Analysis
-
max time kernel
150s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 14:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e410cd0189d8717eaceadd677ce79a8d8bdf68ae4ab865732858c677eac5f4ff.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
e410cd0189d8717eaceadd677ce79a8d8bdf68ae4ab865732858c677eac5f4ff.exe
-
Size
384KB
-
MD5
0ada576629d2a2c79ab1cafcf823718c
-
SHA1
6dde40cdbd6857ffc06569bdf9b9c8b5978c6046
-
SHA256
e410cd0189d8717eaceadd677ce79a8d8bdf68ae4ab865732858c677eac5f4ff
-
SHA512
9567227eb22f308cde4f42a5f6a271ea2ae314c4d6593fd436bd17a9039e9781041d68667eada4122431bff99364089c4efe0acfc4a662bc05d8476bdd763610
-
SSDEEP
3072:8hOm2sI93UufdC67cimD5t251UrRE9TTFw41/t49:8cm7ImGddXmNt251UriZFwkS
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
Processes:
resource yara_rule behavioral1/memory/2452-538-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2156-488-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2148-451-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2008-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1764-407-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1924-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-381-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2828-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1600-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1508-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-341-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2780-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1544-272-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1208-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1960-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1544-244-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/932-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/840-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1080-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3056-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2384-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2384-196-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/1816-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2532-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1788-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1228-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1796-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1796-86-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1844-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-56-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2876-44-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2672-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/880-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-593-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1600-634-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2312-693-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1064-768-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2428-794-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1088-813-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
ppjpd.exexrrlxlx.exe5hhtnb.exejddjj.exexxrlxfx.exe5lfrxfr.exehhhhbn.exevvpvp.exe9tbnbh.exebhhbbt.exelffflrx.exerrlrrxr.exe9ppvj.exerrlxffr.exehhhhbb.exe3dvjp.exe7nhtth.exevvpvd.exexrllxxl.exerffllff.exevvppd.exexxlxflx.exedddjd.exevvvdp.exenhbbht.exe5hhtbn.exe7rffrrf.exe9nhntb.exe5xlrflf.exe5hbhth.exeppddp.exexrlfllr.exebbhhnt.exejdjpp.exerxrfrxl.exetnhhbb.exe5bhbtt.exejvppd.exe7xlxflx.exelfxxllx.exehhhnhn.exejdvdp.exevpjpp.exexxllrxf.exetbthtb.exetthnbh.exedvdvd.exelxrrxfr.exe9frrxfl.exe3tnntt.exejjjjv.exedpddd.exexxrlxfx.exebntnht.exe1jddj.exevjddj.exexfrlrll.exerfrxfxf.exebthnhh.exehtbnhb.exejvjjp.exexlrrxxf.exefrfxffr.exe3thhnb.exepid Process 2652 ppjpd.exe 2836 xrrlxlx.exe 2672 5hhtnb.exe 2876 jddjj.exe 2816 xxrlxfx.exe 2596 5lfrxfr.exe 1844 hhhhbn.exe 1796 vvpvp.exe 1804 9tbnbh.exe 1228 bhhbbt.exe 1788 lffflrx.exe 2532 rrlrrxr.exe 3012 9ppvj.exe 2648 rrlxffr.exe 1160 hhhhbb.exe 2392 3dvjp.exe 484 7nhtth.exe 1816 vvpvd.exe 1956 xrllxxl.exe 2384 rffllff.exe 3056 vvppd.exe 1080 xxlxflx.exe 840 dddjd.exe 932 vvvdp.exe 1544 nhbbht.exe 1960 5hhtbn.exe 672 7rffrrf.exe 1208 9nhntb.exe 1744 5xlrflf.exe 1800 5hbhth.exe 2696 ppddp.exe 2700 xrlfllr.exe 2744 bbhhnt.exe 2780 jdjpp.exe 2664 rxrfrxl.exe 2712 tnhhbb.exe 2540 5bhbtt.exe 1516 jvppd.exe 1508 7xlxflx.exe 1600 lfxxllx.exe 2016 hhhnhn.exe 1360 jdvdp.exe 2828 vpjpp.exe 2952 xxllrxf.exe 1924 tbthtb.exe 2824 tthnbh.exe 1764 dvdvd.exe 1972 lxrrxfr.exe 2844 9frrxfl.exe 2648 3tnntt.exe 2180 jjjjv.exe 1732 dpddd.exe 2008 xxrlxfx.exe 2148 bntnht.exe 1280 1jddj.exe 2968 vjddj.exe 1216 xfrlrll.exe 2384 rfrxfxf.exe 1348 bthnhh.exe 2156 htbnhb.exe 2076 jvjjp.exe 1712 xlrrxxf.exe 2248 frfxffr.exe 2128 3thhnb.exe -
Processes:
resource yara_rule behavioral1/memory/2452-538-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1924-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1508-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1208-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/932-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/840-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1080-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1816-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1788-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1228-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1228-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1796-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1844-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/880-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/880-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-593-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1064-768-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2428-794-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-821-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1524-890-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2904-896-0x0000000000220000-0x000000000024A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
rrlxxfx.exe3lflrrf.exebtnnhh.exe7lffxxf.exejdvjv.exevpddv.exedvddj.exedvpdv.exenntbtt.exe1llxfxf.exefxlrxrf.exejvjdj.exe3lffrxl.exe7dvdj.exe9lxfllr.exejvpjv.exethbnbb.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlxxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lflrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lffxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1llxfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lffrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lxfllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e410cd0189d8717eaceadd677ce79a8d8bdf68ae4ab865732858c677eac5f4ff.exeppjpd.exexrrlxlx.exe5hhtnb.exejddjj.exexxrlxfx.exe5lfrxfr.exehhhhbn.exevvpvp.exe9tbnbh.exebhhbbt.exelffflrx.exerrlrrxr.exe9ppvj.exerrlxffr.exehhhhbb.exedescription pid Process procid_target PID 880 wrote to memory of 2652 880 e410cd0189d8717eaceadd677ce79a8d8bdf68ae4ab865732858c677eac5f4ff.exe 30 PID 880 wrote to memory of 2652 880 e410cd0189d8717eaceadd677ce79a8d8bdf68ae4ab865732858c677eac5f4ff.exe 30 PID 880 wrote to memory of 2652 880 e410cd0189d8717eaceadd677ce79a8d8bdf68ae4ab865732858c677eac5f4ff.exe 30 PID 880 wrote to memory of 2652 880 e410cd0189d8717eaceadd677ce79a8d8bdf68ae4ab865732858c677eac5f4ff.exe 30 PID 2652 wrote to memory of 2836 2652 ppjpd.exe 31 PID 2652 wrote to memory of 2836 2652 ppjpd.exe 31 PID 2652 wrote to memory of 2836 2652 ppjpd.exe 31 PID 2652 wrote to memory of 2836 2652 ppjpd.exe 31 PID 2836 wrote to memory of 2672 2836 xrrlxlx.exe 32 PID 2836 wrote to memory of 2672 2836 xrrlxlx.exe 32 PID 2836 wrote to memory of 2672 2836 xrrlxlx.exe 32 PID 2836 wrote to memory of 2672 2836 xrrlxlx.exe 32 PID 2672 wrote to memory of 2876 2672 5hhtnb.exe 33 PID 2672 wrote to memory of 2876 2672 5hhtnb.exe 33 PID 2672 wrote to memory of 2876 2672 5hhtnb.exe 33 PID 2672 wrote to memory of 2876 2672 5hhtnb.exe 33 PID 2876 wrote to memory of 2816 2876 jddjj.exe 34 PID 2876 wrote to memory of 2816 2876 jddjj.exe 34 PID 2876 wrote to memory of 2816 2876 jddjj.exe 34 PID 2876 wrote to memory of 2816 2876 jddjj.exe 34 PID 2816 wrote to memory of 2596 2816 xxrlxfx.exe 35 PID 2816 wrote to memory of 2596 2816 xxrlxfx.exe 35 PID 2816 wrote to memory of 2596 2816 xxrlxfx.exe 35 PID 2816 wrote to memory of 2596 2816 xxrlxfx.exe 35 PID 2596 wrote to memory of 1844 2596 5lfrxfr.exe 36 PID 2596 wrote to memory of 1844 2596 5lfrxfr.exe 36 PID 2596 wrote to memory of 1844 2596 5lfrxfr.exe 36 PID 2596 wrote to memory of 1844 2596 5lfrxfr.exe 36 PID 1844 wrote to memory of 1796 1844 hhhhbn.exe 37 PID 1844 wrote to memory of 1796 1844 hhhhbn.exe 37 PID 1844 wrote to memory of 1796 1844 hhhhbn.exe 37 PID 1844 wrote to memory of 1796 1844 hhhhbn.exe 37 PID 1796 wrote to memory of 1804 1796 vvpvp.exe 38 PID 1796 wrote to memory of 1804 1796 vvpvp.exe 38 PID 1796 wrote to memory of 1804 1796 vvpvp.exe 38 PID 1796 wrote to memory of 1804 1796 vvpvp.exe 38 PID 1804 wrote to memory of 1228 1804 9tbnbh.exe 39 PID 1804 wrote to memory of 1228 1804 9tbnbh.exe 39 PID 1804 wrote to memory of 1228 1804 9tbnbh.exe 39 PID 1804 wrote to memory of 1228 1804 9tbnbh.exe 39 PID 1228 wrote to memory of 1788 1228 bhhbbt.exe 40 PID 1228 wrote to memory of 1788 1228 bhhbbt.exe 40 PID 1228 wrote to memory of 1788 1228 bhhbbt.exe 40 PID 1228 wrote to memory of 1788 1228 bhhbbt.exe 40 PID 1788 wrote to memory of 2532 1788 lffflrx.exe 41 PID 1788 wrote to memory of 2532 1788 lffflrx.exe 41 PID 1788 wrote to memory of 2532 1788 lffflrx.exe 41 PID 1788 wrote to memory of 2532 1788 lffflrx.exe 41 PID 2532 wrote to memory of 3012 2532 rrlrrxr.exe 42 PID 2532 wrote to memory of 3012 2532 rrlrrxr.exe 42 PID 2532 wrote to memory of 3012 2532 rrlrrxr.exe 42 PID 2532 wrote to memory of 3012 2532 rrlrrxr.exe 42 PID 3012 wrote to memory of 2648 3012 9ppvj.exe 43 PID 3012 wrote to memory of 2648 3012 9ppvj.exe 43 PID 3012 wrote to memory of 2648 3012 9ppvj.exe 43 PID 3012 wrote to memory of 2648 3012 9ppvj.exe 43 PID 2648 wrote to memory of 1160 2648 rrlxffr.exe 44 PID 2648 wrote to memory of 1160 2648 rrlxffr.exe 44 PID 2648 wrote to memory of 1160 2648 rrlxffr.exe 44 PID 2648 wrote to memory of 1160 2648 rrlxffr.exe 44 PID 1160 wrote to memory of 2392 1160 hhhhbb.exe 45 PID 1160 wrote to memory of 2392 1160 hhhhbb.exe 45 PID 1160 wrote to memory of 2392 1160 hhhhbb.exe 45 PID 1160 wrote to memory of 2392 1160 hhhhbb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\e410cd0189d8717eaceadd677ce79a8d8bdf68ae4ab865732858c677eac5f4ff.exe"C:\Users\Admin\AppData\Local\Temp\e410cd0189d8717eaceadd677ce79a8d8bdf68ae4ab865732858c677eac5f4ff.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:880 -
\??\c:\ppjpd.exec:\ppjpd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\xrrlxlx.exec:\xrrlxlx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\5hhtnb.exec:\5hhtnb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\jddjj.exec:\jddjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\xxrlxfx.exec:\xxrlxfx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\5lfrxfr.exec:\5lfrxfr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\hhhhbn.exec:\hhhhbn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
\??\c:\vvpvp.exec:\vvpvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\9tbnbh.exec:\9tbnbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\bhhbbt.exec:\bhhbbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
\??\c:\lffflrx.exec:\lffflrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\rrlrrxr.exec:\rrlrrxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\9ppvj.exec:\9ppvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\rrlxffr.exec:\rrlxffr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\hhhhbb.exec:\hhhhbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
\??\c:\3dvjp.exec:\3dvjp.exe17⤵
- Executes dropped EXE
PID:2392 -
\??\c:\7nhtth.exec:\7nhtth.exe18⤵
- Executes dropped EXE
PID:484 -
\??\c:\vvpvd.exec:\vvpvd.exe19⤵
- Executes dropped EXE
PID:1816 -
\??\c:\xrllxxl.exec:\xrllxxl.exe20⤵
- Executes dropped EXE
PID:1956 -
\??\c:\rffllff.exec:\rffllff.exe21⤵
- Executes dropped EXE
PID:2384 -
\??\c:\vvppd.exec:\vvppd.exe22⤵
- Executes dropped EXE
PID:3056 -
\??\c:\xxlxflx.exec:\xxlxflx.exe23⤵
- Executes dropped EXE
PID:1080 -
\??\c:\dddjd.exec:\dddjd.exe24⤵
- Executes dropped EXE
PID:840 -
\??\c:\vvvdp.exec:\vvvdp.exe25⤵
- Executes dropped EXE
PID:932 -
\??\c:\nhbbht.exec:\nhbbht.exe26⤵
- Executes dropped EXE
PID:1544 -
\??\c:\5hhtbn.exec:\5hhtbn.exe27⤵
- Executes dropped EXE
PID:1960 -
\??\c:\7rffrrf.exec:\7rffrrf.exe28⤵
- Executes dropped EXE
PID:672 -
\??\c:\9nhntb.exec:\9nhntb.exe29⤵
- Executes dropped EXE
PID:1208 -
\??\c:\5xlrflf.exec:\5xlrflf.exe30⤵
- Executes dropped EXE
PID:1744 -
\??\c:\5hbhth.exec:\5hbhth.exe31⤵
- Executes dropped EXE
PID:1800 -
\??\c:\ppddp.exec:\ppddp.exe32⤵
- Executes dropped EXE
PID:2696 -
\??\c:\xrlfllr.exec:\xrlfllr.exe33⤵
- Executes dropped EXE
PID:2700 -
\??\c:\bbhhnt.exec:\bbhhnt.exe34⤵
- Executes dropped EXE
PID:2744 -
\??\c:\jdjpp.exec:\jdjpp.exe35⤵
- Executes dropped EXE
PID:2780 -
\??\c:\rxrfrxl.exec:\rxrfrxl.exe36⤵
- Executes dropped EXE
PID:2664 -
\??\c:\tnhhbb.exec:\tnhhbb.exe37⤵
- Executes dropped EXE
PID:2712 -
\??\c:\5bhbtt.exec:\5bhbtt.exe38⤵
- Executes dropped EXE
PID:2540 -
\??\c:\jvppd.exec:\jvppd.exe39⤵
- Executes dropped EXE
PID:1516 -
\??\c:\7xlxflx.exec:\7xlxflx.exe40⤵
- Executes dropped EXE
PID:1508 -
\??\c:\lfxxllx.exec:\lfxxllx.exe41⤵
- Executes dropped EXE
PID:1600 -
\??\c:\hhhnhn.exec:\hhhnhn.exe42⤵
- Executes dropped EXE
PID:2016 -
\??\c:\jdvdp.exec:\jdvdp.exe43⤵
- Executes dropped EXE
PID:1360 -
\??\c:\vpjpp.exec:\vpjpp.exe44⤵
- Executes dropped EXE
PID:2828 -
\??\c:\xxllrxf.exec:\xxllrxf.exe45⤵
- Executes dropped EXE
PID:2952 -
\??\c:\tbthtb.exec:\tbthtb.exe46⤵
- Executes dropped EXE
PID:1924 -
\??\c:\tthnbh.exec:\tthnbh.exe47⤵
- Executes dropped EXE
PID:2824 -
\??\c:\dvdvd.exec:\dvdvd.exe48⤵
- Executes dropped EXE
PID:1764 -
\??\c:\lxrrxfr.exec:\lxrrxfr.exe49⤵
- Executes dropped EXE
PID:1972 -
\??\c:\9frrxfl.exec:\9frrxfl.exe50⤵
- Executes dropped EXE
PID:2844 -
\??\c:\3tnntt.exec:\3tnntt.exe51⤵
- Executes dropped EXE
PID:2648 -
\??\c:\jjjjv.exec:\jjjjv.exe52⤵
- Executes dropped EXE
PID:2180 -
\??\c:\dpddd.exec:\dpddd.exe53⤵
- Executes dropped EXE
PID:1732 -
\??\c:\xxrlxfx.exec:\xxrlxfx.exe54⤵
- Executes dropped EXE
PID:2008 -
\??\c:\bntnht.exec:\bntnht.exe55⤵
- Executes dropped EXE
PID:2148 -
\??\c:\1jddj.exec:\1jddj.exe56⤵
- Executes dropped EXE
PID:1280 -
\??\c:\vjddj.exec:\vjddj.exe57⤵
- Executes dropped EXE
PID:2968 -
\??\c:\xfrlrll.exec:\xfrlrll.exe58⤵
- Executes dropped EXE
PID:1216 -
\??\c:\rfrxfxf.exec:\rfrxfxf.exe59⤵
- Executes dropped EXE
PID:2384 -
\??\c:\bthnhh.exec:\bthnhh.exe60⤵
- Executes dropped EXE
PID:1348 -
\??\c:\htbnhb.exec:\htbnhb.exe61⤵
- Executes dropped EXE
PID:2156 -
\??\c:\jvjjp.exec:\jvjjp.exe62⤵
- Executes dropped EXE
PID:2076 -
\??\c:\xlrrxxf.exec:\xlrrxxf.exe63⤵
- Executes dropped EXE
PID:1712 -
\??\c:\frfxffr.exec:\frfxffr.exe64⤵
- Executes dropped EXE
PID:2248 -
\??\c:\3thhnb.exec:\3thhnb.exe65⤵
- Executes dropped EXE
PID:2128 -
\??\c:\bthbnt.exec:\bthbnt.exe66⤵PID:2428
-
\??\c:\jvppv.exec:\jvppv.exe67⤵PID:2508
-
\??\c:\7ffrrrr.exec:\7ffrrrr.exe68⤵PID:2476
-
\??\c:\xrlrflx.exec:\xrlrflx.exe69⤵PID:2452
-
\??\c:\nhbbbh.exec:\nhbbbh.exe70⤵PID:764
-
\??\c:\ththhb.exec:\ththhb.exe71⤵PID:2460
-
\??\c:\ppjjv.exec:\ppjjv.exe72⤵PID:2236
-
\??\c:\pjdjd.exec:\pjdjd.exe73⤵PID:2652
-
\??\c:\frxxrxx.exec:\frxxrxx.exe74⤵PID:2760
-
\??\c:\thtthh.exec:\thtthh.exe75⤵PID:2836
-
\??\c:\3bttbt.exec:\3bttbt.exe76⤵PID:2068
-
\??\c:\jdvvd.exec:\jdvvd.exe77⤵PID:1588
-
\??\c:\pdpvv.exec:\pdpvv.exe78⤵PID:2780
-
\??\c:\bbnbhb.exec:\bbnbhb.exe79⤵PID:2876
-
\??\c:\pvjpp.exec:\pvjpp.exe80⤵PID:2712
-
\??\c:\lxrxlfr.exec:\lxrxlfr.exe81⤵PID:2540
-
\??\c:\pjppv.exec:\pjppv.exe82⤵PID:1516
-
\??\c:\fxrlffr.exec:\fxrlffr.exe83⤵PID:2612
-
\??\c:\vjvdj.exec:\vjvdj.exe84⤵PID:1600
-
\??\c:\lfrxfff.exec:\lfrxfff.exe85⤵PID:1804
-
\??\c:\bnbbbb.exec:\bnbbbb.exe86⤵PID:2340
-
\??\c:\lfrxfff.exec:\lfrxfff.exe87⤵PID:2828
-
\??\c:\thnnth.exec:\thnnth.exe88⤵PID:2952
-
\??\c:\frrxllr.exec:\frrxllr.exe89⤵PID:2160
-
\??\c:\rfxrrrx.exec:\rfxrrrx.exe90⤵PID:1772
-
\??\c:\bhtbhh.exec:\bhtbhh.exe91⤵PID:1764
-
\??\c:\dpjpp.exec:\dpjpp.exe92⤵PID:1616
-
\??\c:\9llrllr.exec:\9llrllr.exe93⤵PID:2312
-
\??\c:\3jvvj.exec:\3jvvj.exe94⤵PID:2884
-
\??\c:\jdvvd.exec:\jdvvd.exe95⤵PID:1372
-
\??\c:\nbnntt.exec:\nbnntt.exe96⤵PID:1976
-
\??\c:\jdpdv.exec:\jdpdv.exe97⤵PID:2376
-
\??\c:\rlfrllr.exec:\rlfrllr.exe98⤵PID:2212
-
\??\c:\tnhnbb.exec:\tnhnbb.exe99⤵PID:1956
-
\??\c:\5nhtbb.exec:\5nhtbb.exe100⤵PID:2988
-
\??\c:\5jvjp.exec:\5jvjp.exe101⤵PID:664
-
\??\c:\3lffxfr.exec:\3lffxfr.exe102⤵PID:1604
-
\??\c:\1thhnn.exec:\1thhnn.exe103⤵PID:2156
-
\??\c:\7vjjd.exec:\7vjjd.exe104⤵PID:1064
-
\??\c:\jjdjp.exec:\jjdjp.exe105⤵PID:776
-
\??\c:\fxlfllx.exec:\fxlfllx.exe106⤵PID:2248
-
\??\c:\tbnntt.exec:\tbnntt.exe107⤵PID:2128
-
\??\c:\dvpdv.exec:\dvpdv.exe108⤵
- System Location Discovery: System Language Discovery
PID:2428 -
\??\c:\1djdj.exec:\1djdj.exe109⤵PID:1204
-
\??\c:\xrlxflx.exec:\xrlxflx.exe110⤵PID:1328
-
\??\c:\bthnbb.exec:\bthnbb.exe111⤵PID:1088
-
\??\c:\1hbthn.exec:\1hbthn.exe112⤵PID:2656
-
\??\c:\jdvvv.exec:\jdvvv.exe113⤵PID:2688
-
\??\c:\xxrxflf.exec:\xxrxflf.exe114⤵PID:2788
-
\??\c:\nhtthh.exec:\nhtthh.exe115⤵PID:2720
-
\??\c:\pppjp.exec:\pppjp.exe116⤵PID:1592
-
\??\c:\rllxfrx.exec:\rllxfrx.exe117⤵PID:2840
-
\??\c:\5ttbnn.exec:\5ttbnn.exe118⤵PID:1588
-
\??\c:\7pdvv.exec:\7pdvv.exe119⤵PID:2664
-
\??\c:\lxrlllx.exec:\lxrlllx.exe120⤵PID:2876
-
\??\c:\xxrxllr.exec:\xxrxllr.exe121⤵PID:2712
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-