Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 04:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d02a6dcf9a4d90d952e4934235512ae890ef82f69b985f943087b2b115ed1ac0.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
d02a6dcf9a4d90d952e4934235512ae890ef82f69b985f943087b2b115ed1ac0.exe
-
Size
453KB
-
MD5
db07ed8d02f858f5f721d1ea0774a028
-
SHA1
79c6c903a1734561eb6a23870fe9654d7a1c6651
-
SHA256
d02a6dcf9a4d90d952e4934235512ae890ef82f69b985f943087b2b115ed1ac0
-
SHA512
4f1ec169d9db50e5db9d948b4cc6b427e8c929e4eed13b2ca7d1940d73d72087c11f43a72f44804136a82a0819dbd2471db921335c722728d27b8b73e6101309
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeK:q7Tc2NYHUrAwfMp3CDK
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 51 IoCs
resource yara_rule behavioral1/memory/2452-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1960-19-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1960-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1800-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1436-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2516-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1936-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/780-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/540-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1636-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1748-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-322-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2740-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-381-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2580-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-389-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2972-466-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1864-485-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1304-498-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-579-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2460-593-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2460-592-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2548-657-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1680-682-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2044-756-0x0000000001C70000-0x0000000001C9A000-memory.dmp family_blackmoon behavioral1/memory/1536-777-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/952-789-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/952-791-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2012-852-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1944-928-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1868-964-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1340-1058-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2116-1078-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2008-1129-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2672-1149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-1153-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2688-1182-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2872-1295-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1960 9ppdv.exe 2456 htthbh.exe 3008 lfxfxfx.exe 2676 bhbnbh.exe 2824 ddvjv.exe 2220 9hhnhb.exe 2876 vdppp.exe 2576 lflrrff.exe 2544 rllxfxx.exe 3000 1nnthb.exe 1616 5lrfxll.exe 1800 vvvjd.exe 1436 ntthbn.exe 1660 dvvpj.exe 1700 rfxrxlf.exe 2516 7vpvj.exe 2792 rxrfrfx.exe 2788 tbtbbt.exe 2568 3pddd.exe 2928 fflrrxl.exe 1936 5vjdd.exe 780 ddvvd.exe 1624 xffrflf.exe 580 hbtbnn.exe 2720 vdpjp.exe 1788 bbbnhn.exe 2884 nnhtnt.exe 540 flrxflf.exe 2952 hhhhnn.exe 1636 rrlrffr.exe 1748 bhnhhn.exe 2396 rlfxlrr.exe 1052 xlrllfl.exe 1704 7jppp.exe 2904 7lffrxx.exe 2456 tthhtt.exe 2240 9hnttt.exe 2740 vvvdj.exe 2684 lrlxffl.exe 2828 lfrxfrf.exe 2836 ththnn.exe 2724 pppjj.exe 2876 9jdpp.exe 2540 lrxlrfl.exe 2700 tthbnt.exe 2580 hbnbhn.exe 1656 ddpdj.exe 908 1rffflr.exe 2260 bbthtb.exe 1972 vpddd.exe 2360 pvdjp.exe 1724 fxlrxfr.exe 2268 1hbhhn.exe 708 nnnhth.exe 1768 pjdjd.exe 760 7xllrxl.exe 2764 rrrfxfl.exe 2972 bbhthn.exe 2772 1vvdj.exe 676 xllrrfr.exe 840 ntntnn.exe 1864 nbtthn.exe 1304 7dpjd.exe 1624 rlfflrf.exe -
resource yara_rule behavioral1/memory/2452-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1436-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/780-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/540-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-381-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/2580-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1972-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-466-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1864-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1304-498-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-547-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-593-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-682-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-749-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-756-0x0000000001C70000-0x0000000001C9A000-memory.dmp upx behavioral1/memory/1536-777-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/952-791-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-860-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-903-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1360-1027-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-1078-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1948-1115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-1122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-1130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-1149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-1153-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2688-1157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1912-1243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-1268-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffflxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhtbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxlflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bbnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhntnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbtbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffllrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rlllrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ttnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlfrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ppdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbthtb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2452 wrote to memory of 1960 2452 d02a6dcf9a4d90d952e4934235512ae890ef82f69b985f943087b2b115ed1ac0.exe 31 PID 2452 wrote to memory of 1960 2452 d02a6dcf9a4d90d952e4934235512ae890ef82f69b985f943087b2b115ed1ac0.exe 31 PID 2452 wrote to memory of 1960 2452 d02a6dcf9a4d90d952e4934235512ae890ef82f69b985f943087b2b115ed1ac0.exe 31 PID 2452 wrote to memory of 1960 2452 d02a6dcf9a4d90d952e4934235512ae890ef82f69b985f943087b2b115ed1ac0.exe 31 PID 1960 wrote to memory of 2456 1960 9ppdv.exe 32 PID 1960 wrote to memory of 2456 1960 9ppdv.exe 32 PID 1960 wrote to memory of 2456 1960 9ppdv.exe 32 PID 1960 wrote to memory of 2456 1960 9ppdv.exe 32 PID 2456 wrote to memory of 3008 2456 htthbh.exe 33 PID 2456 wrote to memory of 3008 2456 htthbh.exe 33 PID 2456 wrote to memory of 3008 2456 htthbh.exe 33 PID 2456 wrote to memory of 3008 2456 htthbh.exe 33 PID 3008 wrote to memory of 2676 3008 lfxfxfx.exe 34 PID 3008 wrote to memory of 2676 3008 lfxfxfx.exe 34 PID 3008 wrote to memory of 2676 3008 lfxfxfx.exe 34 PID 3008 wrote to memory of 2676 3008 lfxfxfx.exe 34 PID 2676 wrote to memory of 2824 2676 bhbnbh.exe 35 PID 2676 wrote to memory of 2824 2676 bhbnbh.exe 35 PID 2676 wrote to memory of 2824 2676 bhbnbh.exe 35 PID 2676 wrote to memory of 2824 2676 bhbnbh.exe 35 PID 2824 wrote to memory of 2220 2824 ddvjv.exe 36 PID 2824 wrote to memory of 2220 2824 ddvjv.exe 36 PID 2824 wrote to memory of 2220 2824 ddvjv.exe 36 PID 2824 wrote to memory of 2220 2824 ddvjv.exe 36 PID 2220 wrote to memory of 2876 2220 9hhnhb.exe 37 PID 2220 wrote to memory of 2876 2220 9hhnhb.exe 37 PID 2220 wrote to memory of 2876 2220 9hhnhb.exe 37 PID 2220 wrote to memory of 2876 2220 9hhnhb.exe 37 PID 2876 wrote to memory of 2576 2876 vdppp.exe 38 PID 2876 wrote to memory of 2576 2876 vdppp.exe 38 PID 2876 wrote to memory of 2576 2876 vdppp.exe 38 PID 2876 wrote to memory of 2576 2876 vdppp.exe 38 PID 2576 wrote to memory of 2544 2576 lflrrff.exe 39 PID 2576 wrote to memory of 2544 2576 lflrrff.exe 39 PID 2576 wrote to memory of 2544 2576 lflrrff.exe 39 PID 2576 wrote to memory of 2544 2576 lflrrff.exe 39 PID 2544 wrote to memory of 3000 2544 rllxfxx.exe 40 PID 2544 wrote to memory of 3000 2544 rllxfxx.exe 40 PID 2544 wrote to memory of 3000 2544 rllxfxx.exe 40 PID 2544 wrote to memory of 3000 2544 rllxfxx.exe 40 PID 3000 wrote to memory of 1616 3000 1nnthb.exe 41 PID 3000 wrote to memory of 1616 3000 1nnthb.exe 41 PID 3000 wrote to memory of 1616 3000 1nnthb.exe 41 PID 3000 wrote to memory of 1616 3000 1nnthb.exe 41 PID 1616 wrote to memory of 1800 1616 5lrfxll.exe 42 PID 1616 wrote to memory of 1800 1616 5lrfxll.exe 42 PID 1616 wrote to memory of 1800 1616 5lrfxll.exe 42 PID 1616 wrote to memory of 1800 1616 5lrfxll.exe 42 PID 1800 wrote to memory of 1436 1800 vvvjd.exe 43 PID 1800 wrote to memory of 1436 1800 vvvjd.exe 43 PID 1800 wrote to memory of 1436 1800 vvvjd.exe 43 PID 1800 wrote to memory of 1436 1800 vvvjd.exe 43 PID 1436 wrote to memory of 1660 1436 ntthbn.exe 44 PID 1436 wrote to memory of 1660 1436 ntthbn.exe 44 PID 1436 wrote to memory of 1660 1436 ntthbn.exe 44 PID 1436 wrote to memory of 1660 1436 ntthbn.exe 44 PID 1660 wrote to memory of 1700 1660 dvvpj.exe 45 PID 1660 wrote to memory of 1700 1660 dvvpj.exe 45 PID 1660 wrote to memory of 1700 1660 dvvpj.exe 45 PID 1660 wrote to memory of 1700 1660 dvvpj.exe 45 PID 1700 wrote to memory of 2516 1700 rfxrxlf.exe 46 PID 1700 wrote to memory of 2516 1700 rfxrxlf.exe 46 PID 1700 wrote to memory of 2516 1700 rfxrxlf.exe 46 PID 1700 wrote to memory of 2516 1700 rfxrxlf.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\d02a6dcf9a4d90d952e4934235512ae890ef82f69b985f943087b2b115ed1ac0.exe"C:\Users\Admin\AppData\Local\Temp\d02a6dcf9a4d90d952e4934235512ae890ef82f69b985f943087b2b115ed1ac0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\9ppdv.exec:\9ppdv.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\htthbh.exec:\htthbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\lfxfxfx.exec:\lfxfxfx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\bhbnbh.exec:\bhbnbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\ddvjv.exec:\ddvjv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\9hhnhb.exec:\9hhnhb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\vdppp.exec:\vdppp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\lflrrff.exec:\lflrrff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\rllxfxx.exec:\rllxfxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\1nnthb.exec:\1nnthb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\5lrfxll.exec:\5lrfxll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\vvvjd.exec:\vvvjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\ntthbn.exec:\ntthbn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
\??\c:\dvvpj.exec:\dvvpj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\rfxrxlf.exec:\rfxrxlf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\7vpvj.exec:\7vpvj.exe17⤵
- Executes dropped EXE
PID:2516 -
\??\c:\rxrfrfx.exec:\rxrfrfx.exe18⤵
- Executes dropped EXE
PID:2792 -
\??\c:\tbtbbt.exec:\tbtbbt.exe19⤵
- Executes dropped EXE
PID:2788 -
\??\c:\3pddd.exec:\3pddd.exe20⤵
- Executes dropped EXE
PID:2568 -
\??\c:\fflrrxl.exec:\fflrrxl.exe21⤵
- Executes dropped EXE
PID:2928 -
\??\c:\5vjdd.exec:\5vjdd.exe22⤵
- Executes dropped EXE
PID:1936 -
\??\c:\ddvvd.exec:\ddvvd.exe23⤵
- Executes dropped EXE
PID:780 -
\??\c:\xffrflf.exec:\xffrflf.exe24⤵
- Executes dropped EXE
PID:1624 -
\??\c:\hbtbnn.exec:\hbtbnn.exe25⤵
- Executes dropped EXE
PID:580 -
\??\c:\vdpjp.exec:\vdpjp.exe26⤵
- Executes dropped EXE
PID:2720 -
\??\c:\bbbnhn.exec:\bbbnhn.exe27⤵
- Executes dropped EXE
PID:1788 -
\??\c:\nnhtnt.exec:\nnhtnt.exe28⤵
- Executes dropped EXE
PID:2884 -
\??\c:\flrxflf.exec:\flrxflf.exe29⤵
- Executes dropped EXE
PID:540 -
\??\c:\hhhhnn.exec:\hhhhnn.exe30⤵
- Executes dropped EXE
PID:2952 -
\??\c:\rrlrffr.exec:\rrlrffr.exe31⤵
- Executes dropped EXE
PID:1636 -
\??\c:\bhnhhn.exec:\bhnhhn.exe32⤵
- Executes dropped EXE
PID:1748 -
\??\c:\rlfxlrr.exec:\rlfxlrr.exe33⤵
- Executes dropped EXE
PID:2396 -
\??\c:\xlrllfl.exec:\xlrllfl.exe34⤵
- Executes dropped EXE
PID:1052 -
\??\c:\7jppp.exec:\7jppp.exe35⤵
- Executes dropped EXE
PID:1704 -
\??\c:\7lffrxx.exec:\7lffrxx.exe36⤵
- Executes dropped EXE
PID:2904 -
\??\c:\tthhtt.exec:\tthhtt.exe37⤵
- Executes dropped EXE
PID:2456 -
\??\c:\9hnttt.exec:\9hnttt.exe38⤵
- Executes dropped EXE
PID:2240 -
\??\c:\vvvdj.exec:\vvvdj.exe39⤵
- Executes dropped EXE
PID:2740 -
\??\c:\lrlxffl.exec:\lrlxffl.exe40⤵
- Executes dropped EXE
PID:2684 -
\??\c:\lfrxfrf.exec:\lfrxfrf.exe41⤵
- Executes dropped EXE
PID:2828 -
\??\c:\ththnn.exec:\ththnn.exe42⤵
- Executes dropped EXE
PID:2836 -
\??\c:\pppjj.exec:\pppjj.exe43⤵
- Executes dropped EXE
PID:2724 -
\??\c:\9jdpp.exec:\9jdpp.exe44⤵
- Executes dropped EXE
PID:2876 -
\??\c:\lrxlrfl.exec:\lrxlrfl.exe45⤵
- Executes dropped EXE
PID:2540 -
\??\c:\tthbnt.exec:\tthbnt.exe46⤵
- Executes dropped EXE
PID:2700 -
\??\c:\hbnbhn.exec:\hbnbhn.exe47⤵
- Executes dropped EXE
PID:2580 -
\??\c:\ddpdj.exec:\ddpdj.exe48⤵
- Executes dropped EXE
PID:1656 -
\??\c:\1rffflr.exec:\1rffflr.exe49⤵
- Executes dropped EXE
PID:908 -
\??\c:\bbthtb.exec:\bbthtb.exe50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2260 -
\??\c:\vpddd.exec:\vpddd.exe51⤵
- Executes dropped EXE
PID:1972 -
\??\c:\pvdjp.exec:\pvdjp.exe52⤵
- Executes dropped EXE
PID:2360 -
\??\c:\fxlrxfr.exec:\fxlrxfr.exe53⤵
- Executes dropped EXE
PID:1724 -
\??\c:\1hbhhn.exec:\1hbhhn.exe54⤵
- Executes dropped EXE
PID:2268 -
\??\c:\nnnhth.exec:\nnnhth.exe55⤵
- Executes dropped EXE
PID:708 -
\??\c:\pjdjd.exec:\pjdjd.exe56⤵
- Executes dropped EXE
PID:1768 -
\??\c:\7xllrxl.exec:\7xllrxl.exe57⤵
- Executes dropped EXE
PID:760 -
\??\c:\rrrfxfl.exec:\rrrfxfl.exe58⤵
- Executes dropped EXE
PID:2764 -
\??\c:\bbhthn.exec:\bbhthn.exe59⤵
- Executes dropped EXE
PID:2972 -
\??\c:\1vvdj.exec:\1vvdj.exe60⤵
- Executes dropped EXE
PID:2772 -
\??\c:\xllrrfr.exec:\xllrrfr.exe61⤵
- Executes dropped EXE
PID:676 -
\??\c:\ntntnn.exec:\ntntnn.exe62⤵
- Executes dropped EXE
PID:840 -
\??\c:\nbtthn.exec:\nbtthn.exe63⤵
- Executes dropped EXE
PID:1864 -
\??\c:\7dpjd.exec:\7dpjd.exe64⤵
- Executes dropped EXE
PID:1304 -
\??\c:\rlfflrf.exec:\rlfflrf.exe65⤵
- Executes dropped EXE
PID:1624 -
\??\c:\3tnbhh.exec:\3tnbhh.exe66⤵PID:952
-
\??\c:\nhhnhn.exec:\nhhnhn.exe67⤵PID:2096
-
\??\c:\jdjvj.exec:\jdjvj.exe68⤵PID:1336
-
\??\c:\llrxffr.exec:\llrxffr.exe69⤵PID:3024
-
\??\c:\xlxlxxl.exec:\xlxlxxl.exe70⤵PID:1740
-
\??\c:\tthntb.exec:\tthntb.exe71⤵PID:3036
-
\??\c:\jvpdp.exec:\jvpdp.exe72⤵PID:2404
-
\??\c:\1vjjj.exec:\1vjjj.exe73⤵PID:2300
-
\??\c:\rlflxrf.exec:\rlflxrf.exe74⤵PID:892
-
\??\c:\nnbbhh.exec:\nnbbhh.exe75⤵PID:2256
-
\??\c:\pjdpv.exec:\pjdpv.exe76⤵PID:2012
-
\??\c:\xxlrxlx.exec:\xxlrxlx.exe77⤵PID:2840
-
\??\c:\nnhnhh.exec:\nnhnhh.exe78⤵PID:2468
-
\??\c:\vvjvd.exec:\vvjvd.exe79⤵
- System Location Discovery: System Language Discovery
PID:2460 -
\??\c:\jjvdp.exec:\jjvdp.exe80⤵PID:3068
-
\??\c:\xrlrflx.exec:\xrlrflx.exe81⤵PID:2728
-
\??\c:\htnnbh.exec:\htnnbh.exe82⤵PID:2756
-
\??\c:\ddjjp.exec:\ddjjp.exe83⤵PID:2656
-
\??\c:\7jjjv.exec:\7jjjv.exe84⤵PID:2536
-
\??\c:\lffxlfx.exec:\lffxlfx.exe85⤵PID:2868
-
\??\c:\1nhnbb.exec:\1nhnbb.exe86⤵PID:2696
-
\??\c:\ddvjv.exec:\ddvjv.exe87⤵PID:2752
-
\??\c:\djdjp.exec:\djdjp.exe88⤵PID:2596
-
\??\c:\rlrfxlr.exec:\rlrfxlr.exe89⤵PID:2548
-
\??\c:\hntbbb.exec:\hntbbb.exe90⤵PID:1512
-
\??\c:\vjjvj.exec:\vjjvj.exe91⤵PID:1764
-
\??\c:\jjjdv.exec:\jjjdv.exe92⤵PID:1668
-
\??\c:\lfxflrf.exec:\lfxflrf.exe93⤵PID:1680
-
\??\c:\nnhtbh.exec:\nnhtbh.exe94⤵PID:2260
-
\??\c:\vvpvd.exec:\vvpvd.exe95⤵PID:1056
-
\??\c:\vvvvv.exec:\vvvvv.exe96⤵PID:2360
-
\??\c:\fxllrxf.exec:\fxllrxf.exe97⤵PID:1724
-
\??\c:\7btbht.exec:\7btbht.exe98⤵PID:868
-
\??\c:\9ttnbh.exec:\9ttnbh.exe99⤵
- System Location Discovery: System Language Discovery
PID:1312 -
\??\c:\dvjpp.exec:\dvjpp.exe100⤵PID:2872
-
\??\c:\3rflfrx.exec:\3rflfrx.exe101⤵PID:2568
-
\??\c:\7bbhnh.exec:\7bbhnh.exe102⤵PID:816
-
\??\c:\3tntbt.exec:\3tntbt.exe103⤵PID:292
-
\??\c:\jpjvp.exec:\jpjvp.exe104⤵PID:2928
-
\??\c:\9jvvv.exec:\9jvvv.exe105⤵PID:2044
-
\??\c:\1rfffrx.exec:\1rfffrx.exe106⤵PID:992
-
\??\c:\hnnbnn.exec:\hnnbnn.exe107⤵PID:2780
-
\??\c:\djvpp.exec:\djvpp.exe108⤵PID:1304
-
\??\c:\ddjjp.exec:\ddjjp.exe109⤵PID:1536
-
\??\c:\lfxrfxf.exec:\lfxrfxf.exe110⤵PID:952
-
\??\c:\nhhbtt.exec:\nhhbtt.exe111⤵PID:1788
-
\??\c:\hnntnt.exec:\hnntnt.exe112⤵PID:3020
-
\??\c:\vvjjv.exec:\vvjjv.exe113⤵PID:3028
-
\??\c:\fxlrlxf.exec:\fxlrlxf.exe114⤵PID:2964
-
\??\c:\9tbhnt.exec:\9tbhnt.exe115⤵PID:2960
-
\??\c:\hnnbth.exec:\hnnbth.exe116⤵PID:1040
-
\??\c:\jpjdv.exec:\jpjdv.exe117⤵PID:1844
-
\??\c:\flrxfrl.exec:\flrxfrl.exe118⤵PID:1128
-
\??\c:\3hthtb.exec:\3hthtb.exe119⤵PID:2496
-
\??\c:\vjvjd.exec:\vjvjd.exe120⤵PID:2012
-
\??\c:\9rlrxxl.exec:\9rlrxxl.exe121⤵PID:1704
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-