Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 19:39
Behavioral task
behavioral1
Sample
0caee27f352a68f9eaaea874441415300bf888984803f0a65117db25cac4c181.exe
Resource
win7-20241023-en
General
-
Target
0caee27f352a68f9eaaea874441415300bf888984803f0a65117db25cac4c181.exe
-
Size
331KB
-
MD5
0338c99c86b68b6963301fb49170f14c
-
SHA1
a18f6c295f1aeb0c77bb5439d6c4a954fd73957e
-
SHA256
0caee27f352a68f9eaaea874441415300bf888984803f0a65117db25cac4c181
-
SHA512
13a1732b6fe58436abff3366cb369686f37150ffd3c0749a788376c2c6a29860c9217c4bda2cde90ccd4a8c85e6d2c966f808a219b84e9ea300ff6abfb3b0641
-
SSDEEP
6144:vcm4FmowdHoStJdJIjaRleL42bL37BoTPkhu9gX5yGsTshQc8R0nxA5ij8+RC7tI:94wFHoStJdSjylh2b77BoTMA9gX59sTg
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 35 IoCs
Processes:
resource yara_rule behavioral1/memory/3064-1-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2324-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/648-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2712-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2912-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2840-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2056-121-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2084-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2988-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2764-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1644-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1636-150-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1052-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2944-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2260-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2884-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2232-22-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1284-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1060-213-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2692-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2640-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/552-247-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2460-259-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1880-265-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3052-271-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2104-277-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2964-318-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2732-344-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2492-397-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1636-409-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2800-452-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2908-709-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2932-847-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2504-994-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2628-1235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
xrfflfl.exe484284.exevvpdj.exe826802.exe024806.exerrxrlfl.exedvjjj.exehhhtnh.exebtbhnb.exe622446.exe2088846.exe5xlfrxf.exe7vpdj.exepvppj.exe0482600.exetthtbn.exe666044.exelrlllxf.exe046862.exetbbhhn.exe820684.exe888086.exebhhbbb.exetbnhnb.exe448646.exehbntbb.exethtnnn.exevjpvv.exevppjj.exe9frrfrx.exe42600.exevdvvv.exebnhthn.exe608468.exe2206824.exedpjvj.exefxrfrxl.exe42066.exe1jppd.exe260628.exea0622.exe1vpvd.exe602800.exe1lrflxl.exe486228.exee64424.exejvvpj.exeppjdj.exeflrrrxl.exetnhnhh.exe62820.exe0408246.exe86648.exepdvjp.exew60240.exe62680.exe1xrfffr.exedjpvj.exe0486480.exe9ddvj.exexrfrxrf.exebbhtnb.exe7thhtt.exefxfffrx.exepid process 2260 xrfflfl.exe 2232 484284.exe 2324 vvpdj.exe 648 826802.exe 2884 024806.exe 2844 rrxrlfl.exe 2944 dvjjj.exe 2712 hhhtnh.exe 2912 btbhnb.exe 2840 622446.exe 2876 2088846.exe 2756 5xlfrxf.exe 2128 7vpdj.exe 2084 pvppj.exe 2056 0482600.exe 2428 tthtbn.exe 1052 666044.exe 1636 lrlllxf.exe 1816 046862.exe 1928 tbbhhn.exe 1644 820684.exe 2764 888086.exe 2988 bhhbbb.exe 1284 tbnhnb.exe 2692 448646.exe 1060 hbntbb.exe 2640 thtnnn.exe 1924 vjpvv.exe 2484 vppjj.exe 1552 9frrfrx.exe 552 42600.exe 2460 vdvvv.exe 1880 bnhthn.exe 3052 608468.exe 2104 2206824.exe 2052 dpjvj.exe 2144 fxrfrxl.exe 1624 42066.exe 2616 1jppd.exe 2224 260628.exe 588 a0622.exe 2168 1vpvd.exe 2860 602800.exe 2964 1lrflxl.exe 2928 486228.exe 2396 e64424.exe 2916 jvvpj.exe 2732 ppjdj.exe 2284 flrrrxl.exe 2700 tnhnhh.exe 2632 62820.exe 2740 0408246.exe 2368 86648.exe 1696 pdvjp.exe 2084 w60240.exe 1452 62680.exe 1824 1xrfffr.exe 2492 djpvj.exe 1712 0486480.exe 1636 9ddvj.exe 640 xrfrxrf.exe 2404 bbhtnb.exe 1336 7thhtt.exe 1996 fxfffrx.exe -
Processes:
resource yara_rule behavioral1/memory/3064-1-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrfflfl.exe upx behavioral1/memory/2260-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2232-17-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\484284.exe upx behavioral1/memory/2324-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/648-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/648-39-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\dvjjj.exe upx behavioral1/memory/2712-67-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\btbhnb.exe upx behavioral1/memory/2912-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2840-83-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\622446.exe upx C:\2088846.exe upx \??\c:\5xlfrxf.exe upx \??\c:\7vpdj.exe upx behavioral1/memory/2084-112-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2056-121-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\0482600.exe upx behavioral1/memory/2084-118-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pvppj.exe upx \??\c:\tthtbn.exe upx C:\lrlllxf.exe upx behavioral1/memory/1636-144-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\tbbhhn.exe upx \??\c:\888086.exe upx behavioral1/memory/2988-183-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\bhhbbb.exe upx behavioral1/memory/2764-176-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1644-167-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\820684.exe upx C:\tbnhnb.exe upx \??\c:\046862.exe upx behavioral1/memory/1636-150-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1052-136-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\666044.exe upx behavioral1/memory/2944-60-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\hhhtnh.exe upx \??\c:\rrxrlfl.exe upx behavioral1/memory/2260-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2884-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2884-42-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\024806.exe upx \??\c:\826802.exe upx \??\c:\vvpdj.exe upx behavioral1/memory/2232-22-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\448646.exe upx behavioral1/memory/1284-196-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\thtnnn.exe upx \??\c:\hbntbb.exe upx behavioral1/memory/1060-206-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2692-204-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vjpvv.exe upx C:\vppjj.exe upx \??\c:\9frrfrx.exe upx behavioral1/memory/2640-237-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1552-236-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/552-247-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\42600.exe upx C:\vdvvv.exe upx behavioral1/memory/2460-259-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1880-265-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3052-271-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
2446804.exeppjdv.exe264468.exew60640.exe6608280.exes0842.exe228848.exehbthth.exe7pvvj.exethtnnn.exetthnbb.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2446804.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 264468.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language w60640.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6608280.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language s0842.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 228848.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbthth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0caee27f352a68f9eaaea874441415300bf888984803f0a65117db25cac4c181.exexrfflfl.exe484284.exevvpdj.exe826802.exe024806.exerrxrlfl.exedvjjj.exehhhtnh.exebtbhnb.exe622446.exe2088846.exe5xlfrxf.exe7vpdj.exepvppj.exe0482600.exedescription pid process target process PID 3064 wrote to memory of 2260 3064 0caee27f352a68f9eaaea874441415300bf888984803f0a65117db25cac4c181.exe xrfflfl.exe PID 3064 wrote to memory of 2260 3064 0caee27f352a68f9eaaea874441415300bf888984803f0a65117db25cac4c181.exe xrfflfl.exe PID 3064 wrote to memory of 2260 3064 0caee27f352a68f9eaaea874441415300bf888984803f0a65117db25cac4c181.exe xrfflfl.exe PID 3064 wrote to memory of 2260 3064 0caee27f352a68f9eaaea874441415300bf888984803f0a65117db25cac4c181.exe xrfflfl.exe PID 2260 wrote to memory of 2232 2260 xrfflfl.exe 484284.exe PID 2260 wrote to memory of 2232 2260 xrfflfl.exe 484284.exe PID 2260 wrote to memory of 2232 2260 xrfflfl.exe 484284.exe PID 2260 wrote to memory of 2232 2260 xrfflfl.exe 484284.exe PID 2232 wrote to memory of 2324 2232 484284.exe vvpdj.exe PID 2232 wrote to memory of 2324 2232 484284.exe vvpdj.exe PID 2232 wrote to memory of 2324 2232 484284.exe vvpdj.exe PID 2232 wrote to memory of 2324 2232 484284.exe vvpdj.exe PID 2324 wrote to memory of 648 2324 vvpdj.exe 826802.exe PID 2324 wrote to memory of 648 2324 vvpdj.exe 826802.exe PID 2324 wrote to memory of 648 2324 vvpdj.exe 826802.exe PID 2324 wrote to memory of 648 2324 vvpdj.exe 826802.exe PID 648 wrote to memory of 2884 648 826802.exe 024806.exe PID 648 wrote to memory of 2884 648 826802.exe 024806.exe PID 648 wrote to memory of 2884 648 826802.exe 024806.exe PID 648 wrote to memory of 2884 648 826802.exe 024806.exe PID 2884 wrote to memory of 2844 2884 024806.exe rrxrlfl.exe PID 2884 wrote to memory of 2844 2884 024806.exe rrxrlfl.exe PID 2884 wrote to memory of 2844 2884 024806.exe rrxrlfl.exe PID 2884 wrote to memory of 2844 2884 024806.exe rrxrlfl.exe PID 2844 wrote to memory of 2944 2844 rrxrlfl.exe dvjjj.exe PID 2844 wrote to memory of 2944 2844 rrxrlfl.exe dvjjj.exe PID 2844 wrote to memory of 2944 2844 rrxrlfl.exe dvjjj.exe PID 2844 wrote to memory of 2944 2844 rrxrlfl.exe dvjjj.exe PID 2944 wrote to memory of 2712 2944 dvjjj.exe hhhtnh.exe PID 2944 wrote to memory of 2712 2944 dvjjj.exe hhhtnh.exe PID 2944 wrote to memory of 2712 2944 dvjjj.exe hhhtnh.exe PID 2944 wrote to memory of 2712 2944 dvjjj.exe hhhtnh.exe PID 2712 wrote to memory of 2912 2712 hhhtnh.exe btbhnb.exe PID 2712 wrote to memory of 2912 2712 hhhtnh.exe btbhnb.exe PID 2712 wrote to memory of 2912 2712 hhhtnh.exe btbhnb.exe PID 2712 wrote to memory of 2912 2712 hhhtnh.exe btbhnb.exe PID 2912 wrote to memory of 2840 2912 btbhnb.exe 622446.exe PID 2912 wrote to memory of 2840 2912 btbhnb.exe 622446.exe PID 2912 wrote to memory of 2840 2912 btbhnb.exe 622446.exe PID 2912 wrote to memory of 2840 2912 btbhnb.exe 622446.exe PID 2840 wrote to memory of 2876 2840 622446.exe 2088846.exe PID 2840 wrote to memory of 2876 2840 622446.exe 2088846.exe PID 2840 wrote to memory of 2876 2840 622446.exe 2088846.exe PID 2840 wrote to memory of 2876 2840 622446.exe 2088846.exe PID 2876 wrote to memory of 2756 2876 2088846.exe 5xlfrxf.exe PID 2876 wrote to memory of 2756 2876 2088846.exe 5xlfrxf.exe PID 2876 wrote to memory of 2756 2876 2088846.exe 5xlfrxf.exe PID 2876 wrote to memory of 2756 2876 2088846.exe 5xlfrxf.exe PID 2756 wrote to memory of 2128 2756 5xlfrxf.exe 7vpdj.exe PID 2756 wrote to memory of 2128 2756 5xlfrxf.exe 7vpdj.exe PID 2756 wrote to memory of 2128 2756 5xlfrxf.exe 7vpdj.exe PID 2756 wrote to memory of 2128 2756 5xlfrxf.exe 7vpdj.exe PID 2128 wrote to memory of 2084 2128 7vpdj.exe pvppj.exe PID 2128 wrote to memory of 2084 2128 7vpdj.exe pvppj.exe PID 2128 wrote to memory of 2084 2128 7vpdj.exe pvppj.exe PID 2128 wrote to memory of 2084 2128 7vpdj.exe pvppj.exe PID 2084 wrote to memory of 2056 2084 pvppj.exe 0482600.exe PID 2084 wrote to memory of 2056 2084 pvppj.exe 0482600.exe PID 2084 wrote to memory of 2056 2084 pvppj.exe 0482600.exe PID 2084 wrote to memory of 2056 2084 pvppj.exe 0482600.exe PID 2056 wrote to memory of 2428 2056 0482600.exe tthtbn.exe PID 2056 wrote to memory of 2428 2056 0482600.exe tthtbn.exe PID 2056 wrote to memory of 2428 2056 0482600.exe tthtbn.exe PID 2056 wrote to memory of 2428 2056 0482600.exe tthtbn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0caee27f352a68f9eaaea874441415300bf888984803f0a65117db25cac4c181.exe"C:\Users\Admin\AppData\Local\Temp\0caee27f352a68f9eaaea874441415300bf888984803f0a65117db25cac4c181.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\xrfflfl.exec:\xrfflfl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\484284.exec:\484284.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\vvpdj.exec:\vvpdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\826802.exec:\826802.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:648 -
\??\c:\024806.exec:\024806.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\rrxrlfl.exec:\rrxrlfl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\dvjjj.exec:\dvjjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\hhhtnh.exec:\hhhtnh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\btbhnb.exec:\btbhnb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\622446.exec:\622446.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\2088846.exec:\2088846.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\5xlfrxf.exec:\5xlfrxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\7vpdj.exec:\7vpdj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\pvppj.exec:\pvppj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\0482600.exec:\0482600.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\tthtbn.exec:\tthtbn.exe17⤵
- Executes dropped EXE
PID:2428 -
\??\c:\666044.exec:\666044.exe18⤵
- Executes dropped EXE
PID:1052 -
\??\c:\lrlllxf.exec:\lrlllxf.exe19⤵
- Executes dropped EXE
PID:1636 -
\??\c:\046862.exec:\046862.exe20⤵
- Executes dropped EXE
PID:1816 -
\??\c:\tbbhhn.exec:\tbbhhn.exe21⤵
- Executes dropped EXE
PID:1928 -
\??\c:\820684.exec:\820684.exe22⤵
- Executes dropped EXE
PID:1644 -
\??\c:\888086.exec:\888086.exe23⤵
- Executes dropped EXE
PID:2764 -
\??\c:\bhhbbb.exec:\bhhbbb.exe24⤵
- Executes dropped EXE
PID:2988 -
\??\c:\tbnhnb.exec:\tbnhnb.exe25⤵
- Executes dropped EXE
PID:1284 -
\??\c:\448646.exec:\448646.exe26⤵
- Executes dropped EXE
PID:2692 -
\??\c:\hbntbb.exec:\hbntbb.exe27⤵
- Executes dropped EXE
PID:1060 -
\??\c:\thtnnn.exec:\thtnnn.exe28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2640 -
\??\c:\vjpvv.exec:\vjpvv.exe29⤵
- Executes dropped EXE
PID:1924 -
\??\c:\vppjj.exec:\vppjj.exe30⤵
- Executes dropped EXE
PID:2484 -
\??\c:\9frrfrx.exec:\9frrfrx.exe31⤵
- Executes dropped EXE
PID:1552 -
\??\c:\42600.exec:\42600.exe32⤵
- Executes dropped EXE
PID:552 -
\??\c:\vdvvv.exec:\vdvvv.exe33⤵
- Executes dropped EXE
PID:2460 -
\??\c:\bnhthn.exec:\bnhthn.exe34⤵
- Executes dropped EXE
PID:1880 -
\??\c:\608468.exec:\608468.exe35⤵
- Executes dropped EXE
PID:3052 -
\??\c:\2206824.exec:\2206824.exe36⤵
- Executes dropped EXE
PID:2104 -
\??\c:\dpjvj.exec:\dpjvj.exe37⤵
- Executes dropped EXE
PID:2052 -
\??\c:\fxrfrxl.exec:\fxrfrxl.exe38⤵
- Executes dropped EXE
PID:2144 -
\??\c:\42066.exec:\42066.exe39⤵
- Executes dropped EXE
PID:1624 -
\??\c:\1jppd.exec:\1jppd.exe40⤵
- Executes dropped EXE
PID:2616 -
\??\c:\260628.exec:\260628.exe41⤵
- Executes dropped EXE
PID:2224 -
\??\c:\a0622.exec:\a0622.exe42⤵
- Executes dropped EXE
PID:588 -
\??\c:\1vpvd.exec:\1vpvd.exe43⤵
- Executes dropped EXE
PID:2168 -
\??\c:\602800.exec:\602800.exe44⤵
- Executes dropped EXE
PID:2860 -
\??\c:\1lrflxl.exec:\1lrflxl.exe45⤵
- Executes dropped EXE
PID:2964 -
\??\c:\486228.exec:\486228.exe46⤵
- Executes dropped EXE
PID:2928 -
\??\c:\e64424.exec:\e64424.exe47⤵
- Executes dropped EXE
PID:2396 -
\??\c:\jvvpj.exec:\jvvpj.exe48⤵
- Executes dropped EXE
PID:2916 -
\??\c:\ppjdj.exec:\ppjdj.exe49⤵
- Executes dropped EXE
PID:2732 -
\??\c:\flrrrxl.exec:\flrrrxl.exe50⤵
- Executes dropped EXE
PID:2284 -
\??\c:\tnhnhh.exec:\tnhnhh.exe51⤵
- Executes dropped EXE
PID:2700 -
\??\c:\62820.exec:\62820.exe52⤵
- Executes dropped EXE
PID:2632 -
\??\c:\0408246.exec:\0408246.exe53⤵
- Executes dropped EXE
PID:2740 -
\??\c:\86648.exec:\86648.exe54⤵
- Executes dropped EXE
PID:2368 -
\??\c:\pdvjp.exec:\pdvjp.exe55⤵
- Executes dropped EXE
PID:1696 -
\??\c:\w60240.exec:\w60240.exe56⤵
- Executes dropped EXE
PID:2084 -
\??\c:\62680.exec:\62680.exe57⤵
- Executes dropped EXE
PID:1452 -
\??\c:\1xrfffr.exec:\1xrfffr.exe58⤵
- Executes dropped EXE
PID:1824 -
\??\c:\djpvj.exec:\djpvj.exe59⤵
- Executes dropped EXE
PID:2492 -
\??\c:\0486480.exec:\0486480.exe60⤵
- Executes dropped EXE
PID:1712 -
\??\c:\9ddvj.exec:\9ddvj.exe61⤵
- Executes dropped EXE
PID:1636 -
\??\c:\xrfrxrf.exec:\xrfrxrf.exe62⤵
- Executes dropped EXE
PID:640 -
\??\c:\bbhtnb.exec:\bbhtnb.exe63⤵
- Executes dropped EXE
PID:2404 -
\??\c:\7thhtt.exec:\7thhtt.exe64⤵
- Executes dropped EXE
PID:1336 -
\??\c:\fxfffrx.exec:\fxfffrx.exe65⤵
- Executes dropped EXE
PID:1996 -
\??\c:\00840.exec:\00840.exe66⤵PID:1348
-
\??\c:\1tthnn.exec:\1tthnn.exe67⤵PID:1172
-
\??\c:\hnhthh.exec:\hnhthh.exe68⤵PID:2016
-
\??\c:\22624.exec:\22624.exe69⤵PID:2800
-
\??\c:\3dvjj.exec:\3dvjj.exe70⤵PID:2256
-
\??\c:\7dpjp.exec:\7dpjp.exe71⤵PID:2288
-
\??\c:\622046.exec:\622046.exe72⤵PID:1060
-
\??\c:\vjjvd.exec:\vjjvd.exe73⤵PID:1036
-
\??\c:\vpdpd.exec:\vpdpd.exe74⤵PID:1040
-
\??\c:\vddpp.exec:\vddpp.exe75⤵PID:2640
-
\??\c:\822862.exec:\822862.exe76⤵PID:1924
-
\??\c:\g4224.exec:\g4224.exe77⤵PID:716
-
\??\c:\i048448.exec:\i048448.exe78⤵PID:2688
-
\??\c:\48068.exec:\48068.exe79⤵PID:1496
-
\??\c:\6006468.exec:\6006468.exe80⤵PID:2344
-
\??\c:\828028.exec:\828028.exe81⤵PID:604
-
\??\c:\648406.exec:\648406.exe82⤵PID:1628
-
\??\c:\8206808.exec:\8206808.exe83⤵PID:892
-
\??\c:\428806.exec:\428806.exe84⤵PID:3064
-
\??\c:\848466.exec:\848466.exe85⤵PID:2104
-
\??\c:\24486.exec:\24486.exe86⤵PID:1588
-
\??\c:\0442026.exec:\0442026.exe87⤵PID:2440
-
\??\c:\a6020.exec:\a6020.exe88⤵PID:2308
-
\??\c:\jjdvj.exec:\jjdvj.exe89⤵PID:2500
-
\??\c:\ttnbbt.exec:\ttnbbt.exe90⤵PID:588
-
\??\c:\6840842.exec:\6840842.exe91⤵PID:2808
-
\??\c:\pdppp.exec:\pdppp.exe92⤵PID:2964
-
\??\c:\4802402.exec:\4802402.exe93⤵PID:3024
-
\??\c:\lfxlrfl.exec:\lfxlrfl.exe94⤵PID:2396
-
\??\c:\48246.exec:\48246.exe95⤵PID:2880
-
\??\c:\u888844.exec:\u888844.exe96⤵PID:2812
-
\??\c:\60408.exec:\60408.exe97⤵PID:536
-
\??\c:\8246024.exec:\8246024.exe98⤵PID:2768
-
\??\c:\pjvdv.exec:\pjvdv.exe99⤵PID:2952
-
\??\c:\lllxrlx.exec:\lllxrlx.exe100⤵PID:2856
-
\??\c:\hbbthh.exec:\hbbthh.exe101⤵PID:2752
-
\??\c:\66426.exec:\66426.exe102⤵PID:1332
-
\??\c:\tthnhh.exec:\tthnhh.exe103⤵PID:1984
-
\??\c:\4428660.exec:\4428660.exe104⤵PID:2420
-
\??\c:\9fxllrl.exec:\9fxllrl.exe105⤵PID:1668
-
\??\c:\rfllrfr.exec:\rfllrfr.exe106⤵PID:2068
-
\??\c:\062664.exec:\062664.exe107⤵PID:1712
-
\??\c:\tnhnhn.exec:\tnhnhn.exe108⤵PID:1208
-
\??\c:\1bbtbh.exec:\1bbtbh.exe109⤵PID:1956
-
\??\c:\xrxxlrf.exec:\xrxxlrf.exe110⤵PID:2012
-
\??\c:\840288.exec:\840288.exe111⤵PID:1292
-
\??\c:\4480802.exec:\4480802.exe112⤵PID:2764
-
\??\c:\vvpvp.exec:\vvpvp.exe113⤵PID:804
-
\??\c:\5bntbh.exec:\5bntbh.exe114⤵PID:2416
-
\??\c:\26402.exec:\26402.exe115⤵PID:852
-
\??\c:\260886.exec:\260886.exe116⤵PID:2188
-
\??\c:\6822446.exec:\6822446.exe117⤵PID:2908
-
\??\c:\xxxlfxl.exec:\xxxlfxl.exe118⤵PID:2992
-
\??\c:\ddvdp.exec:\ddvdp.exe119⤵PID:684
-
\??\c:\6442442.exec:\6442442.exe120⤵PID:2044
-
\??\c:\fxrxlxf.exec:\fxrxlxf.exe121⤵PID:2804
-
\??\c:\4662080.exec:\4662080.exe122⤵PID:268
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-