50⤵
- Executes dropped EXE
PID:656 -
\??\c:\nnhnbn.exec:\nnhnbn.exe51⤵
- Executes dropped EXE
PID:1404 -
\??\c:\vdpdd.exec:\vdpdd.exe52⤵
- Executes dropped EXE
PID:2912 -
\??\c:\xfrllfx.exec:\xfrllfx.exe53⤵
- Executes dropped EXE
PID:2680 -
\??\c:\bthbbn.exec:\bthbbn.exe54⤵
- Executes dropped EXE
PID:3036 -
\??\c:\jdddp.exec:\jdddp.exe55⤵
- Executes dropped EXE
PID:1904 -
\??\c:\rfxrxxr.exec:\rfxrxxr.exe56⤵
- Executes dropped EXE
PID:1936 -
\??\c:\rlxrxxf.exec:\rlxrxxf.exe57⤵
- Executes dropped EXE
PID:1348 -
\??\c:\hthbtn.exec:\hthbtn.exe58⤵
- Executes dropped EXE
PID:2344 -
\??\c:\9pjjd.exec:\9pjjd.exe59⤵
- Executes dropped EXE
PID:2564 -
\??\c:\rlllfrl.exec:\rlllfrl.exe60⤵
- Executes dropped EXE
PID:444 -
\??\c:\tththn.exec:\tththn.exe61⤵
- Executes dropped EXE
PID:1888 -
\??\c:\jjvvj.exec:\jjvvj.exe62⤵
- Executes dropped EXE
PID:2272 -
\??\c:\lrlrlxl.exec:\lrlrlxl.exe63⤵
- Executes dropped EXE
PID:352 -
\??\c:\xxrrxrl.exec:\xxrrxrl.exe64⤵
- Executes dropped EXE
PID:112 -
\??\c:\bbbthn.exec:\bbbthn.exe65⤵
- Executes dropped EXE
PID:1216 -
\??\c:\dvddj.exec:\dvddj.exe66⤵PID:1480
-
\??\c:\rxxlxfx.exec:\rxxlxfx.exe67⤵PID:2472
-
\??\c:\tnbbnt.exec:\tnbbnt.exe68⤵PID:1924
-
\??\c:\jddjp.exec:\jddjp.exe69⤵PID:2584
-
\??\c:\3lxrffl.exec:\3lxrffl.exe70⤵PID:380
-
\??\c:\xfxlxxr.exec:\xfxlxxr.exe71⤵PID:1200
-
\??\c:\btnthh.exec:\btnthh.exe72⤵PID:1836
-
\??\c:\ddvvv.exec:\ddvvv.exe73⤵PID:1672
-
\??\c:\lrfrflr.exec:\lrfrflr.exe74⤵PID:1660
-
\??\c:\1bnntt.exec:\1bnntt.exe75⤵PID:1640
-
\??\c:\ppjjd.exec:\ppjjd.exe76⤵PID:2588
-
\??\c:\ffxlxfx.exec:\ffxlxfx.exe77⤵PID:2068
-
\??\c:\ntnbtb.exec:\ntnbtb.exe78⤵PID:2284
-
\??\c:\nnbntb.exec:\nnbntb.exe79⤵PID:2460
-
\??\c:\jjpjj.exec:\jjpjj.exe80⤵PID:3068
-
\??\c:\1fllflr.exec:\1fllflr.exe81⤵PID:1628
-
\??\c:\hnhnbn.exec:\hnhnbn.exe82⤵PID:2888
-
\??\c:\ddjpd.exec:\ddjpd.exe83⤵PID:2088
-
\??\c:\xxfrflf.exec:\xxfrflf.exe84⤵PID:2860
-
\??\c:\hbhnnh.exec:\hbhnnh.exe85⤵PID:2756
-
\??\c:\bbbhnt.exec:\bbbhnt.exe86⤵PID:2280
-
\??\c:\dpjvp.exec:\dpjvp.exe87⤵PID:2732
-
\??\c:\tnhbhn.exec:\tnhbhn.exe88⤵PID:2628
-
\??\c:\nbhbtb.exec:\nbhbtb.exe89⤵PID:1960
-
\??\c:\pvdvp.exec:\pvdvp.exe90⤵PID:632
-
\??\c:\lxrxfxx.exec:\lxrxfxx.exe91⤵PID:2012
-
\??\c:\hnnhth.exec:\hnnhth.exe92⤵PID:2980
-
\??\c:\jjjpj.exec:\jjjpj.exe93⤵PID:3040
-
\??\c:\9lfffrf.exec:\9lfffrf.exe94⤵PID:948
-
\??\c:\ttnbhn.exec:\ttnbhn.exe95⤵PID:2916
-
\??\c:\bbtbnh.exec:\bbtbnh.exe96⤵PID:2912
-
\??\c:\7vdvd.exec:\7vdvd.exe97⤵PID:2680
-
\??\c:\ffllflx.exec:\ffllflx.exe98⤵PID:3044
-
\??\c:\3bhnnt.exec:\3bhnnt.exe99⤵PID:1904
-
\??\c:\3dvdj.exec:\3dvdj.exe100⤵PID:2868
-
\??\c:\nhbhtb.exec:\nhbhtb.exe101⤵PID:2148
-
\??\c:\pvvjp.exec:\pvvjp.exe102⤵PID:2344
-
\??\c:\jpvjp.exec:\jpvjp.exe103⤵PID:2944
-
\??\c:\1llrflf.exec:\1llrflf.exe104⤵PID:444
-
\??\c:\9thnht.exec:\9thnht.exe105⤵PID:280
-
\??\c:\jjjpv.exec:\jjjpv.exe106⤵PID:2272
-
\??\c:\jdvdp.exec:\jdvdp.exe107⤵PID:1692
-
\??\c:\lrxflxf.exec:\lrxflxf.exe108⤵PID:112
-
\??\c:\tnhnbt.exec:\tnhnbt.exe109⤵PID:1216
-
\??\c:\7vvdv.exec:\7vvdv.exe110⤵PID:1592
-
\??\c:\lrrfxfx.exec:\lrrfxfx.exe111⤵PID:2472
-
\??\c:\ffxrlxl.exec:\ffxrlxl.exe112⤵PID:844
-
\??\c:\nbthnt.exec:\nbthnt.exe113⤵PID:2584
-
\??\c:\3vjpv.exec:\3vjpv.exe114⤵PID:2212
-
\??\c:\ffflffx.exec:\ffflffx.exe115⤵PID:1200
-
\??\c:\9tntth.exec:\9tntth.exe116⤵PID:1836
-
\??\c:\3dvjv.exec:\3dvjv.exe117⤵PID:1656
-
\??\c:\pvpdd.exec:\pvpdd.exe118⤵PID:1660
-
\??\c:\xrrlxrl.exec:\xrrlxrl.exe119⤵PID:1640
-
\??\c:\ttbnbb.exec:\ttbnbb.exe120⤵PID:1864
-
\??\c:\vvpdp.exec:\vvpdp.exe121⤵PID:3060
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-