Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24-11-2024 03:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d63abe588b87bbbc1854f05ee027b12f613a64ebc031c71044fcefc4a0108606.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
d63abe588b87bbbc1854f05ee027b12f613a64ebc031c71044fcefc4a0108606.exe
-
Size
349KB
-
MD5
c127df286098c6e50dcc0f98b10238be
-
SHA1
01493860a0e40fa19b8e9787316dc79f9db6d558
-
SHA256
d63abe588b87bbbc1854f05ee027b12f613a64ebc031c71044fcefc4a0108606
-
SHA512
d005189b32569ca993f161e097f60762db154c053fdd432f1c2dd3c853ffdb8399acfec88e77cef27048b4c7ddbde2e08c2cbcbf7162eda1e5c4615db3f473d1
-
SSDEEP
6144:Xcm7ImGddXgYW5fNZWB5hFfci3Add4kGYA4K:l7TcbWXZshJX2VGd4K
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 50 IoCs
resource yara_rule behavioral1/memory/1708-7-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2956-16-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1224-28-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1224-26-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2172-37-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2684-52-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2208-49-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2208-47-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2152-71-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2904-67-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2904-62-0x00000000001B0000-0x00000000001D8000-memory.dmp family_blackmoon behavioral1/memory/2636-88-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2636-84-0x0000000000250000-0x0000000000278000-memory.dmp family_blackmoon behavioral1/memory/2636-86-0x0000000000250000-0x0000000000278000-memory.dmp family_blackmoon behavioral1/memory/660-113-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2752-127-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1808-125-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2592-150-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1236-159-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2404-170-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2404-167-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2416-179-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2136-197-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1336-234-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2304-249-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2168-268-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2156-301-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1256-313-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/3048-320-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2252-327-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2692-346-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2532-371-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/3036-378-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2508-391-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1240-404-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1788-406-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2180-450-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2096-469-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1336-513-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2392-539-0x0000000000250000-0x0000000000278000-memory.dmp family_blackmoon behavioral1/memory/1584-558-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2208-598-0x00000000001B0000-0x00000000001D8000-memory.dmp family_blackmoon behavioral1/memory/2548-634-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1316-648-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/320-664-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1528-785-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1684-804-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2084-817-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1708-1084-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1088-1272-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2956 pppvj.exe 1224 rrlrrxr.exe 2172 pjvvd.exe 2208 ffflfxl.exe 2684 ntnthb.exe 2904 dvpvv.exe 2152 rfrfrxx.exe 2636 ntnntb.exe 2576 jjdvp.exe 2604 ttbbhn.exe 660 vvjpj.exe 1808 hbnbth.exe 2752 pvjvd.exe 2068 1nthtb.exe 2592 ddvpj.exe 1236 rrlrflf.exe 2404 hbnthn.exe 2416 ddvdv.exe 1328 5flxxll.exe 2136 dvpvd.exe 948 xrflxfr.exe 1088 nhbhnb.exe 1992 lfrrflf.exe 1008 3tbntb.exe 1336 djvpj.exe 2304 jjjvp.exe 380 xxffxlr.exe 872 vpdvp.exe 2168 9tnbtb.exe 2276 bthnht.exe 2952 1lxrfrf.exe 1552 hhtttb.exe 2156 dvvjv.exe 1256 jjvvp.exe 3048 5xrfxlr.exe 2252 9htbtt.exe 2788 1hhbht.exe 2804 dvpvj.exe 2692 5frxflr.exe 2696 xlflrrx.exe 2672 hnhnbh.exe 2872 pvvdv.exe 2532 pjvdv.exe 3036 xxrlxfl.exe 2848 tnbhnt.exe 2508 hhtbbb.exe 796 7jdjp.exe 1240 rrlrxlx.exe 1788 rlrfffx.exe 1932 nnhnbn.exe 1928 jdpvj.exe 2520 9jjvv.exe 2876 7xrxxlx.exe 2300 1hnbth.exe 2180 hbbntb.exe 2064 jdvjv.exe 956 llflflf.exe 2224 3rffxlr.exe 2096 hnhnht.exe 948 jvpdv.exe 2268 9vvdp.exe 1980 3rlrfrr.exe 1532 ffrlxlx.exe 1008 tttnhb.exe -
resource yara_rule behavioral1/memory/1708-7-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2956-16-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1224-28-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2172-30-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2172-37-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2684-52-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2208-49-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2152-71-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2904-67-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2636-88-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/660-113-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2752-127-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1808-125-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2592-150-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1236-159-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2404-170-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2404-167-0x0000000000220000-0x0000000000248000-memory.dmp upx behavioral1/memory/2416-179-0x0000000000220000-0x0000000000248000-memory.dmp upx behavioral1/memory/2136-197-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1336-234-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2304-249-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2168-268-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2156-301-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1256-306-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1256-313-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/3048-320-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2252-327-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2692-346-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2532-371-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/3036-378-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2508-391-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1788-406-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/796-414-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1928-419-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2180-450-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2096-469-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1336-506-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1336-513-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1532-516-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1584-558-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2548-634-0x0000000000220000-0x0000000000248000-memory.dmp upx behavioral1/memory/1316-648-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/320-661-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2912-805-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2600-924-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1540-933-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1520-1022-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1708-1084-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2788-1122-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1088-1268-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1088-1272-0x0000000000220000-0x0000000000248000-memory.dmp upx behavioral1/memory/3048-1366-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2672-1415-0x0000000000400000-0x0000000000428000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlflxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlllxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7btbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlxxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bbnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1708 wrote to memory of 2956 1708 d63abe588b87bbbc1854f05ee027b12f613a64ebc031c71044fcefc4a0108606.exe 31 PID 1708 wrote to memory of 2956 1708 d63abe588b87bbbc1854f05ee027b12f613a64ebc031c71044fcefc4a0108606.exe 31 PID 1708 wrote to memory of 2956 1708 d63abe588b87bbbc1854f05ee027b12f613a64ebc031c71044fcefc4a0108606.exe 31 PID 1708 wrote to memory of 2956 1708 d63abe588b87bbbc1854f05ee027b12f613a64ebc031c71044fcefc4a0108606.exe 31 PID 2956 wrote to memory of 1224 2956 pppvj.exe 32 PID 2956 wrote to memory of 1224 2956 pppvj.exe 32 PID 2956 wrote to memory of 1224 2956 pppvj.exe 32 PID 2956 wrote to memory of 1224 2956 pppvj.exe 32 PID 1224 wrote to memory of 2172 1224 rrlrrxr.exe 33 PID 1224 wrote to memory of 2172 1224 rrlrrxr.exe 33 PID 1224 wrote to memory of 2172 1224 rrlrrxr.exe 33 PID 1224 wrote to memory of 2172 1224 rrlrrxr.exe 33 PID 2172 wrote to memory of 2208 2172 pjvvd.exe 34 PID 2172 wrote to memory of 2208 2172 pjvvd.exe 34 PID 2172 wrote to memory of 2208 2172 pjvvd.exe 34 PID 2172 wrote to memory of 2208 2172 pjvvd.exe 34 PID 2208 wrote to memory of 2684 2208 ffflfxl.exe 35 PID 2208 wrote to memory of 2684 2208 ffflfxl.exe 35 PID 2208 wrote to memory of 2684 2208 ffflfxl.exe 35 PID 2208 wrote to memory of 2684 2208 ffflfxl.exe 35 PID 2684 wrote to memory of 2904 2684 ntnthb.exe 36 PID 2684 wrote to memory of 2904 2684 ntnthb.exe 36 PID 2684 wrote to memory of 2904 2684 ntnthb.exe 36 PID 2684 wrote to memory of 2904 2684 ntnthb.exe 36 PID 2904 wrote to memory of 2152 2904 dvpvv.exe 37 PID 2904 wrote to memory of 2152 2904 dvpvv.exe 37 PID 2904 wrote to memory of 2152 2904 dvpvv.exe 37 PID 2904 wrote to memory of 2152 2904 dvpvv.exe 37 PID 2152 wrote to memory of 2636 2152 rfrfrxx.exe 38 PID 2152 wrote to memory of 2636 2152 rfrfrxx.exe 38 PID 2152 wrote to memory of 2636 2152 rfrfrxx.exe 38 PID 2152 wrote to memory of 2636 2152 rfrfrxx.exe 38 PID 2636 wrote to memory of 2576 2636 ntnntb.exe 39 PID 2636 wrote to memory of 2576 2636 ntnntb.exe 39 PID 2636 wrote to memory of 2576 2636 ntnntb.exe 39 PID 2636 wrote to memory of 2576 2636 ntnntb.exe 39 PID 2576 wrote to memory of 2604 2576 jjdvp.exe 40 PID 2576 wrote to memory of 2604 2576 jjdvp.exe 40 PID 2576 wrote to memory of 2604 2576 jjdvp.exe 40 PID 2576 wrote to memory of 2604 2576 jjdvp.exe 40 PID 2604 wrote to memory of 660 2604 ttbbhn.exe 41 PID 2604 wrote to memory of 660 2604 ttbbhn.exe 41 PID 2604 wrote to memory of 660 2604 ttbbhn.exe 41 PID 2604 wrote to memory of 660 2604 ttbbhn.exe 41 PID 660 wrote to memory of 1808 660 vvjpj.exe 42 PID 660 wrote to memory of 1808 660 vvjpj.exe 42 PID 660 wrote to memory of 1808 660 vvjpj.exe 42 PID 660 wrote to memory of 1808 660 vvjpj.exe 42 PID 1808 wrote to memory of 2752 1808 hbnbth.exe 43 PID 1808 wrote to memory of 2752 1808 hbnbth.exe 43 PID 1808 wrote to memory of 2752 1808 hbnbth.exe 43 PID 1808 wrote to memory of 2752 1808 hbnbth.exe 43 PID 2752 wrote to memory of 2068 2752 pvjvd.exe 44 PID 2752 wrote to memory of 2068 2752 pvjvd.exe 44 PID 2752 wrote to memory of 2068 2752 pvjvd.exe 44 PID 2752 wrote to memory of 2068 2752 pvjvd.exe 44 PID 2068 wrote to memory of 2592 2068 1nthtb.exe 45 PID 2068 wrote to memory of 2592 2068 1nthtb.exe 45 PID 2068 wrote to memory of 2592 2068 1nthtb.exe 45 PID 2068 wrote to memory of 2592 2068 1nthtb.exe 45 PID 2592 wrote to memory of 1236 2592 ddvpj.exe 46 PID 2592 wrote to memory of 1236 2592 ddvpj.exe 46 PID 2592 wrote to memory of 1236 2592 ddvpj.exe 46 PID 2592 wrote to memory of 1236 2592 ddvpj.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\d63abe588b87bbbc1854f05ee027b12f613a64ebc031c71044fcefc4a0108606.exe"C:\Users\Admin\AppData\Local\Temp\d63abe588b87bbbc1854f05ee027b12f613a64ebc031c71044fcefc4a0108606.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\pppvj.exec:\pppvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\rrlrrxr.exec:\rrlrrxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
\??\c:\pjvvd.exec:\pjvvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\ffflfxl.exec:\ffflfxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\ntnthb.exec:\ntnthb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\dvpvv.exec:\dvpvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\rfrfrxx.exec:\rfrfrxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\ntnntb.exec:\ntnntb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\jjdvp.exec:\jjdvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\ttbbhn.exec:\ttbbhn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\vvjpj.exec:\vvjpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:660 -
\??\c:\hbnbth.exec:\hbnbth.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\pvjvd.exec:\pvjvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\1nthtb.exec:\1nthtb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\ddvpj.exec:\ddvpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\rrlrflf.exec:\rrlrflf.exe17⤵
- Executes dropped EXE
PID:1236 -
\??\c:\hbnthn.exec:\hbnthn.exe18⤵
- Executes dropped EXE
PID:2404 -
\??\c:\ddvdv.exec:\ddvdv.exe19⤵
- Executes dropped EXE
PID:2416 -
\??\c:\5flxxll.exec:\5flxxll.exe20⤵
- Executes dropped EXE
PID:1328 -
\??\c:\dvpvd.exec:\dvpvd.exe21⤵
- Executes dropped EXE
PID:2136 -
\??\c:\xrflxfr.exec:\xrflxfr.exe22⤵
- Executes dropped EXE
PID:948 -
\??\c:\nhbhnb.exec:\nhbhnb.exe23⤵
- Executes dropped EXE
PID:1088 -
\??\c:\lfrrflf.exec:\lfrrflf.exe24⤵
- Executes dropped EXE
PID:1992 -
\??\c:\3tbntb.exec:\3tbntb.exe25⤵
- Executes dropped EXE
PID:1008 -
\??\c:\djvpj.exec:\djvpj.exe26⤵
- Executes dropped EXE
PID:1336 -
\??\c:\jjjvp.exec:\jjjvp.exe27⤵
- Executes dropped EXE
PID:2304 -
\??\c:\xxffxlr.exec:\xxffxlr.exe28⤵
- Executes dropped EXE
PID:380 -
\??\c:\vpdvp.exec:\vpdvp.exe29⤵
- Executes dropped EXE
PID:872 -
\??\c:\9tnbtb.exec:\9tnbtb.exe30⤵
- Executes dropped EXE
PID:2168 -
\??\c:\bthnht.exec:\bthnht.exe31⤵
- Executes dropped EXE
PID:2276 -
\??\c:\1lxrfrf.exec:\1lxrfrf.exe32⤵
- Executes dropped EXE
PID:2952 -
\??\c:\hhtttb.exec:\hhtttb.exe33⤵
- Executes dropped EXE
PID:1552 -
\??\c:\dvvjv.exec:\dvvjv.exe34⤵
- Executes dropped EXE
PID:2156 -
\??\c:\jjvvp.exec:\jjvvp.exe35⤵
- Executes dropped EXE
PID:1256 -
\??\c:\5xrfxlr.exec:\5xrfxlr.exe36⤵
- Executes dropped EXE
PID:3048 -
\??\c:\9htbtt.exec:\9htbtt.exe37⤵
- Executes dropped EXE
PID:2252 -
\??\c:\1hhbht.exec:\1hhbht.exe38⤵
- Executes dropped EXE
PID:2788 -
\??\c:\dvpvj.exec:\dvpvj.exe39⤵
- Executes dropped EXE
PID:2804 -
\??\c:\5frxflr.exec:\5frxflr.exe40⤵
- Executes dropped EXE
PID:2692 -
\??\c:\xlflrrx.exec:\xlflrrx.exe41⤵
- Executes dropped EXE
PID:2696 -
\??\c:\hnhnbh.exec:\hnhnbh.exe42⤵
- Executes dropped EXE
PID:2672 -
\??\c:\pvvdv.exec:\pvvdv.exe43⤵
- Executes dropped EXE
PID:2872 -
\??\c:\pjvdv.exec:\pjvdv.exe44⤵
- Executes dropped EXE
PID:2532 -
\??\c:\xxrlxfl.exec:\xxrlxfl.exe45⤵
- Executes dropped EXE
PID:3036 -
\??\c:\tnbhnt.exec:\tnbhnt.exe46⤵
- Executes dropped EXE
PID:2848 -
\??\c:\hhtbbb.exec:\hhtbbb.exe47⤵
- Executes dropped EXE
PID:2508 -
\??\c:\7jdjp.exec:\7jdjp.exe48⤵
- Executes dropped EXE
PID:796 -
\??\c:\rrlrxlx.exec:\rrlrxlx.exe49⤵
- Executes dropped EXE
PID:1240 -
\??\c:\rlrfffx.exec:\rlrfffx.exe50⤵
- Executes dropped EXE
PID:1788 -
\??\c:\nnhnbn.exec:\nnhnbn.exe51⤵
- Executes dropped EXE
PID:1932 -
\??\c:\jdpvj.exec:\jdpvj.exe52⤵
- Executes dropped EXE
PID:1928 -
\??\c:\9jjvv.exec:\9jjvv.exe53⤵
- Executes dropped EXE
PID:2520 -
\??\c:\7xrxxlx.exec:\7xrxxlx.exe54⤵
- Executes dropped EXE
PID:2876 -
\??\c:\1hnbth.exec:\1hnbth.exe55⤵
- Executes dropped EXE
PID:2300 -
\??\c:\hbbntb.exec:\hbbntb.exe56⤵
- Executes dropped EXE
PID:2180 -
\??\c:\jdvjv.exec:\jdvjv.exe57⤵
- Executes dropped EXE
PID:2064 -
\??\c:\llflflf.exec:\llflflf.exe58⤵
- Executes dropped EXE
PID:956 -
\??\c:\3rffxlr.exec:\3rffxlr.exe59⤵
- Executes dropped EXE
PID:2224 -
\??\c:\hnhnht.exec:\hnhnht.exe60⤵
- Executes dropped EXE
PID:2096 -
\??\c:\jvpdv.exec:\jvpdv.exe61⤵
- Executes dropped EXE
PID:948 -
\??\c:\9vvdp.exec:\9vvdp.exe62⤵
- Executes dropped EXE
PID:2268 -
\??\c:\3rlrfrr.exec:\3rlrfrr.exe63⤵
- Executes dropped EXE
PID:1980 -
\??\c:\ffrlxlx.exec:\ffrlxlx.exe64⤵
- Executes dropped EXE
PID:1532 -
\??\c:\tttnhb.exec:\tttnhb.exe65⤵
- Executes dropped EXE
PID:1008 -
\??\c:\vpjpv.exec:\vpjpv.exe66⤵PID:1336
-
\??\c:\jppjd.exec:\jppjd.exe67⤵PID:1324
-
\??\c:\flxxxfx.exec:\flxxxfx.exe68⤵PID:2296
-
\??\c:\bntntt.exec:\bntntt.exe69⤵PID:2488
-
\??\c:\7djdd.exec:\7djdd.exe70⤵PID:2392
-
\??\c:\jjjpv.exec:\jjjpv.exe71⤵PID:2168
-
\??\c:\rlffllr.exec:\rlffllr.exe72⤵PID:1044
-
\??\c:\rlffxfr.exec:\rlffxfr.exe73⤵PID:1584
-
\??\c:\bhbttn.exec:\bhbttn.exe74⤵PID:1580
-
\??\c:\jjjvj.exec:\jjjvj.exe75⤵PID:1444
-
\??\c:\jdvpd.exec:\jdvpd.exe76⤵PID:1792
-
\??\c:\rrflxlx.exec:\rrflxlx.exe77⤵PID:3060
-
\??\c:\5thntb.exec:\5thntb.exe78⤵PID:1292
-
\??\c:\3nbnnn.exec:\3nbnnn.exe79⤵PID:2208
-
\??\c:\vvpdp.exec:\vvpdp.exe80⤵PID:2780
-
\??\c:\ddvvj.exec:\ddvvj.exe81⤵PID:2816
-
\??\c:\xrlrlrx.exec:\xrlrlrx.exe82⤵PID:2784
-
\??\c:\hhhnbt.exec:\hhhnbt.exe83⤵PID:3032
-
\??\c:\9jpvv.exec:\9jpvv.exe84⤵PID:2832
-
\??\c:\3vpvp.exec:\3vpvp.exe85⤵PID:2548
-
\??\c:\rrrfrxl.exec:\rrrfrxl.exe86⤵PID:2576
-
\??\c:\lflxfxx.exec:\lflxfxx.exe87⤵PID:2564
-
\??\c:\nhbhnt.exec:\nhbhnt.exe88⤵PID:1316
-
\??\c:\nnnbth.exec:\nnnbth.exe89⤵PID:2364
-
\??\c:\jdjpj.exec:\jdjpj.exe90⤵PID:320
-
\??\c:\rlrxlxf.exec:\rlrxlxf.exe91⤵PID:1784
-
\??\c:\nbtbnh.exec:\nbtbnh.exe92⤵
- System Location Discovery: System Language Discovery
PID:2360 -
\??\c:\hhttnt.exec:\hhttnt.exe93⤵PID:2088
-
\??\c:\ppjpd.exec:\ppjpd.exe94⤵PID:540
-
\??\c:\ddvdd.exec:\ddvdd.exe95⤵PID:108
-
\??\c:\fxrflrf.exec:\fxrflrf.exe96⤵PID:2112
-
\??\c:\nnhbtn.exec:\nnhbtn.exe97⤵PID:2944
-
\??\c:\7tntbn.exec:\7tntbn.exe98⤵PID:3000
-
\??\c:\dvpvj.exec:\dvpvj.exe99⤵PID:2924
-
\??\c:\dvpvj.exec:\dvpvj.exe100⤵PID:2064
-
\??\c:\3lflxrx.exec:\3lflxrx.exe101⤵PID:672
-
\??\c:\xrxrffr.exec:\xrxrffr.exe102⤵PID:1396
-
\??\c:\nnhtnt.exec:\nnhtnt.exe103⤵PID:1356
-
\??\c:\jdvdp.exec:\jdvdp.exe104⤵PID:932
-
\??\c:\ddpvd.exec:\ddpvd.exe105⤵PID:1048
-
\??\c:\fxlrrfl.exec:\fxlrrfl.exe106⤵PID:1520
-
\??\c:\ffrflrr.exec:\ffrflrr.exe107⤵PID:2080
-
\??\c:\hbbtnb.exec:\hbbtnb.exe108⤵PID:1748
-
\??\c:\jdpvd.exec:\jdpvd.exe109⤵PID:2308
-
\??\c:\3pddd.exec:\3pddd.exe110⤵PID:1528
-
\??\c:\xrlxlrf.exec:\xrlxlrf.exe111⤵PID:1252
-
\??\c:\tnbbhh.exec:\tnbbhh.exe112⤵PID:1732
-
\??\c:\hhhttt.exec:\hhhttt.exe113⤵PID:1684
-
\??\c:\pjvvv.exec:\pjvvv.exe114⤵PID:2912
-
\??\c:\xrxfflx.exec:\xrxfflx.exe115⤵PID:2336
-
\??\c:\ffffrrf.exec:\ffffrrf.exe116⤵PID:2084
-
\??\c:\1nbnbn.exec:\1nbnbn.exe117⤵PID:3024
-
\??\c:\dvdjv.exec:\dvdjv.exe118⤵PID:2500
-
\??\c:\5vppd.exec:\5vppd.exe119⤵PID:1224
-
\??\c:\xrrxlrf.exec:\xrrxlrf.exe120⤵PID:1256
-
\??\c:\3nnbhn.exec:\3nnbhn.exe121⤵PID:2644
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-