Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-11-2024 05:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f503baa8d038a0e3f50857a860b9991e799bec6f245916ec7d7da46c63a18145.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
f503baa8d038a0e3f50857a860b9991e799bec6f245916ec7d7da46c63a18145.exe
-
Size
347KB
-
MD5
f93203be77bac24876c9f4c8728185ef
-
SHA1
1b09931ba39a455617d851b90ecfc41ca7161e7d
-
SHA256
f503baa8d038a0e3f50857a860b9991e799bec6f245916ec7d7da46c63a18145
-
SHA512
53d3a4096dad3107db699ee0cd9982d1fe28af0dad10a73728cd0fb55e72633e231cb7e1a00a16ddbd99183e552bf43283dc5f7ef6ca0c91077be53bb23580b4
-
SSDEEP
6144:Xcm7ImGddXgYW5fNZWB5hFfci3Add4kGYAn:l7TcbWXZshJX2VGdn
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/2788-1-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2812-11-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2688-22-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2732-31-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2528-42-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2732-36-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/3044-65-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1640-75-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1544-84-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2856-94-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1632-104-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1332-112-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/344-122-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2292-141-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2756-151-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/3052-168-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/764-177-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2532-202-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1076-211-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1808-236-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2160-254-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2320-281-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2564-310-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2892-330-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2724-344-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1340-388-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2032-395-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/584-420-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/848-456-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/848-455-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/404-470-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/404-469-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1596-565-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2824-578-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/3004-615-0x0000000000230000-0x0000000000258000-memory.dmp family_blackmoon behavioral1/memory/2736-640-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1376-790-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1952-803-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2612-873-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2112-1001-0x00000000003B0000-0x00000000003D8000-memory.dmp family_blackmoon behavioral1/memory/2112-1020-0x00000000003B0000-0x00000000003D8000-memory.dmp family_blackmoon behavioral1/memory/1236-1161-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2864-1170-0x00000000001B0000-0x00000000001D8000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2812 xfffxff.exe 2688 bthhbn.exe 2732 xxxlxlr.exe 2528 tbhbhb.exe 2588 dvdpv.exe 3044 1fxrfrf.exe 1640 pvddj.exe 1544 1bthtt.exe 2856 vvppd.exe 1632 ffrlrlr.exe 1332 ttnbth.exe 344 5rxlfrf.exe 1820 vvvjj.exe 2292 7xxfrfr.exe 2756 bbbthn.exe 2936 7rlxlrx.exe 3052 9bbnbh.exe 764 bbnbth.exe 652 jppjd.exe 2088 hnnttb.exe 2532 tnbbbh.exe 1076 3xxlflr.exe 2232 fflrlrl.exe 1472 ddjvv.exe 1808 xfxfrfx.exe 1624 jjdjd.exe 2160 dddpj.exe 1232 7nhtbb.exe 1968 jjpjd.exe 2320 bhthbh.exe 2904 9jjvd.exe 2920 rrlxrxl.exe 2708 vpppj.exe 2564 vvjpd.exe 2852 rxffrrf.exe 2580 nnbnbt.exe 2892 jjvjv.exe 2572 rxrllrf.exe 2724 nnnnhn.exe 2840 5jdjd.exe 1800 9dvjd.exe 2044 7xxlxfr.exe 2776 hhbtnh.exe 2900 ppvpd.exe 2856 dvppd.exe 1340 3frlxrl.exe 112 hhnhnh.exe 2032 ddjvj.exe 1880 rffxfrr.exe 1120 hbhbtt.exe 584 dvpdj.exe 1168 ddvvj.exe 1140 3xrfrxf.exe 2208 nbhttn.exe 2248 pdpdv.exe 848 3fxxrfr.exe 764 5bbtnh.exe 404 vvvpd.exe 2088 xrflxlr.exe 1924 tttnhb.exe 696 5tttht.exe 928 jjjpv.exe 2232 xlxllxx.exe 1856 nntthb.exe -
resource yara_rule behavioral1/memory/2788-1-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2812-11-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2688-22-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2732-31-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2528-42-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/3044-57-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/3044-65-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1544-76-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1640-75-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1544-84-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2856-94-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1632-104-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1332-112-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/344-122-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2292-132-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2292-141-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2756-143-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2936-153-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2756-151-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/3052-168-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/764-177-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2532-202-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1076-211-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1808-236-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2160-254-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2320-281-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2564-310-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2892-330-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2724-344-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1340-388-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2032-395-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/584-420-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2208-433-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/848-456-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/928-489-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1596-565-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2824-578-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2168-718-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/812-771-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1376-790-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1952-803-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/3068-840-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/3020-853-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/3044-880-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1148-942-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2544-955-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2692-1122-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2668-1129-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2588-1142-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1484-1194-0x0000000000400000-0x0000000000428000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9djjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xrrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bbnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrfrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nbhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlfxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfxlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxffllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrfflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlrlxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrfxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2788 wrote to memory of 2812 2788 f503baa8d038a0e3f50857a860b9991e799bec6f245916ec7d7da46c63a18145.exe 31 PID 2788 wrote to memory of 2812 2788 f503baa8d038a0e3f50857a860b9991e799bec6f245916ec7d7da46c63a18145.exe 31 PID 2788 wrote to memory of 2812 2788 f503baa8d038a0e3f50857a860b9991e799bec6f245916ec7d7da46c63a18145.exe 31 PID 2788 wrote to memory of 2812 2788 f503baa8d038a0e3f50857a860b9991e799bec6f245916ec7d7da46c63a18145.exe 31 PID 2812 wrote to memory of 2688 2812 xfffxff.exe 32 PID 2812 wrote to memory of 2688 2812 xfffxff.exe 32 PID 2812 wrote to memory of 2688 2812 xfffxff.exe 32 PID 2812 wrote to memory of 2688 2812 xfffxff.exe 32 PID 2688 wrote to memory of 2732 2688 bthhbn.exe 33 PID 2688 wrote to memory of 2732 2688 bthhbn.exe 33 PID 2688 wrote to memory of 2732 2688 bthhbn.exe 33 PID 2688 wrote to memory of 2732 2688 bthhbn.exe 33 PID 2732 wrote to memory of 2528 2732 xxxlxlr.exe 34 PID 2732 wrote to memory of 2528 2732 xxxlxlr.exe 34 PID 2732 wrote to memory of 2528 2732 xxxlxlr.exe 34 PID 2732 wrote to memory of 2528 2732 xxxlxlr.exe 34 PID 2528 wrote to memory of 2588 2528 tbhbhb.exe 35 PID 2528 wrote to memory of 2588 2528 tbhbhb.exe 35 PID 2528 wrote to memory of 2588 2528 tbhbhb.exe 35 PID 2528 wrote to memory of 2588 2528 tbhbhb.exe 35 PID 2588 wrote to memory of 3044 2588 dvdpv.exe 36 PID 2588 wrote to memory of 3044 2588 dvdpv.exe 36 PID 2588 wrote to memory of 3044 2588 dvdpv.exe 36 PID 2588 wrote to memory of 3044 2588 dvdpv.exe 36 PID 3044 wrote to memory of 1640 3044 1fxrfrf.exe 37 PID 3044 wrote to memory of 1640 3044 1fxrfrf.exe 37 PID 3044 wrote to memory of 1640 3044 1fxrfrf.exe 37 PID 3044 wrote to memory of 1640 3044 1fxrfrf.exe 37 PID 1640 wrote to memory of 1544 1640 pvddj.exe 38 PID 1640 wrote to memory of 1544 1640 pvddj.exe 38 PID 1640 wrote to memory of 1544 1640 pvddj.exe 38 PID 1640 wrote to memory of 1544 1640 pvddj.exe 38 PID 1544 wrote to memory of 2856 1544 1bthtt.exe 39 PID 1544 wrote to memory of 2856 1544 1bthtt.exe 39 PID 1544 wrote to memory of 2856 1544 1bthtt.exe 39 PID 1544 wrote to memory of 2856 1544 1bthtt.exe 39 PID 2856 wrote to memory of 1632 2856 vvppd.exe 40 PID 2856 wrote to memory of 1632 2856 vvppd.exe 40 PID 2856 wrote to memory of 1632 2856 vvppd.exe 40 PID 2856 wrote to memory of 1632 2856 vvppd.exe 40 PID 1632 wrote to memory of 1332 1632 ffrlrlr.exe 41 PID 1632 wrote to memory of 1332 1632 ffrlrlr.exe 41 PID 1632 wrote to memory of 1332 1632 ffrlrlr.exe 41 PID 1632 wrote to memory of 1332 1632 ffrlrlr.exe 41 PID 1332 wrote to memory of 344 1332 ttnbth.exe 42 PID 1332 wrote to memory of 344 1332 ttnbth.exe 42 PID 1332 wrote to memory of 344 1332 ttnbth.exe 42 PID 1332 wrote to memory of 344 1332 ttnbth.exe 42 PID 344 wrote to memory of 1820 344 5rxlfrf.exe 43 PID 344 wrote to memory of 1820 344 5rxlfrf.exe 43 PID 344 wrote to memory of 1820 344 5rxlfrf.exe 43 PID 344 wrote to memory of 1820 344 5rxlfrf.exe 43 PID 1820 wrote to memory of 2292 1820 vvvjj.exe 44 PID 1820 wrote to memory of 2292 1820 vvvjj.exe 44 PID 1820 wrote to memory of 2292 1820 vvvjj.exe 44 PID 1820 wrote to memory of 2292 1820 vvvjj.exe 44 PID 2292 wrote to memory of 2756 2292 7xxfrfr.exe 45 PID 2292 wrote to memory of 2756 2292 7xxfrfr.exe 45 PID 2292 wrote to memory of 2756 2292 7xxfrfr.exe 45 PID 2292 wrote to memory of 2756 2292 7xxfrfr.exe 45 PID 2756 wrote to memory of 2936 2756 bbbthn.exe 46 PID 2756 wrote to memory of 2936 2756 bbbthn.exe 46 PID 2756 wrote to memory of 2936 2756 bbbthn.exe 46 PID 2756 wrote to memory of 2936 2756 bbbthn.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\f503baa8d038a0e3f50857a860b9991e799bec6f245916ec7d7da46c63a18145.exe"C:\Users\Admin\AppData\Local\Temp\f503baa8d038a0e3f50857a860b9991e799bec6f245916ec7d7da46c63a18145.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\xfffxff.exec:\xfffxff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\bthhbn.exec:\bthhbn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\xxxlxlr.exec:\xxxlxlr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\tbhbhb.exec:\tbhbhb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\dvdpv.exec:\dvdpv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\1fxrfrf.exec:\1fxrfrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\pvddj.exec:\pvddj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\1bthtt.exec:\1bthtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
\??\c:\vvppd.exec:\vvppd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\ffrlrlr.exec:\ffrlrlr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\ttnbth.exec:\ttnbth.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
\??\c:\5rxlfrf.exec:\5rxlfrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:344 -
\??\c:\vvvjj.exec:\vvvjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\7xxfrfr.exec:\7xxfrfr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\bbbthn.exec:\bbbthn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\7rlxlrx.exec:\7rlxlrx.exe17⤵
- Executes dropped EXE
PID:2936 -
\??\c:\9bbnbh.exec:\9bbnbh.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3052 -
\??\c:\bbnbth.exec:\bbnbth.exe19⤵
- Executes dropped EXE
PID:764 -
\??\c:\jppjd.exec:\jppjd.exe20⤵
- Executes dropped EXE
PID:652 -
\??\c:\hnnttb.exec:\hnnttb.exe21⤵
- Executes dropped EXE
PID:2088 -
\??\c:\tnbbbh.exec:\tnbbbh.exe22⤵
- Executes dropped EXE
PID:2532 -
\??\c:\3xxlflr.exec:\3xxlflr.exe23⤵
- Executes dropped EXE
PID:1076 -
\??\c:\fflrlrl.exec:\fflrlrl.exe24⤵
- Executes dropped EXE
PID:2232 -
\??\c:\ddjvv.exec:\ddjvv.exe25⤵
- Executes dropped EXE
PID:1472 -
\??\c:\xfxfrfx.exec:\xfxfrfx.exe26⤵
- Executes dropped EXE
PID:1808 -
\??\c:\jjdjd.exec:\jjdjd.exe27⤵
- Executes dropped EXE
PID:1624 -
\??\c:\dddpj.exec:\dddpj.exe28⤵
- Executes dropped EXE
PID:2160 -
\??\c:\7nhtbb.exec:\7nhtbb.exe29⤵
- Executes dropped EXE
PID:1232 -
\??\c:\jjpjd.exec:\jjpjd.exe30⤵
- Executes dropped EXE
PID:1968 -
\??\c:\bhthbh.exec:\bhthbh.exe31⤵
- Executes dropped EXE
PID:2320 -
\??\c:\9jjvd.exec:\9jjvd.exe32⤵
- Executes dropped EXE
PID:2904 -
\??\c:\rrlxrxl.exec:\rrlxrxl.exe33⤵
- Executes dropped EXE
PID:2920 -
\??\c:\vpppj.exec:\vpppj.exe34⤵
- Executes dropped EXE
PID:2708 -
\??\c:\vvjpd.exec:\vvjpd.exe35⤵
- Executes dropped EXE
PID:2564 -
\??\c:\rxffrrf.exec:\rxffrrf.exe36⤵
- Executes dropped EXE
PID:2852 -
\??\c:\nnbnbt.exec:\nnbnbt.exe37⤵
- Executes dropped EXE
PID:2580 -
\??\c:\jjvjv.exec:\jjvjv.exe38⤵
- Executes dropped EXE
PID:2892 -
\??\c:\rxrllrf.exec:\rxrllrf.exe39⤵
- Executes dropped EXE
PID:2572 -
\??\c:\nnnnhn.exec:\nnnnhn.exe40⤵
- Executes dropped EXE
PID:2724 -
\??\c:\5jdjd.exec:\5jdjd.exe41⤵
- Executes dropped EXE
PID:2840 -
\??\c:\9dvjd.exec:\9dvjd.exe42⤵
- Executes dropped EXE
PID:1800 -
\??\c:\7xxlxfr.exec:\7xxlxfr.exe43⤵
- Executes dropped EXE
PID:2044 -
\??\c:\hhbtnh.exec:\hhbtnh.exe44⤵
- Executes dropped EXE
PID:2776 -
\??\c:\ppvpd.exec:\ppvpd.exe45⤵
- Executes dropped EXE
PID:2900 -
\??\c:\dvppd.exec:\dvppd.exe46⤵
- Executes dropped EXE
PID:2856 -
\??\c:\3frlxrl.exec:\3frlxrl.exe47⤵
- Executes dropped EXE
PID:1340 -
\??\c:\hhnhnh.exec:\hhnhnh.exe48⤵
- Executes dropped EXE
PID:112 -
\??\c:\ddjvj.exec:\ddjvj.exe49⤵
- Executes dropped EXE
PID:2032 -
\??\c:\rffxfrr.exec:\rffxfrr.exe50⤵
- Executes dropped EXE
PID:1880 -
\??\c:\hbhbtt.exec:\hbhbtt.exe51⤵
- Executes dropped EXE
PID:1120 -
\??\c:\dvpdj.exec:\dvpdj.exe52⤵
- Executes dropped EXE
PID:584 -
\??\c:\ddvvj.exec:\ddvvj.exe53⤵
- Executes dropped EXE
PID:1168 -
\??\c:\3xrfrxf.exec:\3xrfrxf.exe54⤵
- Executes dropped EXE
PID:1140 -
\??\c:\nbhttn.exec:\nbhttn.exe55⤵
- Executes dropped EXE
PID:2208 -
\??\c:\pdpdv.exec:\pdpdv.exe56⤵
- Executes dropped EXE
PID:2248 -
\??\c:\3fxxrfr.exec:\3fxxrfr.exe57⤵
- Executes dropped EXE
PID:848 -
\??\c:\5bbtnh.exec:\5bbtnh.exe58⤵
- Executes dropped EXE
PID:764 -
\??\c:\vvvpd.exec:\vvvpd.exe59⤵
- Executes dropped EXE
PID:404 -
\??\c:\xrflxlr.exec:\xrflxlr.exe60⤵
- Executes dropped EXE
PID:2088 -
\??\c:\tttnhb.exec:\tttnhb.exe61⤵
- Executes dropped EXE
PID:1924 -
\??\c:\5tttht.exec:\5tttht.exe62⤵
- Executes dropped EXE
PID:696 -
\??\c:\jjjpv.exec:\jjjpv.exe63⤵
- Executes dropped EXE
PID:928 -
\??\c:\xlxllxx.exec:\xlxllxx.exe64⤵
- Executes dropped EXE
PID:2232 -
\??\c:\nntthb.exec:\nntthb.exe65⤵
- Executes dropped EXE
PID:1856 -
\??\c:\pddjd.exec:\pddjd.exe66⤵PID:1752
-
\??\c:\xlxrxxf.exec:\xlxrxxf.exe67⤵PID:576
-
\??\c:\frfflrx.exec:\frfflrx.exe68⤵PID:1972
-
\??\c:\bbbnhn.exec:\bbbnhn.exe69⤵PID:2368
-
\??\c:\ddpdv.exec:\ddpdv.exe70⤵PID:2492
-
\??\c:\7jjdp.exec:\7jjdp.exe71⤵PID:1740
-
\??\c:\xxxlllx.exec:\xxxlllx.exe72⤵PID:2284
-
\??\c:\bbtbnn.exec:\bbtbnn.exe73⤵
- System Location Discovery: System Language Discovery
PID:2980 -
\??\c:\nttnht.exec:\nttnht.exe74⤵PID:2984
-
\??\c:\vvvdv.exec:\vvvdv.exe75⤵PID:1596
-
\??\c:\xlrrfll.exec:\xlrrfll.exe76⤵PID:2920
-
\??\c:\1hnbnh.exec:\1hnbnh.exe77⤵PID:2824
-
\??\c:\3dpdp.exec:\3dpdp.exe78⤵PID:2564
-
\??\c:\lfrrlff.exec:\lfrrlff.exe79⤵PID:2688
-
\??\c:\7ffrllf.exec:\7ffrllf.exe80⤵PID:2580
-
\??\c:\hbnnhh.exec:\hbnnhh.exe81⤵PID:2576
-
\??\c:\jppjv.exec:\jppjv.exe82⤵PID:2552
-
\??\c:\vdpjp.exec:\vdpjp.exe83⤵PID:3004
-
\??\c:\llxlrrl.exec:\llxlrrl.exe84⤵PID:560
-
\??\c:\9tntnn.exec:\9tntnn.exe85⤵PID:1096
-
\??\c:\pppvj.exec:\pppvj.exe86⤵PID:1940
-
\??\c:\xrrxlfl.exec:\xrrxlfl.exe87⤵PID:2736
-
\??\c:\bhhbbt.exec:\bhhbbt.exe88⤵PID:2384
-
\??\c:\3jvjv.exec:\3jvjv.exe89⤵PID:288
-
\??\c:\pjpvp.exec:\pjpvp.exe90⤵PID:1780
-
\??\c:\rrxlfrl.exec:\rrxlfrl.exe91⤵PID:1636
-
\??\c:\hbtbhh.exec:\hbtbhh.exe92⤵PID:1036
-
\??\c:\jjjpj.exec:\jjjpj.exe93⤵PID:1620
-
\??\c:\llxlflf.exec:\llxlflf.exe94⤵PID:2544
-
\??\c:\llxfllf.exec:\llxfllf.exe95⤵PID:2292
-
\??\c:\3hthbn.exec:\3hthbn.exe96⤵PID:1548
-
\??\c:\vvjpd.exec:\vvjpd.exe97⤵PID:2392
-
\??\c:\lfxllrf.exec:\lfxllrf.exe98⤵PID:2256
-
\??\c:\7nhnbb.exec:\7nhnbb.exe99⤵PID:1416
-
\??\c:\tnntth.exec:\tnntth.exe100⤵PID:2168
-
\??\c:\5jpvj.exec:\5jpvj.exe101⤵PID:1436
-
\??\c:\lrflfrx.exec:\lrflfrx.exe102⤵PID:960
-
\??\c:\btttht.exec:\btttht.exe103⤵PID:1980
-
\??\c:\5tnthh.exec:\5tnthh.exe104⤵PID:2088
-
\??\c:\7dpjp.exec:\7dpjp.exe105⤵PID:1976
-
\??\c:\llfxlrf.exec:\llfxlrf.exe106⤵PID:2444
-
\??\c:\3hhnbb.exec:\3hhnbb.exe107⤵PID:1380
-
\??\c:\vjvjp.exec:\vjvjp.exe108⤵PID:812
-
\??\c:\9rflfrl.exec:\9rflfrl.exe109⤵PID:2080
-
\??\c:\lrlrflx.exec:\lrlrflx.exe110⤵PID:1376
-
\??\c:\hhthbt.exec:\hhthbt.exe111⤵PID:2496
-
\??\c:\ddpdp.exec:\ddpdp.exe112⤵PID:1040
-
\??\c:\rrxxlrf.exec:\rrxxlrf.exe113⤵PID:1952
-
\??\c:\9bthbn.exec:\9bthbn.exe114⤵PID:1968
-
\??\c:\vvpvd.exec:\vvpvd.exe115⤵PID:3024
-
\??\c:\5fflxxf.exec:\5fflxxf.exe116⤵PID:2464
-
\??\c:\llflffx.exec:\llflffx.exe117⤵PID:2800
-
\??\c:\7bnnbh.exec:\7bnnbh.exe118⤵PID:2108
-
\??\c:\jjpvv.exec:\jjpvv.exe119⤵PID:3068
-
\??\c:\rrflrxx.exec:\rrflrxx.exe120⤵PID:2824
-
\??\c:\vvpdv.exec:\vvpdv.exe121⤵PID:3020
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-