Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24-11-2024 05:19
Behavioral task
behavioral1
Sample
025363a853d4fd548ae83c95ae4e3dbac9d16b04e2ec92126363cb9fd83568c6.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
025363a853d4fd548ae83c95ae4e3dbac9d16b04e2ec92126363cb9fd83568c6.exe
-
Size
127KB
-
MD5
37087dfa868e04dc799d9f2ec998c28b
-
SHA1
c7513b127e2d1e57dad4c55ad114a498e454bd05
-
SHA256
025363a853d4fd548ae83c95ae4e3dbac9d16b04e2ec92126363cb9fd83568c6
-
SHA512
17ad5981bf0611528a2dd0f9f8dd01bd2c454a62704e81eabb371123ee48dd4a495111d3efaeeffb471434b66ba5fb70c752ba0af9d2905fdf7847d4b3e627fa
-
SSDEEP
3072:chOmTsF93UYfwC6GIout5pi8rY9AABa1JePQKN1hJCJ2owWT:ccm4FmowdHoS5ddW7Y6XJCJ9T
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 54 IoCs
resource yara_rule behavioral1/memory/2084-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2372-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2992-22-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2544-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2848-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2860-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2988-80-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2988-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2696-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2112-117-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2112-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1836-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1840-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1624-154-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/1624-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2460-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/536-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2124-206-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2124-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1172-226-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1876-238-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2256-247-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2076-260-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/352-279-0x00000000003D0000-0x00000000003F7000-memory.dmp family_blackmoon behavioral1/memory/352-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2372-304-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1484-311-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2796-336-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2836-350-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2688-369-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2580-377-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2580-375-0x00000000005C0000-0x00000000005E7000-memory.dmp family_blackmoon behavioral1/memory/2208-396-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1936-433-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1624-440-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1952-443-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1564-453-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2172-459-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2172-462-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1392-469-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3052-500-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2280-547-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/1628-581-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/2700-619-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2112-674-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1612-731-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1304-787-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/968-800-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2680-893-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1016-970-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1192-983-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1820-1242-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1428-1250-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2336-1335-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2372 tthtbh.exe 2992 pjddp.exe 2544 lllfllf.exe 2684 djpdv.exe 2820 jddjv.exe 2848 flrrlfl.exe 2860 tnhttt.exe 2988 7dvvd.exe 2576 rfllrxl.exe 2696 9xxlxxf.exe 2208 1pdvv.exe 2112 dpvpv.exe 1836 lfrrxxf.exe 1840 hnnntt.exe 1888 vppvj.exe 1624 1lrxlrf.exe 1656 5bbtbh.exe 1420 nhtbth.exe 2460 jdjjp.exe 2952 5rfllrl.exe 536 tttnbb.exe 2124 jvpjd.exe 2920 lllrfrl.exe 1172 1hbnhn.exe 1876 hbthtb.exe 904 1vjpv.exe 2256 xxflflr.exe 2076 5btnnb.exe 1920 jdjdp.exe 352 xfxrfrl.exe 1860 nnhnnh.exe 2264 bbtbbt.exe 2372 pdvvd.exe 1484 nnnhbh.exe 2520 vvdjp.exe 3056 jjjpv.exe 2704 xrlrlxl.exe 2796 5xxlxxf.exe 2680 hhbthb.exe 2836 hbthhh.exe 3044 ppddj.exe 2712 7xrlflf.exe 2688 frlrrll.exe 2580 tnhnhh.exe 2608 5pjdp.exe 1632 3jdjp.exe 2208 rlrrxxl.exe 1388 hbbnht.exe 1940 bbthbh.exe 1856 pvjjv.exe 2416 rrlflfr.exe 1900 ffxflfl.exe 1936 tthtbn.exe 1624 ntbntt.exe 1952 vdpjd.exe 1564 flffrxf.exe 2172 tnthbh.exe 1392 tnntbb.exe 2216 7dvvj.exe 1832 fllxlfx.exe 2248 hhnthh.exe 916 hhtbhn.exe 3052 vpjpd.exe 1336 vpjdp.exe -
resource yara_rule behavioral1/memory/2084-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000c000000012263-8.dat upx behavioral1/memory/2372-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2084-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2372-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2992-22-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016cfe-19.dat upx behavioral1/files/0x0007000000016d0b-26.dat upx behavioral1/memory/2544-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d13-36.dat upx behavioral1/files/0x0007000000016d24-47.dat upx behavioral1/memory/2684-45-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0007000000016d2e-54.dat upx behavioral1/files/0x0007000000016d36-64.dat upx behavioral1/memory/2848-63-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d3f-73.dat upx behavioral1/memory/2860-72-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d47-84.dat upx behavioral1/memory/2988-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000174ac-91.dat upx behavioral1/files/0x000600000001752f-100.dat upx behavioral1/memory/2696-101-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2112-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x001500000001866d-108.dat upx behavioral1/memory/2112-117-0x00000000003C0000-0x00000000003E7000-memory.dmp upx behavioral1/files/0x0009000000018678-118.dat upx behavioral1/memory/2112-120-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018690-129.dat upx behavioral1/memory/1836-128-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001879b-137.dat upx behavioral1/memory/1840-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000190cd-146.dat upx behavioral1/memory/1624-154-0x00000000002C0000-0x00000000002E7000-memory.dmp upx behavioral1/files/0x00060000000190d6-155.dat upx behavioral1/memory/1624-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000191f3-164.dat upx behavioral1/files/0x00050000000191f7-172.dat upx behavioral1/memory/2460-174-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019218-181.dat upx behavioral1/files/0x0005000000019229-189.dat upx behavioral1/memory/536-197-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019234-198.dat upx behavioral1/memory/2124-208-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001924c-207.dat upx behavioral1/files/0x000500000001926b-216.dat upx behavioral1/files/0x0005000000019271-225.dat upx behavioral1/memory/1172-226-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019273-234.dat upx behavioral1/memory/1876-233-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/1876-238-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019277-244.dat upx behavioral1/memory/2256-247-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000016c58-253.dat upx behavioral1/files/0x0005000000019382-263.dat upx behavioral1/files/0x0005000000019389-270.dat upx behavioral1/files/0x00050000000193be-281.dat upx behavioral1/memory/352-280-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193c4-289.dat upx behavioral1/memory/2372-304-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2372-299-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/1484-311-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2836-343-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2836-350-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2688-369-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rllrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frffxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfxlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3djdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2084 wrote to memory of 2372 2084 025363a853d4fd548ae83c95ae4e3dbac9d16b04e2ec92126363cb9fd83568c6.exe 30 PID 2084 wrote to memory of 2372 2084 025363a853d4fd548ae83c95ae4e3dbac9d16b04e2ec92126363cb9fd83568c6.exe 30 PID 2084 wrote to memory of 2372 2084 025363a853d4fd548ae83c95ae4e3dbac9d16b04e2ec92126363cb9fd83568c6.exe 30 PID 2084 wrote to memory of 2372 2084 025363a853d4fd548ae83c95ae4e3dbac9d16b04e2ec92126363cb9fd83568c6.exe 30 PID 2372 wrote to memory of 2992 2372 tthtbh.exe 31 PID 2372 wrote to memory of 2992 2372 tthtbh.exe 31 PID 2372 wrote to memory of 2992 2372 tthtbh.exe 31 PID 2372 wrote to memory of 2992 2372 tthtbh.exe 31 PID 2992 wrote to memory of 2544 2992 pjddp.exe 32 PID 2992 wrote to memory of 2544 2992 pjddp.exe 32 PID 2992 wrote to memory of 2544 2992 pjddp.exe 32 PID 2992 wrote to memory of 2544 2992 pjddp.exe 32 PID 2544 wrote to memory of 2684 2544 lllfllf.exe 33 PID 2544 wrote to memory of 2684 2544 lllfllf.exe 33 PID 2544 wrote to memory of 2684 2544 lllfllf.exe 33 PID 2544 wrote to memory of 2684 2544 lllfllf.exe 33 PID 2684 wrote to memory of 2820 2684 djpdv.exe 34 PID 2684 wrote to memory of 2820 2684 djpdv.exe 34 PID 2684 wrote to memory of 2820 2684 djpdv.exe 34 PID 2684 wrote to memory of 2820 2684 djpdv.exe 34 PID 2820 wrote to memory of 2848 2820 jddjv.exe 35 PID 2820 wrote to memory of 2848 2820 jddjv.exe 35 PID 2820 wrote to memory of 2848 2820 jddjv.exe 35 PID 2820 wrote to memory of 2848 2820 jddjv.exe 35 PID 2848 wrote to memory of 2860 2848 flrrlfl.exe 36 PID 2848 wrote to memory of 2860 2848 flrrlfl.exe 36 PID 2848 wrote to memory of 2860 2848 flrrlfl.exe 36 PID 2848 wrote to memory of 2860 2848 flrrlfl.exe 36 PID 2860 wrote to memory of 2988 2860 tnhttt.exe 37 PID 2860 wrote to memory of 2988 2860 tnhttt.exe 37 PID 2860 wrote to memory of 2988 2860 tnhttt.exe 37 PID 2860 wrote to memory of 2988 2860 tnhttt.exe 37 PID 2988 wrote to memory of 2576 2988 7dvvd.exe 38 PID 2988 wrote to memory of 2576 2988 7dvvd.exe 38 PID 2988 wrote to memory of 2576 2988 7dvvd.exe 38 PID 2988 wrote to memory of 2576 2988 7dvvd.exe 38 PID 2576 wrote to memory of 2696 2576 rfllrxl.exe 39 PID 2576 wrote to memory of 2696 2576 rfllrxl.exe 39 PID 2576 wrote to memory of 2696 2576 rfllrxl.exe 39 PID 2576 wrote to memory of 2696 2576 rfllrxl.exe 39 PID 2696 wrote to memory of 2208 2696 9xxlxxf.exe 40 PID 2696 wrote to memory of 2208 2696 9xxlxxf.exe 40 PID 2696 wrote to memory of 2208 2696 9xxlxxf.exe 40 PID 2696 wrote to memory of 2208 2696 9xxlxxf.exe 40 PID 2208 wrote to memory of 2112 2208 1pdvv.exe 41 PID 2208 wrote to memory of 2112 2208 1pdvv.exe 41 PID 2208 wrote to memory of 2112 2208 1pdvv.exe 41 PID 2208 wrote to memory of 2112 2208 1pdvv.exe 41 PID 2112 wrote to memory of 1836 2112 dpvpv.exe 42 PID 2112 wrote to memory of 1836 2112 dpvpv.exe 42 PID 2112 wrote to memory of 1836 2112 dpvpv.exe 42 PID 2112 wrote to memory of 1836 2112 dpvpv.exe 42 PID 1836 wrote to memory of 1840 1836 lfrrxxf.exe 43 PID 1836 wrote to memory of 1840 1836 lfrrxxf.exe 43 PID 1836 wrote to memory of 1840 1836 lfrrxxf.exe 43 PID 1836 wrote to memory of 1840 1836 lfrrxxf.exe 43 PID 1840 wrote to memory of 1888 1840 hnnntt.exe 44 PID 1840 wrote to memory of 1888 1840 hnnntt.exe 44 PID 1840 wrote to memory of 1888 1840 hnnntt.exe 44 PID 1840 wrote to memory of 1888 1840 hnnntt.exe 44 PID 1888 wrote to memory of 1624 1888 vppvj.exe 45 PID 1888 wrote to memory of 1624 1888 vppvj.exe 45 PID 1888 wrote to memory of 1624 1888 vppvj.exe 45 PID 1888 wrote to memory of 1624 1888 vppvj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\025363a853d4fd548ae83c95ae4e3dbac9d16b04e2ec92126363cb9fd83568c6.exe"C:\Users\Admin\AppData\Local\Temp\025363a853d4fd548ae83c95ae4e3dbac9d16b04e2ec92126363cb9fd83568c6.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\tthtbh.exec:\tthtbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\pjddp.exec:\pjddp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\lllfllf.exec:\lllfllf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\djpdv.exec:\djpdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\jddjv.exec:\jddjv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\flrrlfl.exec:\flrrlfl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\tnhttt.exec:\tnhttt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\7dvvd.exec:\7dvvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\rfllrxl.exec:\rfllrxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\9xxlxxf.exec:\9xxlxxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\1pdvv.exec:\1pdvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\dpvpv.exec:\dpvpv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\lfrrxxf.exec:\lfrrxxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
\??\c:\hnnntt.exec:\hnnntt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
\??\c:\vppvj.exec:\vppvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
\??\c:\1lrxlrf.exec:\1lrxlrf.exe17⤵
- Executes dropped EXE
PID:1624 -
\??\c:\5bbtbh.exec:\5bbtbh.exe18⤵
- Executes dropped EXE
PID:1656 -
\??\c:\nhtbth.exec:\nhtbth.exe19⤵
- Executes dropped EXE
PID:1420 -
\??\c:\jdjjp.exec:\jdjjp.exe20⤵
- Executes dropped EXE
PID:2460 -
\??\c:\5rfllrl.exec:\5rfllrl.exe21⤵
- Executes dropped EXE
PID:2952 -
\??\c:\tttnbb.exec:\tttnbb.exe22⤵
- Executes dropped EXE
PID:536 -
\??\c:\jvpjd.exec:\jvpjd.exe23⤵
- Executes dropped EXE
PID:2124 -
\??\c:\lllrfrl.exec:\lllrfrl.exe24⤵
- Executes dropped EXE
PID:2920 -
\??\c:\1hbnhn.exec:\1hbnhn.exe25⤵
- Executes dropped EXE
PID:1172 -
\??\c:\hbthtb.exec:\hbthtb.exe26⤵
- Executes dropped EXE
PID:1876 -
\??\c:\1vjpv.exec:\1vjpv.exe27⤵
- Executes dropped EXE
PID:904 -
\??\c:\xxflflr.exec:\xxflflr.exe28⤵
- Executes dropped EXE
PID:2256 -
\??\c:\5btnnb.exec:\5btnnb.exe29⤵
- Executes dropped EXE
PID:2076 -
\??\c:\jdjdp.exec:\jdjdp.exe30⤵
- Executes dropped EXE
PID:1920 -
\??\c:\xfxrfrl.exec:\xfxrfrl.exe31⤵
- Executes dropped EXE
PID:352 -
\??\c:\nnhnnh.exec:\nnhnnh.exe32⤵
- Executes dropped EXE
PID:1860 -
\??\c:\bbtbbt.exec:\bbtbbt.exe33⤵
- Executes dropped EXE
PID:2264 -
\??\c:\pdvvd.exec:\pdvvd.exe34⤵
- Executes dropped EXE
PID:2372 -
\??\c:\nnnhbh.exec:\nnnhbh.exe35⤵
- Executes dropped EXE
PID:1484 -
\??\c:\vvdjp.exec:\vvdjp.exe36⤵
- Executes dropped EXE
PID:2520 -
\??\c:\jjjpv.exec:\jjjpv.exe37⤵
- Executes dropped EXE
PID:3056 -
\??\c:\xrlrlxl.exec:\xrlrlxl.exe38⤵
- Executes dropped EXE
PID:2704 -
\??\c:\5xxlxxf.exec:\5xxlxxf.exe39⤵
- Executes dropped EXE
PID:2796 -
\??\c:\hhbthb.exec:\hhbthb.exe40⤵
- Executes dropped EXE
PID:2680 -
\??\c:\hbthhh.exec:\hbthhh.exe41⤵
- Executes dropped EXE
PID:2836 -
\??\c:\ppddj.exec:\ppddj.exe42⤵
- Executes dropped EXE
PID:3044 -
\??\c:\7xrlflf.exec:\7xrlflf.exe43⤵
- Executes dropped EXE
PID:2712 -
\??\c:\frlrrll.exec:\frlrrll.exe44⤵
- Executes dropped EXE
PID:2688 -
\??\c:\tnhnhh.exec:\tnhnhh.exe45⤵
- Executes dropped EXE
PID:2580 -
\??\c:\5pjdp.exec:\5pjdp.exe46⤵
- Executes dropped EXE
PID:2608 -
\??\c:\3jdjp.exec:\3jdjp.exe47⤵
- Executes dropped EXE
PID:1632 -
\??\c:\rlrrxxl.exec:\rlrrxxl.exe48⤵
- Executes dropped EXE
PID:2208 -
\??\c:\hbbnht.exec:\hbbnht.exe49⤵
- Executes dropped EXE
PID:1388 -
\??\c:\bbthbh.exec:\bbthbh.exe50⤵
- Executes dropped EXE
PID:1940 -
\??\c:\pvjjv.exec:\pvjjv.exe51⤵
- Executes dropped EXE
PID:1856 -
\??\c:\rrlflfr.exec:\rrlflfr.exe52⤵
- Executes dropped EXE
PID:2416 -
\??\c:\ffxflfl.exec:\ffxflfl.exe53⤵
- Executes dropped EXE
PID:1900 -
\??\c:\tthtbn.exec:\tthtbn.exe54⤵
- Executes dropped EXE
PID:1936 -
\??\c:\ntbntt.exec:\ntbntt.exe55⤵
- Executes dropped EXE
PID:1624 -
\??\c:\vdpjd.exec:\vdpjd.exe56⤵
- Executes dropped EXE
PID:1952 -
\??\c:\flffrxf.exec:\flffrxf.exe57⤵
- Executes dropped EXE
PID:1564 -
\??\c:\tnthbh.exec:\tnthbh.exe58⤵
- Executes dropped EXE
PID:2172 -
\??\c:\tnntbb.exec:\tnntbb.exe59⤵
- Executes dropped EXE
PID:1392 -
\??\c:\7dvvj.exec:\7dvvj.exe60⤵
- Executes dropped EXE
PID:2216 -
\??\c:\fllxlfx.exec:\fllxlfx.exe61⤵
- Executes dropped EXE
PID:1832 -
\??\c:\hhnthh.exec:\hhnthh.exe62⤵
- Executes dropped EXE
PID:2248 -
\??\c:\hhtbhn.exec:\hhtbhn.exe63⤵
- Executes dropped EXE
PID:916 -
\??\c:\vpjpd.exec:\vpjpd.exe64⤵
- Executes dropped EXE
PID:3052 -
\??\c:\vpjdp.exec:\vpjdp.exe65⤵
- Executes dropped EXE
PID:1336 -
\??\c:\llflffr.exec:\llflffr.exe66⤵PID:736
-
\??\c:\bhttnn.exec:\bhttnn.exe67⤵PID:2300
-
\??\c:\bbthnh.exec:\bbthnh.exe68⤵PID:904
-
\??\c:\jvpjp.exec:\jvpjp.exe69⤵PID:2776
-
\??\c:\pddpj.exec:\pddpj.exe70⤵PID:2332
-
\??\c:\3xrflrl.exec:\3xrflrl.exe71⤵PID:3064
-
\??\c:\htntbn.exec:\htntbn.exe72⤵PID:2280
-
\??\c:\ttnthn.exec:\ttnthn.exe73⤵PID:352
-
\??\c:\jvpjp.exec:\jvpjp.exe74⤵PID:2516
-
\??\c:\rrlxxxl.exec:\rrlxxxl.exe75⤵PID:2940
-
\??\c:\rfrfrfl.exec:\rfrfrfl.exe76⤵PID:2380
-
\??\c:\bttbnn.exec:\bttbnn.exe77⤵PID:1628
-
\??\c:\thbhnt.exec:\thbhnt.exe78⤵PID:1484
-
\??\c:\9vpdv.exec:\9vpdv.exe79⤵PID:2756
-
\??\c:\5fxrflx.exec:\5fxrflx.exe80⤵PID:2788
-
\??\c:\rfxlfrf.exec:\rfxlfrf.exe81⤵PID:2856
-
\??\c:\5nhtnb.exec:\5nhtnb.exe82⤵PID:2584
-
\??\c:\5ttnbh.exec:\5ttnbh.exe83⤵PID:2700
-
\??\c:\vpvjd.exec:\vpvjd.exe84⤵PID:2808
-
\??\c:\pvpjd.exec:\pvpjd.exe85⤵PID:2188
-
\??\c:\xxlrllr.exec:\xxlrllr.exe86⤵PID:2832
-
\??\c:\htbbth.exec:\htbbth.exe87⤵PID:2572
-
\??\c:\hbbtbt.exec:\hbbtbt.exe88⤵PID:2828
-
\??\c:\jdpjv.exec:\jdpjv.exe89⤵PID:2648
-
\??\c:\pvppp.exec:\pvppp.exe90⤵PID:2696
-
\??\c:\lrfllrl.exec:\lrfllrl.exe91⤵PID:1568
-
\??\c:\bbbhtt.exec:\bbbhtt.exe92⤵PID:2112
-
\??\c:\tnntht.exec:\tnntht.exe93⤵PID:1880
-
\??\c:\djdvj.exec:\djdvj.exe94⤵PID:2396
-
\??\c:\djjpp.exec:\djjpp.exe95⤵PID:1928
-
\??\c:\3llxxll.exec:\3llxxll.exe96⤵PID:2120
-
\??\c:\tnhnhn.exec:\tnhnhn.exe97⤵PID:1428
-
\??\c:\bthnbb.exec:\bthnbb.exe98⤵PID:1192
-
\??\c:\7dvjd.exec:\7dvjd.exe99⤵PID:1040
-
\??\c:\9jvjv.exec:\9jvjv.exe100⤵PID:2672
-
\??\c:\xxrfrfr.exec:\xxrfrfr.exe101⤵PID:1612
-
\??\c:\xxlxllf.exec:\xxlxllf.exe102⤵PID:772
-
\??\c:\bbtntb.exec:\bbtntb.exe103⤵PID:1392
-
\??\c:\vvdjp.exec:\vvdjp.exe104⤵PID:584
-
\??\c:\jpdvp.exec:\jpdvp.exe105⤵PID:1220
-
\??\c:\llfrrfx.exec:\llfrrfx.exe106⤵PID:2248
-
\??\c:\bthbnt.exec:\bthbnt.exe107⤵PID:1756
-
\??\c:\5nnthh.exec:\5nnthh.exe108⤵PID:3052
-
\??\c:\vppdp.exec:\vppdp.exe109⤵PID:968
-
\??\c:\1ffrfxf.exec:\1ffrfxf.exe110⤵PID:1304
-
\??\c:\xxrllrf.exec:\xxrllrf.exe111⤵PID:1400
-
\??\c:\hnbtht.exec:\hnbtht.exe112⤵PID:1976
-
\??\c:\tnnbhh.exec:\tnnbhh.exe113⤵PID:2776
-
\??\c:\djjpp.exec:\djjpp.exe114⤵PID:2072
-
\??\c:\lrffrff.exec:\lrffrff.exe115⤵PID:3064
-
\??\c:\frrlxfl.exec:\frrlxfl.exe116⤵PID:2148
-
\??\c:\5bbtnb.exec:\5bbtnb.exe117⤵PID:1996
-
\??\c:\9bthbn.exec:\9bthbn.exe118⤵PID:2412
-
\??\c:\vvvvd.exec:\vvvvd.exe119⤵PID:1988
-
\??\c:\dpjvd.exec:\dpjvd.exe120⤵PID:2380
-
\??\c:\xrxfllx.exec:\xrxfllx.exe121⤵PID:3032
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-