Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 19:17
Behavioral task
behavioral1
Sample
e486e9a4f70928a10a6a35fd90f36cfc4880f89d4ec07ca16865a62bf6d56105.exe
Resource
win7-20240903-en
General
-
Target
e486e9a4f70928a10a6a35fd90f36cfc4880f89d4ec07ca16865a62bf6d56105.exe
-
Size
50KB
-
MD5
5b8fcc61f01923defa64b4cb5a1e076b
-
SHA1
c230a9f733d13a4a866891abe71c9b1a607d33b1
-
SHA256
e486e9a4f70928a10a6a35fd90f36cfc4880f89d4ec07ca16865a62bf6d56105
-
SHA512
e137519deaf1b5214d440f7c6e645aef952a3cae18d23c6c5583b3c65502de53d24bd796c6a97dd1cc8f8c0b5e35af0073581fa79ef720b1280fe6f326b14ea0
-
SSDEEP
1536:LvQBeOGtrYS3srx93UBWfwC6Ggnouy8g5Uhub:LhOmTsF93UYfwC6GIoutg5Uha
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 45 IoCs
Processes:
resource yara_rule behavioral1/memory/2196-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2440-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1124-22-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2564-27-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/264-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2500-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2500-48-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2776-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2748-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2648-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2804-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2640-98-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2640-97-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2116-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1200-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2020-132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2944-153-0x00000000003B0000-0x00000000003D7000-memory.dmp family_blackmoon behavioral1/memory/2944-154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1860-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1664-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2520-182-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1868-199-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2368-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1204-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2436-220-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1368-230-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/596-243-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/556-259-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2204-297-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/264-309-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2916-330-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2776-336-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2868-389-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2944-427-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3000-607-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2116-635-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/840-647-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1144-738-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1696-744-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2232-761-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/284-777-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2316-809-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1072-1025-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1960-24165-0x0000000076CF0000-0x0000000076E0F000-memory.dmp family_blackmoon behavioral1/memory/1960-25525-0x0000000076CF0000-0x0000000076E0F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
5jjvv.exe3pdpj.exexlrrxxf.exe7btbth.exevpjvd.exexflrxrl.exerfrfxll.exe3bbtht.exevvpjj.exepvjpd.exe7lllrxf.exe5pjvj.exeflrfxlx.exe7xfrxxf.exe1vpjj.exe1xlxxrl.exe1ffllrx.exettttbh.exe9nnnnb.exerxlrrfr.exexllxrlf.exe3hthtn.exe7jjvv.exeflxlffx.exeffxrlxf.exehnbntn.exejjvdj.exelxllrxf.exehntthh.exepdvvj.exexlfrrfr.exehthntn.exe1nbtnt.exeppjvj.exelrxxxll.exe5llxlxr.exebnhnbh.exenbbbtb.exeppjvp.exe7rlrxxr.exeffflxxx.exenbbbbn.exe1ppvp.exelllrllf.exerlfxxlr.exebhthnt.exeppvjj.exe5ddpj.exelfrfxrl.exehtnhhb.exetthhhb.exeddpjv.exejvjjp.exerlrllxx.exehhtbhn.exenhtbtb.exevpdpd.exerfrxllr.exe1bbtnt.exenhtbnt.exebtnbnb.exevvppp.exexrrrxxx.exefxxfrrx.exepid process 2196 5jjvv.exe 1124 3pdpj.exe 2564 xlrrxxf.exe 264 7btbth.exe 2500 vpjvd.exe 2748 xflrxrl.exe 2776 rfrfxll.exe 2804 3bbtht.exe 2648 vvpjj.exe 2664 pvjpd.exe 2640 7lllrxf.exe 2116 5pjvj.exe 2112 flrfxlx.exe 1200 7xfrxxf.exe 2020 1vpjj.exe 2992 1xlxxrl.exe 1996 1ffllrx.exe 2944 ttttbh.exe 1664 9nnnnb.exe 1860 rxlrrfr.exe 800 xllxrlf.exe 2520 3hthtn.exe 2368 7jjvv.exe 1868 flxlffx.exe 1204 ffxrlxf.exe 2436 hnbntn.exe 1660 jjvdj.exe 1368 lxllrxf.exe 596 hntthh.exe 2084 pdvvj.exe 556 xlfrrfr.exe 2032 hthntn.exe 1724 1nbtnt.exe 888 ppjvj.exe 2548 lrxxxll.exe 2300 5llxlxr.exe 2164 bnhnbh.exe 2204 nbbbtb.exe 1748 ppjvp.exe 264 7rlrxxr.exe 2724 ffflxxx.exe 2764 nbbbbn.exe 2900 1ppvp.exe 2916 lllrllf.exe 2776 rlfxxlr.exe 1576 bhthnt.exe 2804 ppvjj.exe 3036 5ddpj.exe 2628 lfrfxrl.exe 2800 htnhhb.exe 2876 tthhhb.exe 2160 ddpjv.exe 2476 jvjjp.exe 1028 rlrllxx.exe 2868 hhtbhn.exe 1200 nhtbtb.exe 1484 vpdpd.exe 1776 rfrxllr.exe 2992 1bbtnt.exe 2828 nhtbnt.exe 2980 btnbnb.exe 2944 vvppp.exe 768 xrrrxxx.exe 1416 fxxfrrx.exe -
Processes:
resource yara_rule C:\3pdpj.exe upx behavioral1/memory/2196-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2440-5-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5jjvv.exe upx \??\c:\xlrrxxf.exe upx behavioral1/memory/1124-22-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1124-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/264-34-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\7btbth.exe upx behavioral1/memory/2500-40-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vpjvd.exe upx \??\c:\xflrxrl.exe upx behavioral1/memory/2748-51-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2500-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2500-47-0x00000000001B0000-0x00000000001D7000-memory.dmp upx behavioral1/memory/2776-62-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rfrfxll.exe upx behavioral1/memory/2748-58-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2648-77-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\vvpjj.exe upx behavioral1/memory/2804-70-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\3bbtht.exe upx \??\c:\pvjpd.exe upx C:\7lllrxf.exe upx C:\5pjvj.exe upx behavioral1/memory/2640-97-0x0000000000220000-0x0000000000247000-memory.dmp upx C:\flrfxlx.exe upx behavioral1/memory/2116-106-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7xfrxxf.exe upx behavioral1/memory/1200-117-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1vpjj.exe upx C:\1xlxxrl.exe upx behavioral1/memory/2020-127-0x00000000003C0000-0x00000000003E7000-memory.dmp upx behavioral1/memory/2020-132-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1ffllrx.exe upx \??\c:\ttttbh.exe upx C:\9nnnnb.exe upx behavioral1/memory/2944-154-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rxlrrfr.exe upx C:\xllxrlf.exe upx behavioral1/memory/1860-172-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1860-164-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1664-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2520-182-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\3hthtn.exe upx C:\7jjvv.exe upx C:\ffxrlxf.exe upx behavioral1/memory/1868-199-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\flxlffx.exe upx behavioral1/memory/2368-196-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1204-205-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\hnbntn.exe upx behavioral1/memory/1204-213-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jjvdj.exe upx C:\lxllrxf.exe upx behavioral1/memory/1368-230-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hntthh.exe upx C:\pdvvj.exe upx behavioral1/memory/596-243-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xlfrrfr.exe upx C:\hthntn.exe upx behavioral1/memory/556-259-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2204-297-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/264-309-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
ddjjp.exe3dvdj.exenhbttt.exexlffrxl.exexrfrfrx.exefffflrx.exepdjdj.exe1pjvp.exethnbhn.exexxflrfx.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlffrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfrfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxflrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e486e9a4f70928a10a6a35fd90f36cfc4880f89d4ec07ca16865a62bf6d56105.exe5jjvv.exe3pdpj.exexlrrxxf.exe7btbth.exevpjvd.exexflrxrl.exerfrfxll.exe3bbtht.exevvpjj.exepvjpd.exe7lllrxf.exe5pjvj.exeflrfxlx.exe7xfrxxf.exe1vpjj.exedescription pid process target process PID 2440 wrote to memory of 2196 2440 e486e9a4f70928a10a6a35fd90f36cfc4880f89d4ec07ca16865a62bf6d56105.exe 5jjvv.exe PID 2440 wrote to memory of 2196 2440 e486e9a4f70928a10a6a35fd90f36cfc4880f89d4ec07ca16865a62bf6d56105.exe 5jjvv.exe PID 2440 wrote to memory of 2196 2440 e486e9a4f70928a10a6a35fd90f36cfc4880f89d4ec07ca16865a62bf6d56105.exe 5jjvv.exe PID 2440 wrote to memory of 2196 2440 e486e9a4f70928a10a6a35fd90f36cfc4880f89d4ec07ca16865a62bf6d56105.exe 5jjvv.exe PID 2196 wrote to memory of 1124 2196 5jjvv.exe 3pdpj.exe PID 2196 wrote to memory of 1124 2196 5jjvv.exe 3pdpj.exe PID 2196 wrote to memory of 1124 2196 5jjvv.exe 3pdpj.exe PID 2196 wrote to memory of 1124 2196 5jjvv.exe 3pdpj.exe PID 1124 wrote to memory of 2564 1124 3pdpj.exe xlrrxxf.exe PID 1124 wrote to memory of 2564 1124 3pdpj.exe xlrrxxf.exe PID 1124 wrote to memory of 2564 1124 3pdpj.exe xlrrxxf.exe PID 1124 wrote to memory of 2564 1124 3pdpj.exe xlrrxxf.exe PID 2564 wrote to memory of 264 2564 xlrrxxf.exe 7btbth.exe PID 2564 wrote to memory of 264 2564 xlrrxxf.exe 7btbth.exe PID 2564 wrote to memory of 264 2564 xlrrxxf.exe 7btbth.exe PID 2564 wrote to memory of 264 2564 xlrrxxf.exe 7btbth.exe PID 264 wrote to memory of 2500 264 7btbth.exe vpjvd.exe PID 264 wrote to memory of 2500 264 7btbth.exe vpjvd.exe PID 264 wrote to memory of 2500 264 7btbth.exe vpjvd.exe PID 264 wrote to memory of 2500 264 7btbth.exe vpjvd.exe PID 2500 wrote to memory of 2748 2500 vpjvd.exe xflrxrl.exe PID 2500 wrote to memory of 2748 2500 vpjvd.exe xflrxrl.exe PID 2500 wrote to memory of 2748 2500 vpjvd.exe xflrxrl.exe PID 2500 wrote to memory of 2748 2500 vpjvd.exe xflrxrl.exe PID 2748 wrote to memory of 2776 2748 xflrxrl.exe rfrfxll.exe PID 2748 wrote to memory of 2776 2748 xflrxrl.exe rfrfxll.exe PID 2748 wrote to memory of 2776 2748 xflrxrl.exe rfrfxll.exe PID 2748 wrote to memory of 2776 2748 xflrxrl.exe rfrfxll.exe PID 2776 wrote to memory of 2804 2776 rfrfxll.exe 3bbtht.exe PID 2776 wrote to memory of 2804 2776 rfrfxll.exe 3bbtht.exe PID 2776 wrote to memory of 2804 2776 rfrfxll.exe 3bbtht.exe PID 2776 wrote to memory of 2804 2776 rfrfxll.exe 3bbtht.exe PID 2804 wrote to memory of 2648 2804 3bbtht.exe vvpjj.exe PID 2804 wrote to memory of 2648 2804 3bbtht.exe vvpjj.exe PID 2804 wrote to memory of 2648 2804 3bbtht.exe vvpjj.exe PID 2804 wrote to memory of 2648 2804 3bbtht.exe vvpjj.exe PID 2648 wrote to memory of 2664 2648 vvpjj.exe pvjpd.exe PID 2648 wrote to memory of 2664 2648 vvpjj.exe pvjpd.exe PID 2648 wrote to memory of 2664 2648 vvpjj.exe pvjpd.exe PID 2648 wrote to memory of 2664 2648 vvpjj.exe pvjpd.exe PID 2664 wrote to memory of 2640 2664 pvjpd.exe 7lllrxf.exe PID 2664 wrote to memory of 2640 2664 pvjpd.exe 7lllrxf.exe PID 2664 wrote to memory of 2640 2664 pvjpd.exe 7lllrxf.exe PID 2664 wrote to memory of 2640 2664 pvjpd.exe 7lllrxf.exe PID 2640 wrote to memory of 2116 2640 7lllrxf.exe 5pjvj.exe PID 2640 wrote to memory of 2116 2640 7lllrxf.exe 5pjvj.exe PID 2640 wrote to memory of 2116 2640 7lllrxf.exe 5pjvj.exe PID 2640 wrote to memory of 2116 2640 7lllrxf.exe 5pjvj.exe PID 2116 wrote to memory of 2112 2116 5pjvj.exe flrfxlx.exe PID 2116 wrote to memory of 2112 2116 5pjvj.exe flrfxlx.exe PID 2116 wrote to memory of 2112 2116 5pjvj.exe flrfxlx.exe PID 2116 wrote to memory of 2112 2116 5pjvj.exe flrfxlx.exe PID 2112 wrote to memory of 1200 2112 flrfxlx.exe 7xfrxxf.exe PID 2112 wrote to memory of 1200 2112 flrfxlx.exe 7xfrxxf.exe PID 2112 wrote to memory of 1200 2112 flrfxlx.exe 7xfrxxf.exe PID 2112 wrote to memory of 1200 2112 flrfxlx.exe 7xfrxxf.exe PID 1200 wrote to memory of 2020 1200 7xfrxxf.exe 1vpjj.exe PID 1200 wrote to memory of 2020 1200 7xfrxxf.exe 1vpjj.exe PID 1200 wrote to memory of 2020 1200 7xfrxxf.exe 1vpjj.exe PID 1200 wrote to memory of 2020 1200 7xfrxxf.exe 1vpjj.exe PID 2020 wrote to memory of 2992 2020 1vpjj.exe 1xlxxrl.exe PID 2020 wrote to memory of 2992 2020 1vpjj.exe 1xlxxrl.exe PID 2020 wrote to memory of 2992 2020 1vpjj.exe 1xlxxrl.exe PID 2020 wrote to memory of 2992 2020 1vpjj.exe 1xlxxrl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e486e9a4f70928a10a6a35fd90f36cfc4880f89d4ec07ca16865a62bf6d56105.exe"C:\Users\Admin\AppData\Local\Temp\e486e9a4f70928a10a6a35fd90f36cfc4880f89d4ec07ca16865a62bf6d56105.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\5jjvv.exec:\5jjvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\3pdpj.exec:\3pdpj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
\??\c:\xlrrxxf.exec:\xlrrxxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\7btbth.exec:\7btbth.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:264 -
\??\c:\vpjvd.exec:\vpjvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\xflrxrl.exec:\xflrxrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\rfrfxll.exec:\rfrfxll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\3bbtht.exec:\3bbtht.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\vvpjj.exec:\vvpjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\pvjpd.exec:\pvjpd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\7lllrxf.exec:\7lllrxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\5pjvj.exec:\5pjvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\flrfxlx.exec:\flrfxlx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\7xfrxxf.exec:\7xfrxxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
\??\c:\1vpjj.exec:\1vpjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\1xlxxrl.exec:\1xlxxrl.exe17⤵
- Executes dropped EXE
PID:2992 -
\??\c:\1ffllrx.exec:\1ffllrx.exe18⤵
- Executes dropped EXE
PID:1996 -
\??\c:\ttttbh.exec:\ttttbh.exe19⤵
- Executes dropped EXE
PID:2944 -
\??\c:\9nnnnb.exec:\9nnnnb.exe20⤵
- Executes dropped EXE
PID:1664 -
\??\c:\rxlrrfr.exec:\rxlrrfr.exe21⤵
- Executes dropped EXE
PID:1860 -
\??\c:\xllxrlf.exec:\xllxrlf.exe22⤵
- Executes dropped EXE
PID:800 -
\??\c:\3hthtn.exec:\3hthtn.exe23⤵
- Executes dropped EXE
PID:2520 -
\??\c:\7jjvv.exec:\7jjvv.exe24⤵
- Executes dropped EXE
PID:2368 -
\??\c:\flxlffx.exec:\flxlffx.exe25⤵
- Executes dropped EXE
PID:1868 -
\??\c:\ffxrlxf.exec:\ffxrlxf.exe26⤵
- Executes dropped EXE
PID:1204 -
\??\c:\hnbntn.exec:\hnbntn.exe27⤵
- Executes dropped EXE
PID:2436 -
\??\c:\jjvdj.exec:\jjvdj.exe28⤵
- Executes dropped EXE
PID:1660 -
\??\c:\lxllrxf.exec:\lxllrxf.exe29⤵
- Executes dropped EXE
PID:1368 -
\??\c:\hntthh.exec:\hntthh.exe30⤵
- Executes dropped EXE
PID:596 -
\??\c:\pdvvj.exec:\pdvvj.exe31⤵
- Executes dropped EXE
PID:2084 -
\??\c:\xlfrrfr.exec:\xlfrrfr.exe32⤵
- Executes dropped EXE
PID:556 -
\??\c:\hthntn.exec:\hthntn.exe33⤵
- Executes dropped EXE
PID:2032 -
\??\c:\1nbtnt.exec:\1nbtnt.exe34⤵
- Executes dropped EXE
PID:1724 -
\??\c:\ppjvj.exec:\ppjvj.exe35⤵
- Executes dropped EXE
PID:888 -
\??\c:\lrxxxll.exec:\lrxxxll.exe36⤵
- Executes dropped EXE
PID:2548 -
\??\c:\5llxlxr.exec:\5llxlxr.exe37⤵
- Executes dropped EXE
PID:2300 -
\??\c:\bnhnbh.exec:\bnhnbh.exe38⤵
- Executes dropped EXE
PID:2164 -
\??\c:\nbbbtb.exec:\nbbbtb.exe39⤵
- Executes dropped EXE
PID:2204 -
\??\c:\ppjvp.exec:\ppjvp.exe40⤵
- Executes dropped EXE
PID:1748 -
\??\c:\7rlrxxr.exec:\7rlrxxr.exe41⤵
- Executes dropped EXE
PID:264 -
\??\c:\ffflxxx.exec:\ffflxxx.exe42⤵
- Executes dropped EXE
PID:2724 -
\??\c:\nbbbbn.exec:\nbbbbn.exe43⤵
- Executes dropped EXE
PID:2764 -
\??\c:\1ppvp.exec:\1ppvp.exe44⤵
- Executes dropped EXE
PID:2900 -
\??\c:\lllrllf.exec:\lllrllf.exe45⤵
- Executes dropped EXE
PID:2916 -
\??\c:\rlfxxlr.exec:\rlfxxlr.exe46⤵
- Executes dropped EXE
PID:2776 -
\??\c:\bhthnt.exec:\bhthnt.exe47⤵
- Executes dropped EXE
PID:1576 -
\??\c:\ppvjj.exec:\ppvjj.exe48⤵
- Executes dropped EXE
PID:2804 -
\??\c:\5ddpj.exec:\5ddpj.exe49⤵
- Executes dropped EXE
PID:3036 -
\??\c:\lfrfxrl.exec:\lfrfxrl.exe50⤵
- Executes dropped EXE
PID:2628 -
\??\c:\htnhhb.exec:\htnhhb.exe51⤵
- Executes dropped EXE
PID:2800 -
\??\c:\tthhhb.exec:\tthhhb.exe52⤵
- Executes dropped EXE
PID:2876 -
\??\c:\ddpjv.exec:\ddpjv.exe53⤵
- Executes dropped EXE
PID:2160 -
\??\c:\jvjjp.exec:\jvjjp.exe54⤵
- Executes dropped EXE
PID:2476 -
\??\c:\rlrllxx.exec:\rlrllxx.exe55⤵
- Executes dropped EXE
PID:1028 -
\??\c:\hhtbhn.exec:\hhtbhn.exe56⤵
- Executes dropped EXE
PID:2868 -
\??\c:\nhtbtb.exec:\nhtbtb.exe57⤵
- Executes dropped EXE
PID:1200 -
\??\c:\vpdpd.exec:\vpdpd.exe58⤵
- Executes dropped EXE
PID:1484 -
\??\c:\rfrxllr.exec:\rfrxllr.exe59⤵
- Executes dropped EXE
PID:1776 -
\??\c:\1bbtnt.exec:\1bbtnt.exe60⤵
- Executes dropped EXE
PID:2992 -
\??\c:\nhtbnt.exec:\nhtbnt.exe61⤵
- Executes dropped EXE
PID:2828 -
\??\c:\btnbnb.exec:\btnbnb.exe62⤵
- Executes dropped EXE
PID:2980 -
\??\c:\vvppp.exec:\vvppp.exe63⤵
- Executes dropped EXE
PID:2944 -
\??\c:\xrrrxxx.exec:\xrrrxxx.exe64⤵
- Executes dropped EXE
PID:768 -
\??\c:\fxxfrrx.exec:\fxxfrrx.exe65⤵
- Executes dropped EXE
PID:1416 -
\??\c:\ntnthn.exec:\ntnthn.exe66⤵PID:2016
-
\??\c:\1vpvp.exec:\1vpvp.exe67⤵PID:800
-
\??\c:\3pjjv.exec:\3pjjv.exe68⤵PID:2200
-
\??\c:\rfrlfrr.exec:\rfrlfrr.exe69⤵PID:2344
-
\??\c:\ntnnbt.exec:\ntnnbt.exe70⤵PID:2356
-
\??\c:\9vpdj.exec:\9vpdj.exe71⤵PID:996
-
\??\c:\1vjdv.exec:\1vjdv.exe72⤵PID:708
-
\??\c:\pppdv.exec:\pppdv.exe73⤵PID:316
-
\??\c:\xlrrfxx.exec:\xlrrfxx.exe74⤵PID:236
-
\??\c:\htthbn.exec:\htthbn.exe75⤵PID:1528
-
\??\c:\5tnnbh.exec:\5tnnbh.exe76⤵PID:1644
-
\??\c:\1jjdp.exec:\1jjdp.exe77⤵PID:1468
-
\??\c:\pjddd.exec:\pjddd.exe78⤵PID:1524
-
\??\c:\xxlrfrf.exec:\xxlrfrf.exe79⤵PID:2376
-
\??\c:\lrrrfll.exec:\lrrrfll.exe80⤵PID:1360
-
\??\c:\nhbttt.exec:\nhbttt.exe81⤵
- System Location Discovery: System Language Discovery
PID:592 -
\??\c:\pdddv.exec:\pdddv.exe82⤵PID:1892
-
\??\c:\3jjvp.exec:\3jjvp.exe83⤵PID:1724
-
\??\c:\1lrlllf.exec:\1lrlllf.exe84⤵PID:2292
-
\??\c:\xrxrxxl.exec:\xrxrxxl.exe85⤵PID:2548
-
\??\c:\bnhbtb.exec:\bnhbtb.exe86⤵PID:2552
-
\??\c:\1nnhht.exec:\1nnhht.exe87⤵PID:2164
-
\??\c:\vjpvj.exec:\vjpvj.exe88⤵PID:1884
-
\??\c:\xffrxxf.exec:\xffrxxf.exe89⤵PID:1812
-
\??\c:\flrxlxx.exec:\flrxlxx.exe90⤵PID:264
-
\??\c:\hhhhbh.exec:\hhhhbh.exe91⤵PID:2252
-
\??\c:\nhnhbn.exec:\nhnhbn.exe92⤵PID:2500
-
\??\c:\nnbhht.exec:\nnbhht.exe93⤵PID:2744
-
\??\c:\9jjpd.exec:\9jjpd.exe94⤵PID:2772
-
\??\c:\fflxxff.exec:\fflxxff.exe95⤵PID:2888
-
\??\c:\xxflrfx.exec:\xxflrfx.exe96⤵
- System Location Discovery: System Language Discovery
PID:1720 -
\??\c:\7tthth.exec:\7tthth.exe97⤵PID:3000
-
\??\c:\bhhtnb.exec:\bhhtnb.exe98⤵PID:2660
-
\??\c:\jvjpp.exec:\jvjpp.exe99⤵PID:2968
-
\??\c:\9dddp.exec:\9dddp.exe100⤵PID:2684
-
\??\c:\llrflrf.exec:\llrflrf.exe101⤵PID:2796
-
\??\c:\9lxrfff.exec:\9lxrfff.exe102⤵PID:2932
-
\??\c:\3tnnnt.exec:\3tnnnt.exe103⤵PID:2116
-
\??\c:\nbtnnh.exec:\nbtnnh.exe104⤵PID:840
-
\??\c:\rxxlfll.exec:\rxxlfll.exe105⤵PID:2028
-
\??\c:\1xrfrfr.exec:\1xrfrfr.exe106⤵PID:1200
-
\??\c:\bhttth.exec:\bhttth.exe107⤵PID:576
-
\??\c:\jdpjv.exec:\jdpjv.exe108⤵PID:2352
-
\??\c:\ppdvv.exec:\ppdvv.exe109⤵PID:2848
-
\??\c:\xxlfrrf.exec:\xxlfrrf.exe110⤵PID:2836
-
\??\c:\5frffxr.exec:\5frffxr.exe111⤵PID:2212
-
\??\c:\ntbhnn.exec:\ntbhnn.exe112⤵PID:1864
-
\??\c:\dpjdp.exec:\dpjdp.exe113⤵PID:2000
-
\??\c:\5vdjp.exec:\5vdjp.exe114⤵PID:2132
-
\??\c:\fxxflrl.exec:\fxxflrl.exe115⤵PID:2172
-
\??\c:\tthbth.exec:\tthbth.exe116⤵PID:1912
-
\??\c:\bttthn.exec:\bttthn.exe117⤵PID:2508
-
\??\c:\3jddd.exec:\3jddd.exe118⤵PID:2372
-
\??\c:\1vdvj.exec:\1vdvj.exe119⤵PID:2344
-
\??\c:\lllfllx.exec:\lllfllx.exe120⤵PID:1136
-
\??\c:\tbnhnt.exec:\tbnhnt.exe121⤵PID:1144
-
\??\c:\nntbhh.exec:\nntbhh.exe122⤵PID:1696
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-