Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-11-2024 05:41
Behavioral task
behavioral1
Sample
fe232863a9cff46b9661580477ca70edef32ed77134563641915fdfdbc8f3afc.exe
Resource
win7-20240903-en
General
-
Target
fe232863a9cff46b9661580477ca70edef32ed77134563641915fdfdbc8f3afc.exe
-
Size
371KB
-
MD5
ad83a0fb512017846d400bcbe0dc3086
-
SHA1
bc212f1f366dfaa55bf843481143ac222c1c18f0
-
SHA256
fe232863a9cff46b9661580477ca70edef32ed77134563641915fdfdbc8f3afc
-
SHA512
76151b00c0754b0afa1d5da5f6d302305b953cf542b27178000b0aa1c4ac3eb06a9d349ac23e8639a58b0db752923a1b03366a3b0fe462e722e65be783bc8c28
-
SSDEEP
6144:9cm4FmowdHoSABIs9OKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf72:/4wFHoSA4KofHfHTXQLzgvnzHPowYbvH
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 54 IoCs
Processes:
resource yara_rule behavioral1/memory/2316-7-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2328-18-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2752-29-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2760-40-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2796-52-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2740-61-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2296-76-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2612-73-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2296-83-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2020-92-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2232-101-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2312-113-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2940-121-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2940-122-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2004-134-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1084-147-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1108-145-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1108-144-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1084-156-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1332-169-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1148-178-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1672-189-0x0000000001BE0000-0x0000000001C40000-memory.dmp family_blackmoon behavioral1/memory/3008-191-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/3008-200-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/3008-199-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/600-213-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2476-223-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2568-237-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/3008-236-0x00000000002B0000-0x0000000000310000-memory.dmp family_blackmoon behavioral1/memory/2960-234-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1780-253-0x0000000000220000-0x0000000000280000-memory.dmp family_blackmoon behavioral1/memory/2568-246-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1780-258-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/924-269-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2868-281-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1940-291-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2148-302-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2524-313-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1596-323-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2748-333-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2816-342-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2608-352-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2856-354-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1596-353-0x00000000003A0000-0x0000000000400000-memory.dmp family_blackmoon behavioral1/memory/2796-362-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2856-361-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2796-369-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/296-392-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1084-469-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1048-487-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/3000-511-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1624-528-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1124-580-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2072-597-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
jvpjd.exepvdpp.exennnhth.exeffrlffr.exe9hbbbt.exefffxlxl.exexlffrfl.exe5nbbnn.exentthtb.exevvpdv.exeddvpd.exeffflxlr.exettthtt.exebnhbth.exehhhnbn.exevpddp.exefxrrflx.exe9tthbt.exeflxxrlx.exenttnnn.exefllxxxx.exetbthbh.exexxrlflf.exerxfrlfx.exevvppj.exe5dvdd.exejvdjp.exe9lfrlxr.exehhntht.exerlfrlxx.exebtnhht.exerxrlffx.exeffxrffx.exedvdvd.exehbhhbh.exe7jvjd.exellflfrx.exelfrflll.exe3hhnbh.exe7vdvp.exerrrrffx.exerfxfrfr.exetbtbnh.exevppdj.exelxlllfr.exetnhthn.exevvvvp.exeflxlrfr.exe9hnnth.exeppppp.exexfxrxrr.exehthbhn.exejjjdv.exedvjvp.exerxxfllf.exe1nbttt.exejpjpv.exexllfxrr.exetthttn.exedvdvd.exexfxrflx.exettbbtt.exepvvpd.exefffrffr.exepid process 2328 jvpjd.exe 2752 pvdpp.exe 2760 nnnhth.exe 2796 ffrlffr.exe 2740 9hbbbt.exe 2612 fffxlxl.exe 2296 xlffrfl.exe 2020 5nbbnn.exe 2232 ntthtb.exe 2312 vvpdv.exe 2940 ddvpd.exe 2004 ffflxlr.exe 1108 ttthtt.exe 1084 bnhbth.exe 1332 hhhnbn.exe 1148 vpddp.exe 1672 fxrrflx.exe 3008 9tthbt.exe 600 flxxrlx.exe 2476 nttnnn.exe 2960 fllxxxx.exe 2568 tbthbh.exe 1780 xxrlflf.exe 924 rxfrlfx.exe 2868 vvppj.exe 1940 5dvdd.exe 2148 jvdjp.exe 2524 9lfrlxr.exe 1596 hhntht.exe 2748 rlfrlxx.exe 2816 btnhht.exe 2608 rxrlffx.exe 2856 ffxrffx.exe 2796 dvdvd.exe 2768 hbhhbh.exe 1728 7jvjd.exe 296 llflfrx.exe 2972 lfrflll.exe 376 3hhnbh.exe 1788 7vdvp.exe 320 rrrrffx.exe 316 rfxfrfr.exe 2780 tbtbnh.exe 1352 vppdj.exe 2936 lxlllfr.exe 1152 tnhthn.exe 1084 vvvvp.exe 352 flxlrfr.exe 1048 9hnnth.exe 3012 ppppp.exe 2464 xfxrxrr.exe 3000 hthbhn.exe 2260 jjjdv.exe 1624 dvjvp.exe 800 rxxfllf.exe 1696 1nbttt.exe 1688 jpjpv.exe 844 xllfxrr.exe 2064 tthttn.exe 1124 dvdvd.exe 2380 xfxrflx.exe 2072 ttbbtt.exe 744 pvvpd.exe 2788 fffrffr.exe -
Molebox Virtualization software 32 IoCs
Detects file using Molebox Virtualization software.
Processes:
resource yara_rule \??\c:\jvpjd.exe molebox C:\pvdpp.exe molebox \??\c:\nnnhth.exe molebox C:\ffrlffr.exe molebox C:\9hbbbt.exe molebox C:\fffxlxl.exe molebox \??\c:\xlffrfl.exe molebox C:\5nbbnn.exe molebox C:\ntthtb.exe molebox C:\vvpdv.exe molebox C:\ddvpd.exe molebox C:\ffflxlr.exe molebox C:\ttthtt.exe molebox C:\bnhbth.exe molebox \??\c:\hhhnbn.exe molebox C:\vpddp.exe molebox C:\fxrrflx.exe molebox C:\9tthbt.exe molebox C:\flxxrlx.exe molebox C:\nttnnn.exe molebox C:\fllxxxx.exe molebox \??\c:\tbthbh.exe molebox \??\c:\xxrlflf.exe molebox C:\rxfrlfx.exe molebox C:\vvppj.exe molebox C:\5dvdd.exe molebox C:\jvdjp.exe molebox \??\c:\9lfrlxr.exe molebox \??\c:\hhntht.exe molebox \??\c:\rlfrlxx.exe molebox \??\c:\btnhht.exe molebox C:\rxrlffx.exe molebox -
Processes:
resource yara_rule behavioral1/memory/2316-0-0x0000000000400000-0x0000000000460000-memory.dmp upx \??\c:\jvpjd.exe upx behavioral1/memory/2316-7-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2328-12-0x0000000000220000-0x0000000000280000-memory.dmp upx C:\pvdpp.exe upx behavioral1/memory/2752-19-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2328-18-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2752-23-0x00000000003A0000-0x0000000000400000-memory.dmp upx behavioral1/memory/2752-28-0x00000000003A0000-0x0000000000400000-memory.dmp upx behavioral1/memory/2760-31-0x0000000000400000-0x0000000000460000-memory.dmp upx \??\c:\nnnhth.exe upx behavioral1/memory/2752-29-0x0000000000400000-0x0000000000460000-memory.dmp upx C:\ffrlffr.exe upx behavioral1/memory/2796-42-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2760-40-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2796-46-0x00000000005F0000-0x0000000000650000-memory.dmp upx behavioral1/memory/2796-50-0x0000000000400000-0x0000000000460000-memory.dmp upx C:\9hbbbt.exe upx behavioral1/memory/2796-52-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2328-51-0x0000000000220000-0x0000000000280000-memory.dmp upx behavioral1/memory/2740-61-0x0000000000400000-0x0000000000460000-memory.dmp upx C:\fffxlxl.exe upx behavioral1/memory/2612-67-0x0000000000220000-0x0000000000280000-memory.dmp upx behavioral1/memory/2612-71-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2296-76-0x0000000000400000-0x0000000000460000-memory.dmp upx \??\c:\xlffrfl.exe upx behavioral1/memory/2612-73-0x0000000000400000-0x0000000000460000-memory.dmp upx C:\5nbbnn.exe upx behavioral1/memory/2296-83-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2020-87-0x00000000002F0000-0x0000000000350000-memory.dmp upx C:\ntthtb.exe upx behavioral1/memory/2020-92-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2312-103-0x0000000000400000-0x0000000000460000-memory.dmp upx C:\vvpdv.exe upx behavioral1/memory/2312-107-0x0000000000220000-0x0000000000280000-memory.dmp upx C:\ddvpd.exe upx behavioral1/memory/2312-113-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2940-121-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2004-125-0x0000000000400000-0x0000000000460000-memory.dmp upx C:\ffflxlr.exe upx behavioral1/memory/2940-122-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2004-129-0x00000000004D0000-0x0000000000530000-memory.dmp upx C:\ttthtt.exe upx behavioral1/memory/1108-136-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2004-134-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/1108-140-0x00000000002A0000-0x0000000000300000-memory.dmp upx C:\bnhbth.exe upx behavioral1/memory/1084-147-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/1108-145-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/1084-151-0x0000000001C10000-0x0000000001C70000-memory.dmp upx \??\c:\hhhnbn.exe upx behavioral1/memory/1332-159-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/1084-158-0x0000000001C10000-0x0000000001C70000-memory.dmp upx behavioral1/memory/1084-156-0x0000000000400000-0x0000000000460000-memory.dmp upx C:\vpddp.exe upx behavioral1/memory/1332-169-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/1148-173-0x0000000001B80000-0x0000000001BE0000-memory.dmp upx C:\fxrrflx.exe upx behavioral1/memory/1672-182-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/1148-178-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/3008-191-0x0000000000400000-0x0000000000460000-memory.dmp upx C:\9tthbt.exe upx behavioral1/memory/3008-195-0x00000000002B0000-0x0000000000310000-memory.dmp upx behavioral1/memory/3008-200-0x0000000000400000-0x0000000000460000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
fxxxrxf.exejjdpd.exexrrfrlf.exexxxrlxr.exethttnt.exe7tttnn.exehbnthh.exe1fxxfrf.exe7ddpp.exenhhttn.exe3hhnbh.exefrxlffx.exethhhbb.exetbtbnh.exexxrrlrl.exexxxxxff.exe7nhtbb.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxxrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrfrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxrlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1fxxfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ddpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hhnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbtbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrrlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxxxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nhtbb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
fe232863a9cff46b9661580477ca70edef32ed77134563641915fdfdbc8f3afc.exejvpjd.exepvdpp.exennnhth.exeffrlffr.exe9hbbbt.exefffxlxl.exexlffrfl.exe5nbbnn.exentthtb.exevvpdv.exeddvpd.exeffflxlr.exettthtt.exebnhbth.exehhhnbn.exedescription pid process target process PID 2316 wrote to memory of 2328 2316 fe232863a9cff46b9661580477ca70edef32ed77134563641915fdfdbc8f3afc.exe jvpjd.exe PID 2316 wrote to memory of 2328 2316 fe232863a9cff46b9661580477ca70edef32ed77134563641915fdfdbc8f3afc.exe jvpjd.exe PID 2316 wrote to memory of 2328 2316 fe232863a9cff46b9661580477ca70edef32ed77134563641915fdfdbc8f3afc.exe jvpjd.exe PID 2316 wrote to memory of 2328 2316 fe232863a9cff46b9661580477ca70edef32ed77134563641915fdfdbc8f3afc.exe jvpjd.exe PID 2328 wrote to memory of 2752 2328 jvpjd.exe pvdpp.exe PID 2328 wrote to memory of 2752 2328 jvpjd.exe pvdpp.exe PID 2328 wrote to memory of 2752 2328 jvpjd.exe pvdpp.exe PID 2328 wrote to memory of 2752 2328 jvpjd.exe pvdpp.exe PID 2752 wrote to memory of 2760 2752 pvdpp.exe nnnhth.exe PID 2752 wrote to memory of 2760 2752 pvdpp.exe nnnhth.exe PID 2752 wrote to memory of 2760 2752 pvdpp.exe nnnhth.exe PID 2752 wrote to memory of 2760 2752 pvdpp.exe nnnhth.exe PID 2760 wrote to memory of 2796 2760 nnnhth.exe ffrlffr.exe PID 2760 wrote to memory of 2796 2760 nnnhth.exe ffrlffr.exe PID 2760 wrote to memory of 2796 2760 nnnhth.exe ffrlffr.exe PID 2760 wrote to memory of 2796 2760 nnnhth.exe ffrlffr.exe PID 2796 wrote to memory of 2740 2796 ffrlffr.exe 9hbbbt.exe PID 2796 wrote to memory of 2740 2796 ffrlffr.exe 9hbbbt.exe PID 2796 wrote to memory of 2740 2796 ffrlffr.exe 9hbbbt.exe PID 2796 wrote to memory of 2740 2796 ffrlffr.exe 9hbbbt.exe PID 2740 wrote to memory of 2612 2740 9hbbbt.exe fffxlxl.exe PID 2740 wrote to memory of 2612 2740 9hbbbt.exe fffxlxl.exe PID 2740 wrote to memory of 2612 2740 9hbbbt.exe fffxlxl.exe PID 2740 wrote to memory of 2612 2740 9hbbbt.exe fffxlxl.exe PID 2612 wrote to memory of 2296 2612 fffxlxl.exe xlffrfl.exe PID 2612 wrote to memory of 2296 2612 fffxlxl.exe xlffrfl.exe PID 2612 wrote to memory of 2296 2612 fffxlxl.exe xlffrfl.exe PID 2612 wrote to memory of 2296 2612 fffxlxl.exe xlffrfl.exe PID 2296 wrote to memory of 2020 2296 xlffrfl.exe 5nbbnn.exe PID 2296 wrote to memory of 2020 2296 xlffrfl.exe 5nbbnn.exe PID 2296 wrote to memory of 2020 2296 xlffrfl.exe 5nbbnn.exe PID 2296 wrote to memory of 2020 2296 xlffrfl.exe 5nbbnn.exe PID 2020 wrote to memory of 2232 2020 5nbbnn.exe ntthtb.exe PID 2020 wrote to memory of 2232 2020 5nbbnn.exe ntthtb.exe PID 2020 wrote to memory of 2232 2020 5nbbnn.exe ntthtb.exe PID 2020 wrote to memory of 2232 2020 5nbbnn.exe ntthtb.exe PID 2232 wrote to memory of 2312 2232 ntthtb.exe vvpdv.exe PID 2232 wrote to memory of 2312 2232 ntthtb.exe vvpdv.exe PID 2232 wrote to memory of 2312 2232 ntthtb.exe vvpdv.exe PID 2232 wrote to memory of 2312 2232 ntthtb.exe vvpdv.exe PID 2312 wrote to memory of 2940 2312 vvpdv.exe ddvpd.exe PID 2312 wrote to memory of 2940 2312 vvpdv.exe ddvpd.exe PID 2312 wrote to memory of 2940 2312 vvpdv.exe ddvpd.exe PID 2312 wrote to memory of 2940 2312 vvpdv.exe ddvpd.exe PID 2940 wrote to memory of 2004 2940 ddvpd.exe ffflxlr.exe PID 2940 wrote to memory of 2004 2940 ddvpd.exe ffflxlr.exe PID 2940 wrote to memory of 2004 2940 ddvpd.exe ffflxlr.exe PID 2940 wrote to memory of 2004 2940 ddvpd.exe ffflxlr.exe PID 2004 wrote to memory of 1108 2004 ffflxlr.exe ttthtt.exe PID 2004 wrote to memory of 1108 2004 ffflxlr.exe ttthtt.exe PID 2004 wrote to memory of 1108 2004 ffflxlr.exe ttthtt.exe PID 2004 wrote to memory of 1108 2004 ffflxlr.exe ttthtt.exe PID 1108 wrote to memory of 1084 1108 ttthtt.exe bnhbth.exe PID 1108 wrote to memory of 1084 1108 ttthtt.exe bnhbth.exe PID 1108 wrote to memory of 1084 1108 ttthtt.exe bnhbth.exe PID 1108 wrote to memory of 1084 1108 ttthtt.exe bnhbth.exe PID 1084 wrote to memory of 1332 1084 bnhbth.exe hhhnbn.exe PID 1084 wrote to memory of 1332 1084 bnhbth.exe hhhnbn.exe PID 1084 wrote to memory of 1332 1084 bnhbth.exe hhhnbn.exe PID 1084 wrote to memory of 1332 1084 bnhbth.exe hhhnbn.exe PID 1332 wrote to memory of 1148 1332 hhhnbn.exe vpddp.exe PID 1332 wrote to memory of 1148 1332 hhhnbn.exe vpddp.exe PID 1332 wrote to memory of 1148 1332 hhhnbn.exe vpddp.exe PID 1332 wrote to memory of 1148 1332 hhhnbn.exe vpddp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe232863a9cff46b9661580477ca70edef32ed77134563641915fdfdbc8f3afc.exe"C:\Users\Admin\AppData\Local\Temp\fe232863a9cff46b9661580477ca70edef32ed77134563641915fdfdbc8f3afc.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\jvpjd.exec:\jvpjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\pvdpp.exec:\pvdpp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\nnnhth.exec:\nnnhth.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\ffrlffr.exec:\ffrlffr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\9hbbbt.exec:\9hbbbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\fffxlxl.exec:\fffxlxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\xlffrfl.exec:\xlffrfl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\5nbbnn.exec:\5nbbnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\ntthtb.exec:\ntthtb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\vvpdv.exec:\vvpdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\ddvpd.exec:\ddvpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\ffflxlr.exec:\ffflxlr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\ttthtt.exec:\ttthtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
\??\c:\bnhbth.exec:\bnhbth.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
\??\c:\hhhnbn.exec:\hhhnbn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
\??\c:\vpddp.exec:\vpddp.exe17⤵
- Executes dropped EXE
PID:1148 -
\??\c:\fxrrflx.exec:\fxrrflx.exe18⤵
- Executes dropped EXE
PID:1672 -
\??\c:\9tthbt.exec:\9tthbt.exe19⤵
- Executes dropped EXE
PID:3008 -
\??\c:\flxxrlx.exec:\flxxrlx.exe20⤵
- Executes dropped EXE
PID:600 -
\??\c:\nttnnn.exec:\nttnnn.exe21⤵
- Executes dropped EXE
PID:2476 -
\??\c:\fllxxxx.exec:\fllxxxx.exe22⤵
- Executes dropped EXE
PID:2960 -
\??\c:\tbthbh.exec:\tbthbh.exe23⤵
- Executes dropped EXE
PID:2568 -
\??\c:\xxrlflf.exec:\xxrlflf.exe24⤵
- Executes dropped EXE
PID:1780 -
\??\c:\rxfrlfx.exec:\rxfrlfx.exe25⤵
- Executes dropped EXE
PID:924 -
\??\c:\vvppj.exec:\vvppj.exe26⤵
- Executes dropped EXE
PID:2868 -
\??\c:\5dvdd.exec:\5dvdd.exe27⤵
- Executes dropped EXE
PID:1940 -
\??\c:\jvdjp.exec:\jvdjp.exe28⤵
- Executes dropped EXE
PID:2148 -
\??\c:\9lfrlxr.exec:\9lfrlxr.exe29⤵
- Executes dropped EXE
PID:2524 -
\??\c:\hhntht.exec:\hhntht.exe30⤵
- Executes dropped EXE
PID:1596 -
\??\c:\rlfrlxx.exec:\rlfrlxx.exe31⤵
- Executes dropped EXE
PID:2748 -
\??\c:\btnhht.exec:\btnhht.exe32⤵
- Executes dropped EXE
PID:2816 -
\??\c:\rxrlffx.exec:\rxrlffx.exe33⤵
- Executes dropped EXE
PID:2608 -
\??\c:\ffxrffx.exec:\ffxrffx.exe34⤵
- Executes dropped EXE
PID:2856 -
\??\c:\dvdvd.exec:\dvdvd.exe35⤵
- Executes dropped EXE
PID:2796 -
\??\c:\hbhhbh.exec:\hbhhbh.exe36⤵
- Executes dropped EXE
PID:2768 -
\??\c:\7jvjd.exec:\7jvjd.exe37⤵
- Executes dropped EXE
PID:1728 -
\??\c:\llflfrx.exec:\llflfrx.exe38⤵
- Executes dropped EXE
PID:296 -
\??\c:\lfrflll.exec:\lfrflll.exe39⤵
- Executes dropped EXE
PID:2972 -
\??\c:\3hhnbh.exec:\3hhnbh.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:376 -
\??\c:\7vdvp.exec:\7vdvp.exe41⤵
- Executes dropped EXE
PID:1788 -
\??\c:\rrrrffx.exec:\rrrrffx.exe42⤵
- Executes dropped EXE
PID:320 -
\??\c:\rfxfrfr.exec:\rfxfrfr.exe43⤵
- Executes dropped EXE
PID:316 -
\??\c:\tbtbnh.exec:\tbtbnh.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2780 -
\??\c:\vppdj.exec:\vppdj.exe45⤵
- Executes dropped EXE
PID:1352 -
\??\c:\lxlllfr.exec:\lxlllfr.exe46⤵
- Executes dropped EXE
PID:2936 -
\??\c:\tnhthn.exec:\tnhthn.exe47⤵
- Executes dropped EXE
PID:1152 -
\??\c:\vvvvp.exec:\vvvvp.exe48⤵
- Executes dropped EXE
PID:1084 -
\??\c:\flxlrfr.exec:\flxlrfr.exe49⤵
- Executes dropped EXE
PID:352 -
\??\c:\9hnnth.exec:\9hnnth.exe50⤵
- Executes dropped EXE
PID:1048 -
\??\c:\ppppp.exec:\ppppp.exe51⤵
- Executes dropped EXE
PID:3012 -
\??\c:\xfxrxrr.exec:\xfxrxrr.exe52⤵
- Executes dropped EXE
PID:2464 -
\??\c:\hthbhn.exec:\hthbhn.exe53⤵
- Executes dropped EXE
PID:3000 -
\??\c:\jjjdv.exec:\jjjdv.exe54⤵
- Executes dropped EXE
PID:2260 -
\??\c:\dvjvp.exec:\dvjvp.exe55⤵
- Executes dropped EXE
PID:1624 -
\??\c:\rxxfllf.exec:\rxxfllf.exe56⤵
- Executes dropped EXE
PID:800 -
\??\c:\1nbttt.exec:\1nbttt.exe57⤵
- Executes dropped EXE
PID:1696 -
\??\c:\jpjpv.exec:\jpjpv.exe58⤵
- Executes dropped EXE
PID:1688 -
\??\c:\xllfxrr.exec:\xllfxrr.exe59⤵
- Executes dropped EXE
PID:844 -
\??\c:\tthttn.exec:\tthttn.exe60⤵
- Executes dropped EXE
PID:2064 -
\??\c:\dvdvd.exec:\dvdvd.exe61⤵
- Executes dropped EXE
PID:1124 -
\??\c:\xfxrflx.exec:\xfxrflx.exe62⤵
- Executes dropped EXE
PID:2380 -
\??\c:\ttbbtt.exec:\ttbbtt.exe63⤵
- Executes dropped EXE
PID:2072 -
\??\c:\pvvpd.exec:\pvvpd.exe64⤵
- Executes dropped EXE
PID:744 -
\??\c:\fffrffr.exec:\fffrffr.exe65⤵
- Executes dropped EXE
PID:2788 -
\??\c:\jvdpv.exec:\jvdpv.exe66⤵PID:1772
-
\??\c:\dddjp.exec:\dddjp.exe67⤵PID:2832
-
\??\c:\lxfflxl.exec:\lxfflxl.exe68⤵PID:2756
-
\??\c:\ttbhbh.exec:\ttbhbh.exe69⤵PID:2876
-
\??\c:\pvpjd.exec:\pvpjd.exe70⤵PID:2944
-
\??\c:\xxlxlxf.exec:\xxlxlxf.exe71⤵PID:2772
-
\??\c:\hhhnnh.exec:\hhhnnh.exe72⤵PID:2716
-
\??\c:\ppdjp.exec:\ppdjp.exe73⤵PID:2768
-
\??\c:\dvjdd.exec:\dvjdd.exe74⤵PID:1728
-
\??\c:\fllxrlx.exec:\fllxrlx.exe75⤵PID:296
-
\??\c:\nnhtnh.exec:\nnhtnh.exe76⤵PID:2572
-
\??\c:\9dpjj.exec:\9dpjj.exe77⤵PID:2520
-
\??\c:\9rllflx.exec:\9rllflx.exe78⤵PID:2032
-
\??\c:\tnnbnt.exec:\tnnbnt.exe79⤵PID:1312
-
\??\c:\tbtthn.exec:\tbtthn.exe80⤵PID:2372
-
\??\c:\jpppd.exec:\jpppd.exe81⤵PID:2928
-
\??\c:\llrxxfr.exec:\llrxxfr.exe82⤵PID:348
-
\??\c:\hnhnbh.exec:\hnhnbh.exe83⤵PID:1328
-
\??\c:\nnbbnt.exec:\nnbbnt.exe84⤵PID:580
-
\??\c:\vppvj.exec:\vppvj.exe85⤵PID:544
-
\??\c:\3fllfxx.exec:\3fllfxx.exe86⤵PID:2284
-
\??\c:\ttttnb.exec:\ttttnb.exe87⤵PID:2244
-
\??\c:\vvddv.exec:\vvddv.exe88⤵PID:748
-
\??\c:\xfxxlfl.exec:\xfxxlfl.exe89⤵PID:2428
-
\??\c:\tnnhhn.exec:\tnnhhn.exe90⤵PID:1944
-
\??\c:\pjjdv.exec:\pjjdv.exe91⤵PID:1376
-
\??\c:\5dvpj.exec:\5dvpj.exe92⤵PID:1848
-
\??\c:\7xlflfx.exec:\7xlflfx.exe93⤵PID:800
-
\??\c:\hnbtth.exec:\hnbtth.exe94⤵PID:1664
-
\??\c:\7dpjv.exec:\7dpjv.exe95⤵PID:984
-
\??\c:\djdpj.exec:\djdpj.exe96⤵PID:1652
-
\??\c:\rllrflx.exec:\rllrflx.exe97⤵PID:772
-
\??\c:\hbhhth.exec:\hbhhth.exe98⤵PID:3032
-
\??\c:\nhbnnb.exec:\nhbnnb.exe99⤵PID:804
-
\??\c:\5pvdv.exec:\5pvdv.exe100⤵PID:2200
-
\??\c:\fxrrxxf.exec:\fxrrxxf.exe101⤵PID:2380
-
\??\c:\3rrxlrf.exec:\3rrxlrf.exe102⤵PID:1828
-
\??\c:\bhhtnt.exec:\bhhtnt.exe103⤵PID:2360
-
\??\c:\vvpjj.exec:\vvpjj.exe104⤵PID:1692
-
\??\c:\1lflffx.exec:\1lflffx.exe105⤵PID:1600
-
\??\c:\flfllxr.exec:\flfllxr.exe106⤵PID:2820
-
\??\c:\7htthn.exec:\7htthn.exe107⤵PID:1772
-
\??\c:\jjdpd.exec:\jjdpd.exe108⤵
- System Location Discovery: System Language Discovery
PID:2832 -
\??\c:\xflfrlf.exec:\xflfrlf.exe109⤵PID:2756
-
\??\c:\rrxlxlx.exec:\rrxlxlx.exe110⤵PID:2892
-
\??\c:\nththn.exec:\nththn.exe111⤵PID:2764
-
\??\c:\vdjdj.exec:\vdjdj.exe112⤵PID:1656
-
\??\c:\fxxrlxr.exec:\fxxrlxr.exe113⤵PID:2772
-
\??\c:\xxfrfxr.exec:\xxfrfxr.exe114⤵PID:2276
-
\??\c:\nhbbtt.exec:\nhbbtt.exe115⤵PID:1572
-
\??\c:\pdppv.exec:\pdppv.exe116⤵PID:3064
-
\??\c:\frrllrl.exec:\frrllrl.exe117⤵PID:2640
-
\??\c:\flrrllf.exec:\flrrllf.exe118⤵PID:3048
-
\??\c:\hhbbnt.exec:\hhbbnt.exe119⤵PID:2220
-
\??\c:\dpjjv.exec:\dpjjv.exe120⤵PID:1712
-
\??\c:\frlrlll.exec:\frlrlll.exe121⤵PID:2520
-
\??\c:\nthbtn.exec:\nthbtn.exe122⤵PID:2504
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-