Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24-11-2024 03:47
Static task
static1
Behavioral task
behavioral1
Sample
d63abe588b87bbbc1854f05ee027b12f613a64ebc031c71044fcefc4a0108606.exe
Resource
win7-20240903-en
General
-
Target
d63abe588b87bbbc1854f05ee027b12f613a64ebc031c71044fcefc4a0108606.exe
-
Size
349KB
-
MD5
c127df286098c6e50dcc0f98b10238be
-
SHA1
01493860a0e40fa19b8e9787316dc79f9db6d558
-
SHA256
d63abe588b87bbbc1854f05ee027b12f613a64ebc031c71044fcefc4a0108606
-
SHA512
d005189b32569ca993f161e097f60762db154c053fdd432f1c2dd3c853ffdb8399acfec88e77cef27048b4c7ddbde2e08c2cbcbf7162eda1e5c4615db3f473d1
-
SSDEEP
6144:Xcm7ImGddXgYW5fNZWB5hFfci3Add4kGYA4K:l7TcbWXZshJX2VGd4K
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 50 IoCs
Processes:
resource yara_rule behavioral1/memory/1708-7-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2956-16-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1224-28-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1224-26-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2172-37-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2684-52-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2208-49-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2208-47-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2152-71-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2904-67-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2904-62-0x00000000001B0000-0x00000000001D8000-memory.dmp family_blackmoon behavioral1/memory/2636-88-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2636-84-0x0000000000250000-0x0000000000278000-memory.dmp family_blackmoon behavioral1/memory/2636-86-0x0000000000250000-0x0000000000278000-memory.dmp family_blackmoon behavioral1/memory/660-113-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2752-127-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1808-125-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2592-150-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1236-159-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2404-170-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2404-167-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2416-179-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2136-197-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1336-234-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2304-249-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2168-268-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2156-301-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1256-313-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/3048-320-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2252-327-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2692-346-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2532-371-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/3036-378-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2508-391-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1240-404-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1788-406-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2180-450-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2096-469-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1336-513-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2392-539-0x0000000000250000-0x0000000000278000-memory.dmp family_blackmoon behavioral1/memory/1584-558-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2208-598-0x00000000001B0000-0x00000000001D8000-memory.dmp family_blackmoon behavioral1/memory/2548-634-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1316-648-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/320-664-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1528-785-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1684-804-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2084-817-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1708-1084-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1088-1272-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
pppvj.exerrlrrxr.exepjvvd.exeffflfxl.exentnthb.exedvpvv.exerfrfrxx.exentnntb.exejjdvp.exettbbhn.exevvjpj.exehbnbth.exepvjvd.exe1nthtb.exeddvpj.exerrlrflf.exehbnthn.exeddvdv.exe5flxxll.exedvpvd.exexrflxfr.exenhbhnb.exelfrrflf.exe3tbntb.exedjvpj.exejjjvp.exexxffxlr.exevpdvp.exe9tnbtb.exebthnht.exe1lxrfrf.exehhtttb.exedvvjv.exejjvvp.exe5xrfxlr.exe9htbtt.exe1hhbht.exedvpvj.exe5frxflr.exexlflrrx.exehnhnbh.exepvvdv.exepjvdv.exexxrlxfl.exetnbhnt.exehhtbbb.exe7jdjp.exerrlrxlx.exerlrfffx.exennhnbn.exejdpvj.exe9jjvv.exe7xrxxlx.exe1hnbth.exehbbntb.exejdvjv.exellflflf.exe3rffxlr.exehnhnht.exejvpdv.exe9vvdp.exe3rlrfrr.exeffrlxlx.exetttnhb.exepid process 2956 pppvj.exe 1224 rrlrrxr.exe 2172 pjvvd.exe 2208 ffflfxl.exe 2684 ntnthb.exe 2904 dvpvv.exe 2152 rfrfrxx.exe 2636 ntnntb.exe 2576 jjdvp.exe 2604 ttbbhn.exe 660 vvjpj.exe 1808 hbnbth.exe 2752 pvjvd.exe 2068 1nthtb.exe 2592 ddvpj.exe 1236 rrlrflf.exe 2404 hbnthn.exe 2416 ddvdv.exe 1328 5flxxll.exe 2136 dvpvd.exe 948 xrflxfr.exe 1088 nhbhnb.exe 1992 lfrrflf.exe 1008 3tbntb.exe 1336 djvpj.exe 2304 jjjvp.exe 380 xxffxlr.exe 872 vpdvp.exe 2168 9tnbtb.exe 2276 bthnht.exe 2952 1lxrfrf.exe 1552 hhtttb.exe 2156 dvvjv.exe 1256 jjvvp.exe 3048 5xrfxlr.exe 2252 9htbtt.exe 2788 1hhbht.exe 2804 dvpvj.exe 2692 5frxflr.exe 2696 xlflrrx.exe 2672 hnhnbh.exe 2872 pvvdv.exe 2532 pjvdv.exe 3036 xxrlxfl.exe 2848 tnbhnt.exe 2508 hhtbbb.exe 796 7jdjp.exe 1240 rrlrxlx.exe 1788 rlrfffx.exe 1932 nnhnbn.exe 1928 jdpvj.exe 2520 9jjvv.exe 2876 7xrxxlx.exe 2300 1hnbth.exe 2180 hbbntb.exe 2064 jdvjv.exe 956 llflflf.exe 2224 3rffxlr.exe 2096 hnhnht.exe 948 jvpdv.exe 2268 9vvdp.exe 1980 3rlrfrr.exe 1532 ffrlxlx.exe 1008 tttnhb.exe -
Processes:
resource yara_rule behavioral1/memory/1708-7-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2956-16-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1224-28-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2172-30-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2172-37-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2684-52-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2208-49-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2152-71-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2904-67-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2636-88-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/660-113-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2752-127-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1808-125-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2592-150-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1236-159-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2404-170-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2404-167-0x0000000000220000-0x0000000000248000-memory.dmp upx behavioral1/memory/2416-179-0x0000000000220000-0x0000000000248000-memory.dmp upx behavioral1/memory/2136-197-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1336-234-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2304-249-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2168-268-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2156-301-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1256-306-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1256-313-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/3048-320-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2252-327-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2692-346-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2532-371-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/3036-378-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2508-391-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1788-406-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/796-414-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1928-419-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2180-450-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2096-469-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1336-506-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1336-513-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1532-516-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1584-558-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2548-634-0x0000000000220000-0x0000000000248000-memory.dmp upx behavioral1/memory/1316-648-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/320-661-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2912-805-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2600-924-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1540-933-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1520-1022-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1708-1084-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2788-1122-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1088-1268-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1088-1272-0x0000000000220000-0x0000000000248000-memory.dmp upx behavioral1/memory/3048-1366-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2672-1415-0x0000000000400000-0x0000000000428000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
rlflxlx.exevvvjd.exenbtbnh.exexlllxlf.exetntbhn.exe1jdpd.exebbnthn.exe5jvdd.exetthbtn.exe7btbnt.exebnbhhn.exexrlxxfx.exe9jdpd.exe5bbnbh.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlflxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlllxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7btbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlxxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bbnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d63abe588b87bbbc1854f05ee027b12f613a64ebc031c71044fcefc4a0108606.exepppvj.exerrlrrxr.exepjvvd.exeffflfxl.exentnthb.exedvpvv.exerfrfrxx.exentnntb.exejjdvp.exettbbhn.exevvjpj.exehbnbth.exepvjvd.exe1nthtb.exeddvpj.exedescription pid process target process PID 1708 wrote to memory of 2956 1708 d63abe588b87bbbc1854f05ee027b12f613a64ebc031c71044fcefc4a0108606.exe pppvj.exe PID 1708 wrote to memory of 2956 1708 d63abe588b87bbbc1854f05ee027b12f613a64ebc031c71044fcefc4a0108606.exe pppvj.exe PID 1708 wrote to memory of 2956 1708 d63abe588b87bbbc1854f05ee027b12f613a64ebc031c71044fcefc4a0108606.exe pppvj.exe PID 1708 wrote to memory of 2956 1708 d63abe588b87bbbc1854f05ee027b12f613a64ebc031c71044fcefc4a0108606.exe pppvj.exe PID 2956 wrote to memory of 1224 2956 pppvj.exe rrlrrxr.exe PID 2956 wrote to memory of 1224 2956 pppvj.exe rrlrrxr.exe PID 2956 wrote to memory of 1224 2956 pppvj.exe rrlrrxr.exe PID 2956 wrote to memory of 1224 2956 pppvj.exe rrlrrxr.exe PID 1224 wrote to memory of 2172 1224 rrlrrxr.exe pjvvd.exe PID 1224 wrote to memory of 2172 1224 rrlrrxr.exe pjvvd.exe PID 1224 wrote to memory of 2172 1224 rrlrrxr.exe pjvvd.exe PID 1224 wrote to memory of 2172 1224 rrlrrxr.exe pjvvd.exe PID 2172 wrote to memory of 2208 2172 pjvvd.exe ffflfxl.exe PID 2172 wrote to memory of 2208 2172 pjvvd.exe ffflfxl.exe PID 2172 wrote to memory of 2208 2172 pjvvd.exe ffflfxl.exe PID 2172 wrote to memory of 2208 2172 pjvvd.exe ffflfxl.exe PID 2208 wrote to memory of 2684 2208 ffflfxl.exe ntnthb.exe PID 2208 wrote to memory of 2684 2208 ffflfxl.exe ntnthb.exe PID 2208 wrote to memory of 2684 2208 ffflfxl.exe ntnthb.exe PID 2208 wrote to memory of 2684 2208 ffflfxl.exe ntnthb.exe PID 2684 wrote to memory of 2904 2684 ntnthb.exe dvpvv.exe PID 2684 wrote to memory of 2904 2684 ntnthb.exe dvpvv.exe PID 2684 wrote to memory of 2904 2684 ntnthb.exe dvpvv.exe PID 2684 wrote to memory of 2904 2684 ntnthb.exe dvpvv.exe PID 2904 wrote to memory of 2152 2904 dvpvv.exe rfrfrxx.exe PID 2904 wrote to memory of 2152 2904 dvpvv.exe rfrfrxx.exe PID 2904 wrote to memory of 2152 2904 dvpvv.exe rfrfrxx.exe PID 2904 wrote to memory of 2152 2904 dvpvv.exe rfrfrxx.exe PID 2152 wrote to memory of 2636 2152 rfrfrxx.exe ntnntb.exe PID 2152 wrote to memory of 2636 2152 rfrfrxx.exe ntnntb.exe PID 2152 wrote to memory of 2636 2152 rfrfrxx.exe ntnntb.exe PID 2152 wrote to memory of 2636 2152 rfrfrxx.exe ntnntb.exe PID 2636 wrote to memory of 2576 2636 ntnntb.exe jjdvp.exe PID 2636 wrote to memory of 2576 2636 ntnntb.exe jjdvp.exe PID 2636 wrote to memory of 2576 2636 ntnntb.exe jjdvp.exe PID 2636 wrote to memory of 2576 2636 ntnntb.exe jjdvp.exe PID 2576 wrote to memory of 2604 2576 jjdvp.exe ttbbhn.exe PID 2576 wrote to memory of 2604 2576 jjdvp.exe ttbbhn.exe PID 2576 wrote to memory of 2604 2576 jjdvp.exe ttbbhn.exe PID 2576 wrote to memory of 2604 2576 jjdvp.exe ttbbhn.exe PID 2604 wrote to memory of 660 2604 ttbbhn.exe vvjpj.exe PID 2604 wrote to memory of 660 2604 ttbbhn.exe vvjpj.exe PID 2604 wrote to memory of 660 2604 ttbbhn.exe vvjpj.exe PID 2604 wrote to memory of 660 2604 ttbbhn.exe vvjpj.exe PID 660 wrote to memory of 1808 660 vvjpj.exe hbnbth.exe PID 660 wrote to memory of 1808 660 vvjpj.exe hbnbth.exe PID 660 wrote to memory of 1808 660 vvjpj.exe hbnbth.exe PID 660 wrote to memory of 1808 660 vvjpj.exe hbnbth.exe PID 1808 wrote to memory of 2752 1808 hbnbth.exe pvjvd.exe PID 1808 wrote to memory of 2752 1808 hbnbth.exe pvjvd.exe PID 1808 wrote to memory of 2752 1808 hbnbth.exe pvjvd.exe PID 1808 wrote to memory of 2752 1808 hbnbth.exe pvjvd.exe PID 2752 wrote to memory of 2068 2752 pvjvd.exe 1nthtb.exe PID 2752 wrote to memory of 2068 2752 pvjvd.exe 1nthtb.exe PID 2752 wrote to memory of 2068 2752 pvjvd.exe 1nthtb.exe PID 2752 wrote to memory of 2068 2752 pvjvd.exe 1nthtb.exe PID 2068 wrote to memory of 2592 2068 1nthtb.exe ddvpj.exe PID 2068 wrote to memory of 2592 2068 1nthtb.exe ddvpj.exe PID 2068 wrote to memory of 2592 2068 1nthtb.exe ddvpj.exe PID 2068 wrote to memory of 2592 2068 1nthtb.exe ddvpj.exe PID 2592 wrote to memory of 1236 2592 ddvpj.exe rrlrflf.exe PID 2592 wrote to memory of 1236 2592 ddvpj.exe rrlrflf.exe PID 2592 wrote to memory of 1236 2592 ddvpj.exe rrlrflf.exe PID 2592 wrote to memory of 1236 2592 ddvpj.exe rrlrflf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d63abe588b87bbbc1854f05ee027b12f613a64ebc031c71044fcefc4a0108606.exe"C:\Users\Admin\AppData\Local\Temp\d63abe588b87bbbc1854f05ee027b12f613a64ebc031c71044fcefc4a0108606.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\pppvj.exec:\pppvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\rrlrrxr.exec:\rrlrrxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
\??\c:\pjvvd.exec:\pjvvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\ffflfxl.exec:\ffflfxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\ntnthb.exec:\ntnthb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\dvpvv.exec:\dvpvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\rfrfrxx.exec:\rfrfrxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\ntnntb.exec:\ntnntb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\jjdvp.exec:\jjdvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\ttbbhn.exec:\ttbbhn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\vvjpj.exec:\vvjpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:660 -
\??\c:\hbnbth.exec:\hbnbth.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\pvjvd.exec:\pvjvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\1nthtb.exec:\1nthtb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\ddvpj.exec:\ddvpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\rrlrflf.exec:\rrlrflf.exe17⤵
- Executes dropped EXE
PID:1236 -
\??\c:\hbnthn.exec:\hbnthn.exe18⤵
- Executes dropped EXE
PID:2404 -
\??\c:\ddvdv.exec:\ddvdv.exe19⤵
- Executes dropped EXE
PID:2416 -
\??\c:\5flxxll.exec:\5flxxll.exe20⤵
- Executes dropped EXE
PID:1328 -
\??\c:\dvpvd.exec:\dvpvd.exe21⤵
- Executes dropped EXE
PID:2136 -
\??\c:\xrflxfr.exec:\xrflxfr.exe22⤵
- Executes dropped EXE
PID:948 -
\??\c:\nhbhnb.exec:\nhbhnb.exe23⤵
- Executes dropped EXE
PID:1088 -
\??\c:\lfrrflf.exec:\lfrrflf.exe24⤵
- Executes dropped EXE
PID:1992 -
\??\c:\3tbntb.exec:\3tbntb.exe25⤵
- Executes dropped EXE
PID:1008 -
\??\c:\djvpj.exec:\djvpj.exe26⤵
- Executes dropped EXE
PID:1336 -
\??\c:\jjjvp.exec:\jjjvp.exe27⤵
- Executes dropped EXE
PID:2304 -
\??\c:\xxffxlr.exec:\xxffxlr.exe28⤵
- Executes dropped EXE
PID:380 -
\??\c:\vpdvp.exec:\vpdvp.exe29⤵
- Executes dropped EXE
PID:872 -
\??\c:\9tnbtb.exec:\9tnbtb.exe30⤵
- Executes dropped EXE
PID:2168 -
\??\c:\bthnht.exec:\bthnht.exe31⤵
- Executes dropped EXE
PID:2276 -
\??\c:\1lxrfrf.exec:\1lxrfrf.exe32⤵
- Executes dropped EXE
PID:2952 -
\??\c:\hhtttb.exec:\hhtttb.exe33⤵
- Executes dropped EXE
PID:1552 -
\??\c:\dvvjv.exec:\dvvjv.exe34⤵
- Executes dropped EXE
PID:2156 -
\??\c:\jjvvp.exec:\jjvvp.exe35⤵
- Executes dropped EXE
PID:1256 -
\??\c:\5xrfxlr.exec:\5xrfxlr.exe36⤵
- Executes dropped EXE
PID:3048 -
\??\c:\9htbtt.exec:\9htbtt.exe37⤵
- Executes dropped EXE
PID:2252 -
\??\c:\1hhbht.exec:\1hhbht.exe38⤵
- Executes dropped EXE
PID:2788 -
\??\c:\dvpvj.exec:\dvpvj.exe39⤵
- Executes dropped EXE
PID:2804 -
\??\c:\5frxflr.exec:\5frxflr.exe40⤵
- Executes dropped EXE
PID:2692 -
\??\c:\xlflrrx.exec:\xlflrrx.exe41⤵
- Executes dropped EXE
PID:2696 -
\??\c:\hnhnbh.exec:\hnhnbh.exe42⤵
- Executes dropped EXE
PID:2672 -
\??\c:\pvvdv.exec:\pvvdv.exe43⤵
- Executes dropped EXE
PID:2872 -
\??\c:\pjvdv.exec:\pjvdv.exe44⤵
- Executes dropped EXE
PID:2532 -
\??\c:\xxrlxfl.exec:\xxrlxfl.exe45⤵
- Executes dropped EXE
PID:3036 -
\??\c:\tnbhnt.exec:\tnbhnt.exe46⤵
- Executes dropped EXE
PID:2848 -
\??\c:\hhtbbb.exec:\hhtbbb.exe47⤵
- Executes dropped EXE
PID:2508 -
\??\c:\7jdjp.exec:\7jdjp.exe48⤵
- Executes dropped EXE
PID:796 -
\??\c:\rrlrxlx.exec:\rrlrxlx.exe49⤵
- Executes dropped EXE
PID:1240 -
\??\c:\rlrfffx.exec:\rlrfffx.exe50⤵
- Executes dropped EXE
PID:1788 -
\??\c:\nnhnbn.exec:\nnhnbn.exe51⤵
- Executes dropped EXE
PID:1932 -
\??\c:\jdpvj.exec:\jdpvj.exe52⤵
- Executes dropped EXE
PID:1928 -
\??\c:\9jjvv.exec:\9jjvv.exe53⤵
- Executes dropped EXE
PID:2520 -
\??\c:\7xrxxlx.exec:\7xrxxlx.exe54⤵
- Executes dropped EXE
PID:2876 -
\??\c:\1hnbth.exec:\1hnbth.exe55⤵
- Executes dropped EXE
PID:2300 -
\??\c:\hbbntb.exec:\hbbntb.exe56⤵
- Executes dropped EXE
PID:2180 -
\??\c:\jdvjv.exec:\jdvjv.exe57⤵
- Executes dropped EXE
PID:2064 -
\??\c:\llflflf.exec:\llflflf.exe58⤵
- Executes dropped EXE
PID:956 -
\??\c:\3rffxlr.exec:\3rffxlr.exe59⤵
- Executes dropped EXE
PID:2224 -
\??\c:\hnhnht.exec:\hnhnht.exe60⤵
- Executes dropped EXE
PID:2096 -
\??\c:\jvpdv.exec:\jvpdv.exe61⤵
- Executes dropped EXE
PID:948 -
\??\c:\9vvdp.exec:\9vvdp.exe62⤵
- Executes dropped EXE
PID:2268 -
\??\c:\3rlrfrr.exec:\3rlrfrr.exe63⤵
- Executes dropped EXE
PID:1980 -
\??\c:\ffrlxlx.exec:\ffrlxlx.exe64⤵
- Executes dropped EXE
PID:1532 -
\??\c:\tttnhb.exec:\tttnhb.exe65⤵
- Executes dropped EXE
PID:1008 -
\??\c:\vpjpv.exec:\vpjpv.exe66⤵PID:1336
-
\??\c:\jppjd.exec:\jppjd.exe67⤵PID:1324
-
\??\c:\flxxxfx.exec:\flxxxfx.exe68⤵PID:2296
-
\??\c:\bntntt.exec:\bntntt.exe69⤵PID:2488
-
\??\c:\7djdd.exec:\7djdd.exe70⤵PID:2392
-
\??\c:\jjjpv.exec:\jjjpv.exe71⤵PID:2168
-
\??\c:\rlffllr.exec:\rlffllr.exe72⤵PID:1044
-
\??\c:\rlffxfr.exec:\rlffxfr.exe73⤵PID:1584
-
\??\c:\bhbttn.exec:\bhbttn.exe74⤵PID:1580
-
\??\c:\jjjvj.exec:\jjjvj.exe75⤵PID:1444
-
\??\c:\jdvpd.exec:\jdvpd.exe76⤵PID:1792
-
\??\c:\rrflxlx.exec:\rrflxlx.exe77⤵PID:3060
-
\??\c:\5thntb.exec:\5thntb.exe78⤵PID:1292
-
\??\c:\3nbnnn.exec:\3nbnnn.exe79⤵PID:2208
-
\??\c:\vvpdp.exec:\vvpdp.exe80⤵PID:2780
-
\??\c:\ddvvj.exec:\ddvvj.exe81⤵PID:2816
-
\??\c:\xrlrlrx.exec:\xrlrlrx.exe82⤵PID:2784
-
\??\c:\hhhnbt.exec:\hhhnbt.exe83⤵PID:3032
-
\??\c:\9jpvv.exec:\9jpvv.exe84⤵PID:2832
-
\??\c:\3vpvp.exec:\3vpvp.exe85⤵PID:2548
-
\??\c:\rrrfrxl.exec:\rrrfrxl.exe86⤵PID:2576
-
\??\c:\lflxfxx.exec:\lflxfxx.exe87⤵PID:2564
-
\??\c:\nhbhnt.exec:\nhbhnt.exe88⤵PID:1316
-
\??\c:\nnnbth.exec:\nnnbth.exe89⤵PID:2364
-
\??\c:\jdjpj.exec:\jdjpj.exe90⤵PID:320
-
\??\c:\rlrxlxf.exec:\rlrxlxf.exe91⤵PID:1784
-
\??\c:\nbtbnh.exec:\nbtbnh.exe92⤵
- System Location Discovery: System Language Discovery
PID:2360 -
\??\c:\hhttnt.exec:\hhttnt.exe93⤵PID:2088
-
\??\c:\ppjpd.exec:\ppjpd.exe94⤵PID:540
-
\??\c:\ddvdd.exec:\ddvdd.exe95⤵PID:108
-
\??\c:\fxrflrf.exec:\fxrflrf.exe96⤵PID:2112
-
\??\c:\nnhbtn.exec:\nnhbtn.exe97⤵PID:2944
-
\??\c:\7tntbn.exec:\7tntbn.exe98⤵PID:3000
-
\??\c:\dvpvj.exec:\dvpvj.exe99⤵PID:2924
-
\??\c:\dvpvj.exec:\dvpvj.exe100⤵PID:2064
-
\??\c:\3lflxrx.exec:\3lflxrx.exe101⤵PID:672
-
\??\c:\xrxrffr.exec:\xrxrffr.exe102⤵PID:1396
-
\??\c:\nnhtnt.exec:\nnhtnt.exe103⤵PID:1356
-
\??\c:\jdvdp.exec:\jdvdp.exe104⤵PID:932
-
\??\c:\ddpvd.exec:\ddpvd.exe105⤵PID:1048
-
\??\c:\fxlrrfl.exec:\fxlrrfl.exe106⤵PID:1520
-
\??\c:\ffrflrr.exec:\ffrflrr.exe107⤵PID:2080
-
\??\c:\hbbtnb.exec:\hbbtnb.exe108⤵PID:1748
-
\??\c:\jdpvd.exec:\jdpvd.exe109⤵PID:2308
-
\??\c:\3pddd.exec:\3pddd.exe110⤵PID:1528
-
\??\c:\xrlxlrf.exec:\xrlxlrf.exe111⤵PID:1252
-
\??\c:\tnbbhh.exec:\tnbbhh.exe112⤵PID:1732
-
\??\c:\hhhttt.exec:\hhhttt.exe113⤵PID:1684
-
\??\c:\pjvvv.exec:\pjvvv.exe114⤵PID:2912
-
\??\c:\xrxfflx.exec:\xrxfflx.exe115⤵PID:2336
-
\??\c:\ffffrrf.exec:\ffffrrf.exe116⤵PID:2084
-
\??\c:\1nbnbn.exec:\1nbnbn.exe117⤵PID:3024
-
\??\c:\dvdjv.exec:\dvdjv.exe118⤵PID:2500
-
\??\c:\5vppd.exec:\5vppd.exe119⤵PID:1224
-
\??\c:\xrrxlrf.exec:\xrrxlrf.exe120⤵PID:1256
-
\??\c:\3nnbhn.exec:\3nnbhn.exe121⤵PID:2644
-
\??\c:\hbnnbh.exec:\hbnnbh.exe122⤵PID:2852
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-