Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24-11-2024 09:12
Behavioral task
behavioral1
Sample
73c4963606d4e9d3dcff1cd55d0e7aa19582a623dfe47edb403493ace7250e72.exe
Resource
win7-20240903-en
General
-
Target
73c4963606d4e9d3dcff1cd55d0e7aa19582a623dfe47edb403493ace7250e72.exe
-
Size
87KB
-
MD5
4b7f3720bb32bfbb1914aafd7419cdf0
-
SHA1
c0f28c08f8201d51e2ef53c04586785589249a79
-
SHA256
73c4963606d4e9d3dcff1cd55d0e7aa19582a623dfe47edb403493ace7250e72
-
SHA512
01bfe54325acad87ed8a78f1ab2d1bd62adbc4c38d1ceb179be9e060f1e057b474068ae0d101f9c85b8e0d12fd58fdaad8db7b9257c137bcf24b321e4429f1eb
-
SSDEEP
1536:xvQBeOGtrYS3srx93UBWfwC6Ggnouy82F13w1rCJtzGeKuO+mqizpPubYDEzfY:xhOmTsF93UYfwC6GIout03LzuuOlzpPf
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 57 IoCs
Processes:
resource yara_rule behavioral1/memory/2568-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2524-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2504-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2100-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2304-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2740-54-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2740-51-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/3012-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2480-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2908-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2616-97-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2764-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2640-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2584-133-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2028-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1720-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1720-155-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1968-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2984-189-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2976-209-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2976-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2416-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/408-221-0x00000000002D0000-0x00000000002F7000-memory.dmp family_blackmoon behavioral1/memory/408-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2464-252-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2464-251-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2320-261-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2460-281-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2464-279-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2148-298-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2052-308-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/332-327-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/1576-334-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/2632-367-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2768-374-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2652-381-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2764-388-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1480-407-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2028-433-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/2300-484-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/408-510-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1336-518-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2976-525-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/1940-546-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/1940-544-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2556-554-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2360-587-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2360-586-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1688-613-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2724-627-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2476-641-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1800-684-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1784-708-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1720-728-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2932-741-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2252-754-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/3020-785-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
04280.exe0424062.exe3btnbh.exe5vvjd.exee02888.exe7fxfxfl.exe08002.exejdpjj.exevppdp.exe264080.exexrrxffl.exe48620.exew60682.exevdpjj.exe48686.exejdppv.exe1pdpv.exe264204.exelxflrrx.exew08466.exe64002.exe488062.exe64020.exe9rllxxf.exe4808028.exei682040.exetnhnbb.exec028008.exejdvvv.exe5vppv.exethtttt.exellfrlxf.exe6488488.exe7jpvd.exe42684.exejddvd.exelflrxxl.exexfrrxfr.exe0280228.exelxfflfl.exetthntb.exe6428002.exepjvpj.exe3nnntb.exexxxlfrx.exe3vppd.exebtntbb.exefxlrxrr.exehhtnnt.exe880688.exenntnbh.exellfrllx.exe048488.exe480626.exehtbbbh.exe6088880.exee60844.exe48080.exefxxxrrx.exe484022.exe082688.exexrflrrl.exevpdjd.exeq24428.exepid process 2504 04280.exe 2524 0424062.exe 2100 3btnbh.exe 2304 5vvjd.exe 2740 e02888.exe 3012 7fxfxfl.exe 2480 08002.exe 2908 jdpjj.exe 2764 vppdp.exe 2616 264080.exe 2640 xrrxffl.exe 2412 48620.exe 2584 w60682.exe 2028 vdpjj.exe 1452 48686.exe 1720 jdppv.exe 864 1pdpv.exe 1968 264204.exe 2684 lxflrrx.exe 2984 w08466.exe 2416 64002.exe 2976 488062.exe 408 64020.exe 2224 9rllxxf.exe 2488 4808028.exe 2464 i682040.exe 2320 tnhnbb.exe 2152 c028008.exe 2460 jdvvv.exe 892 5vppv.exe 2148 thtttt.exe 2052 llfrlxf.exe 2336 6488488.exe 2012 7jpvd.exe 332 42684.exe 1576 jddvd.exe 2800 lflrxxl.exe 2804 xfrrxfr.exe 2816 0280228.exe 2812 lxfflfl.exe 2632 tthntb.exe 2768 6428002.exe 2652 pjvpj.exe 2764 3nnntb.exe 1560 xxxlfrx.exe 1456 3vppd.exe 1636 btntbb.exe 1480 fxlrxrr.exe 2004 hhtnnt.exe 2564 880688.exe 2028 nntnbh.exe 2132 llfrllx.exe 1912 048488.exe 1056 480626.exe 1156 htbbbh.exe 1752 6088880.exe 2840 e60844.exe 1996 48080.exe 2300 fxxxrrx.exe 1520 484022.exe 552 082688.exe 2976 xrflrrl.exe 408 vpdjd.exe 1336 q24428.exe -
Processes:
resource yara_rule behavioral1/memory/2568-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\04280.exe upx behavioral1/memory/2504-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2568-7-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\0424062.exe upx behavioral1/memory/2524-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2504-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2100-30-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\3btnbh.exe upx C:\5vvjd.exe upx behavioral1/memory/2740-46-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\e02888.exe upx behavioral1/memory/2304-44-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7fxfxfl.exe upx C:\08002.exe upx behavioral1/memory/3012-65-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/3012-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2480-74-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jdpjj.exe upx C:\vppdp.exe upx behavioral1/memory/2908-82-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\264080.exe upx behavioral1/memory/2764-93-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrrxffl.exe upx \??\c:\48620.exe upx behavioral1/memory/2640-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2640-112-0x00000000001B0000-0x00000000001D7000-memory.dmp upx C:\w60682.exe upx C:\vdpjj.exe upx behavioral1/memory/2584-133-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\48686.exe upx behavioral1/memory/2028-141-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jdppv.exe upx behavioral1/memory/1720-152-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1pdpv.exe upx C:\264204.exe upx C:\lxflrrx.exe upx behavioral1/memory/1968-176-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\w08466.exe upx C:\64002.exe upx behavioral1/memory/2976-206-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\488062.exe upx behavioral1/memory/2416-204-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\64020.exe upx \??\c:\9rllxxf.exe upx behavioral1/memory/2224-225-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/408-224-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\4808028.exe upx behavioral1/memory/2488-235-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\i682040.exe upx C:\tnhnbb.exe upx behavioral1/memory/2464-251-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2320-261-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\c028008.exe upx behavioral1/memory/2152-263-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jdvvv.exe upx \??\c:\5vppv.exe upx C:\thtttt.exe upx behavioral1/memory/2148-298-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\llfrlxf.exe upx behavioral1/memory/1576-334-0x00000000002A0000-0x00000000002C7000-memory.dmp upx behavioral1/memory/2816-348-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2632-367-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2652-381-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
e82484.exe604644.exejdvpv.exeo684062.exepvjpd.exe80420.exe9jddp.exenhtbtt.exevpjpv.exefrxfrlf.exepjjvd.exetthtnt.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e82484.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 604644.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language o684062.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 80420.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxfrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
73c4963606d4e9d3dcff1cd55d0e7aa19582a623dfe47edb403493ace7250e72.exe04280.exe0424062.exe3btnbh.exe5vvjd.exee02888.exe7fxfxfl.exe08002.exejdpjj.exevppdp.exe264080.exexrrxffl.exe48620.exew60682.exevdpjj.exe48686.exedescription pid process target process PID 2568 wrote to memory of 2504 2568 73c4963606d4e9d3dcff1cd55d0e7aa19582a623dfe47edb403493ace7250e72.exe 04280.exe PID 2568 wrote to memory of 2504 2568 73c4963606d4e9d3dcff1cd55d0e7aa19582a623dfe47edb403493ace7250e72.exe 04280.exe PID 2568 wrote to memory of 2504 2568 73c4963606d4e9d3dcff1cd55d0e7aa19582a623dfe47edb403493ace7250e72.exe 04280.exe PID 2568 wrote to memory of 2504 2568 73c4963606d4e9d3dcff1cd55d0e7aa19582a623dfe47edb403493ace7250e72.exe 04280.exe PID 2504 wrote to memory of 2524 2504 04280.exe 0424062.exe PID 2504 wrote to memory of 2524 2504 04280.exe 0424062.exe PID 2504 wrote to memory of 2524 2504 04280.exe 0424062.exe PID 2504 wrote to memory of 2524 2504 04280.exe 0424062.exe PID 2524 wrote to memory of 2100 2524 0424062.exe 3btnbh.exe PID 2524 wrote to memory of 2100 2524 0424062.exe 3btnbh.exe PID 2524 wrote to memory of 2100 2524 0424062.exe 3btnbh.exe PID 2524 wrote to memory of 2100 2524 0424062.exe 3btnbh.exe PID 2100 wrote to memory of 2304 2100 3btnbh.exe 5vvjd.exe PID 2100 wrote to memory of 2304 2100 3btnbh.exe 5vvjd.exe PID 2100 wrote to memory of 2304 2100 3btnbh.exe 5vvjd.exe PID 2100 wrote to memory of 2304 2100 3btnbh.exe 5vvjd.exe PID 2304 wrote to memory of 2740 2304 5vvjd.exe e02888.exe PID 2304 wrote to memory of 2740 2304 5vvjd.exe e02888.exe PID 2304 wrote to memory of 2740 2304 5vvjd.exe e02888.exe PID 2304 wrote to memory of 2740 2304 5vvjd.exe e02888.exe PID 2740 wrote to memory of 3012 2740 e02888.exe 7fxfxfl.exe PID 2740 wrote to memory of 3012 2740 e02888.exe 7fxfxfl.exe PID 2740 wrote to memory of 3012 2740 e02888.exe 7fxfxfl.exe PID 2740 wrote to memory of 3012 2740 e02888.exe 7fxfxfl.exe PID 3012 wrote to memory of 2480 3012 7fxfxfl.exe 08002.exe PID 3012 wrote to memory of 2480 3012 7fxfxfl.exe 08002.exe PID 3012 wrote to memory of 2480 3012 7fxfxfl.exe 08002.exe PID 3012 wrote to memory of 2480 3012 7fxfxfl.exe 08002.exe PID 2480 wrote to memory of 2908 2480 08002.exe jdpjj.exe PID 2480 wrote to memory of 2908 2480 08002.exe jdpjj.exe PID 2480 wrote to memory of 2908 2480 08002.exe jdpjj.exe PID 2480 wrote to memory of 2908 2480 08002.exe jdpjj.exe PID 2908 wrote to memory of 2764 2908 jdpjj.exe vppdp.exe PID 2908 wrote to memory of 2764 2908 jdpjj.exe vppdp.exe PID 2908 wrote to memory of 2764 2908 jdpjj.exe vppdp.exe PID 2908 wrote to memory of 2764 2908 jdpjj.exe vppdp.exe PID 2764 wrote to memory of 2616 2764 vppdp.exe 264080.exe PID 2764 wrote to memory of 2616 2764 vppdp.exe 264080.exe PID 2764 wrote to memory of 2616 2764 vppdp.exe 264080.exe PID 2764 wrote to memory of 2616 2764 vppdp.exe 264080.exe PID 2616 wrote to memory of 2640 2616 264080.exe xrrxffl.exe PID 2616 wrote to memory of 2640 2616 264080.exe xrrxffl.exe PID 2616 wrote to memory of 2640 2616 264080.exe xrrxffl.exe PID 2616 wrote to memory of 2640 2616 264080.exe xrrxffl.exe PID 2640 wrote to memory of 2412 2640 xrrxffl.exe 48620.exe PID 2640 wrote to memory of 2412 2640 xrrxffl.exe 48620.exe PID 2640 wrote to memory of 2412 2640 xrrxffl.exe 48620.exe PID 2640 wrote to memory of 2412 2640 xrrxffl.exe 48620.exe PID 2412 wrote to memory of 2584 2412 48620.exe w60682.exe PID 2412 wrote to memory of 2584 2412 48620.exe w60682.exe PID 2412 wrote to memory of 2584 2412 48620.exe w60682.exe PID 2412 wrote to memory of 2584 2412 48620.exe w60682.exe PID 2584 wrote to memory of 2028 2584 w60682.exe vdpjj.exe PID 2584 wrote to memory of 2028 2584 w60682.exe vdpjj.exe PID 2584 wrote to memory of 2028 2584 w60682.exe vdpjj.exe PID 2584 wrote to memory of 2028 2584 w60682.exe vdpjj.exe PID 2028 wrote to memory of 1452 2028 vdpjj.exe 48686.exe PID 2028 wrote to memory of 1452 2028 vdpjj.exe 48686.exe PID 2028 wrote to memory of 1452 2028 vdpjj.exe 48686.exe PID 2028 wrote to memory of 1452 2028 vdpjj.exe 48686.exe PID 1452 wrote to memory of 1720 1452 48686.exe jdppv.exe PID 1452 wrote to memory of 1720 1452 48686.exe jdppv.exe PID 1452 wrote to memory of 1720 1452 48686.exe jdppv.exe PID 1452 wrote to memory of 1720 1452 48686.exe jdppv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\73c4963606d4e9d3dcff1cd55d0e7aa19582a623dfe47edb403493ace7250e72.exe"C:\Users\Admin\AppData\Local\Temp\73c4963606d4e9d3dcff1cd55d0e7aa19582a623dfe47edb403493ace7250e72.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\04280.exec:\04280.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\0424062.exec:\0424062.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\3btnbh.exec:\3btnbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\5vvjd.exec:\5vvjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\e02888.exec:\e02888.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\7fxfxfl.exec:\7fxfxfl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\08002.exec:\08002.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\jdpjj.exec:\jdpjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\vppdp.exec:\vppdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\264080.exec:\264080.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\xrrxffl.exec:\xrrxffl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\48620.exec:\48620.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\w60682.exec:\w60682.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\vdpjj.exec:\vdpjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\48686.exec:\48686.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
\??\c:\jdppv.exec:\jdppv.exe17⤵
- Executes dropped EXE
PID:1720 -
\??\c:\1pdpv.exec:\1pdpv.exe18⤵
- Executes dropped EXE
PID:864 -
\??\c:\264204.exec:\264204.exe19⤵
- Executes dropped EXE
PID:1968 -
\??\c:\lxflrrx.exec:\lxflrrx.exe20⤵
- Executes dropped EXE
PID:2684 -
\??\c:\w08466.exec:\w08466.exe21⤵
- Executes dropped EXE
PID:2984 -
\??\c:\64002.exec:\64002.exe22⤵
- Executes dropped EXE
PID:2416 -
\??\c:\488062.exec:\488062.exe23⤵
- Executes dropped EXE
PID:2976 -
\??\c:\64020.exec:\64020.exe24⤵
- Executes dropped EXE
PID:408 -
\??\c:\9rllxxf.exec:\9rllxxf.exe25⤵
- Executes dropped EXE
PID:2224 -
\??\c:\4808028.exec:\4808028.exe26⤵
- Executes dropped EXE
PID:2488 -
\??\c:\i682040.exec:\i682040.exe27⤵
- Executes dropped EXE
PID:2464 -
\??\c:\tnhnbb.exec:\tnhnbb.exe28⤵
- Executes dropped EXE
PID:2320 -
\??\c:\c028008.exec:\c028008.exe29⤵
- Executes dropped EXE
PID:2152 -
\??\c:\jdvvv.exec:\jdvvv.exe30⤵
- Executes dropped EXE
PID:2460 -
\??\c:\5vppv.exec:\5vppv.exe31⤵
- Executes dropped EXE
PID:892 -
\??\c:\thtttt.exec:\thtttt.exe32⤵
- Executes dropped EXE
PID:2148 -
\??\c:\llfrlxf.exec:\llfrlxf.exe33⤵
- Executes dropped EXE
PID:2052 -
\??\c:\6488488.exec:\6488488.exe34⤵
- Executes dropped EXE
PID:2336 -
\??\c:\7jpvd.exec:\7jpvd.exe35⤵
- Executes dropped EXE
PID:2012 -
\??\c:\42684.exec:\42684.exe36⤵
- Executes dropped EXE
PID:332 -
\??\c:\jddvd.exec:\jddvd.exe37⤵
- Executes dropped EXE
PID:1576 -
\??\c:\lflrxxl.exec:\lflrxxl.exe38⤵
- Executes dropped EXE
PID:2800 -
\??\c:\xfrrxfr.exec:\xfrrxfr.exe39⤵
- Executes dropped EXE
PID:2804 -
\??\c:\0280228.exec:\0280228.exe40⤵
- Executes dropped EXE
PID:2816 -
\??\c:\lxfflfl.exec:\lxfflfl.exe41⤵
- Executes dropped EXE
PID:2812 -
\??\c:\tthntb.exec:\tthntb.exe42⤵
- Executes dropped EXE
PID:2632 -
\??\c:\6428002.exec:\6428002.exe43⤵
- Executes dropped EXE
PID:2768 -
\??\c:\pjvpj.exec:\pjvpj.exe44⤵
- Executes dropped EXE
PID:2652 -
\??\c:\3nnntb.exec:\3nnntb.exe45⤵
- Executes dropped EXE
PID:2764 -
\??\c:\xxxlfrx.exec:\xxxlfrx.exe46⤵
- Executes dropped EXE
PID:1560 -
\??\c:\3vppd.exec:\3vppd.exe47⤵
- Executes dropped EXE
PID:1456 -
\??\c:\btntbb.exec:\btntbb.exe48⤵
- Executes dropped EXE
PID:1636 -
\??\c:\fxlrxrr.exec:\fxlrxrr.exe49⤵
- Executes dropped EXE
PID:1480 -
\??\c:\hhtnnt.exec:\hhtnnt.exe50⤵
- Executes dropped EXE
PID:2004 -
\??\c:\880688.exec:\880688.exe51⤵
- Executes dropped EXE
PID:2564 -
\??\c:\nntnbh.exec:\nntnbh.exe52⤵
- Executes dropped EXE
PID:2028 -
\??\c:\llfrllx.exec:\llfrllx.exe53⤵
- Executes dropped EXE
PID:2132 -
\??\c:\048488.exec:\048488.exe54⤵
- Executes dropped EXE
PID:1912 -
\??\c:\480626.exec:\480626.exe55⤵
- Executes dropped EXE
PID:1056 -
\??\c:\htbbbh.exec:\htbbbh.exe56⤵
- Executes dropped EXE
PID:1156 -
\??\c:\6088880.exec:\6088880.exe57⤵
- Executes dropped EXE
PID:1752 -
\??\c:\e60844.exec:\e60844.exe58⤵
- Executes dropped EXE
PID:2840 -
\??\c:\48080.exec:\48080.exe59⤵
- Executes dropped EXE
PID:1996 -
\??\c:\fxxxrrx.exec:\fxxxrrx.exe60⤵
- Executes dropped EXE
PID:2300 -
\??\c:\484022.exec:\484022.exe61⤵
- Executes dropped EXE
PID:1520 -
\??\c:\082688.exec:\082688.exe62⤵
- Executes dropped EXE
PID:552 -
\??\c:\xrflrrl.exec:\xrflrrl.exe63⤵
- Executes dropped EXE
PID:2976 -
\??\c:\vpdjd.exec:\vpdjd.exe64⤵
- Executes dropped EXE
PID:408 -
\??\c:\q24428.exec:\q24428.exe65⤵
- Executes dropped EXE
PID:1336 -
\??\c:\g2068.exec:\g2068.exe66⤵PID:1544
-
\??\c:\xrlrffr.exec:\xrlrffr.exe67⤵PID:1992
-
\??\c:\0428284.exec:\0428284.exe68⤵PID:2156
-
\??\c:\btbtnn.exec:\btbtnn.exe69⤵PID:1940
-
\??\c:\m6846.exec:\m6846.exe70⤵PID:2556
-
\??\c:\648422.exec:\648422.exe71⤵PID:1908
-
\??\c:\5pjjv.exec:\5pjjv.exe72⤵PID:888
-
\??\c:\e42088.exec:\e42088.exe73⤵PID:1740
-
\??\c:\dvddp.exec:\dvddp.exe74⤵PID:2016
-
\??\c:\0442440.exec:\0442440.exe75⤵PID:2360
-
\??\c:\nnnhth.exec:\nnnhth.exe76⤵PID:2052
-
\??\c:\6468284.exec:\6468284.exe77⤵PID:2900
-
\??\c:\xrlfxll.exec:\xrlfxll.exe78⤵PID:2352
-
\??\c:\tthbnh.exec:\tthbnh.exe79⤵PID:1688
-
\??\c:\u228066.exec:\u228066.exe80⤵PID:2860
-
\??\c:\64248.exec:\64248.exe81⤵PID:2724
-
\??\c:\6006806.exec:\6006806.exe82⤵PID:2728
-
\??\c:\6288040.exec:\6288040.exe83⤵PID:2476
-
\??\c:\2820204.exec:\2820204.exe84⤵PID:2500
-
\??\c:\420028.exec:\420028.exe85⤵PID:2632
-
\??\c:\k86284.exec:\k86284.exe86⤵PID:2648
-
\??\c:\vpjjv.exec:\vpjjv.exe87⤵PID:2660
-
\??\c:\i802402.exec:\i802402.exe88⤵PID:2616
-
\??\c:\btbhth.exec:\btbhth.exe89⤵PID:1696
-
\??\c:\tnnbtn.exec:\tnnbtn.exe90⤵PID:1800
-
\??\c:\268624.exec:\268624.exe91⤵PID:2696
-
\??\c:\206822.exec:\206822.exe92⤵PID:2040
-
\??\c:\8624440.exec:\8624440.exe93⤵PID:1784
-
\??\c:\tnbnbb.exec:\tnbnbb.exe94⤵PID:1716
-
\??\c:\ddvjj.exec:\ddvjj.exe95⤵PID:1684
-
\??\c:\20806.exec:\20806.exe96⤵PID:1720
-
\??\c:\tnhhhh.exec:\tnhhhh.exe97⤵PID:864
-
\??\c:\668084.exec:\668084.exe98⤵PID:2924
-
\??\c:\7ntthh.exec:\7ntthh.exe99⤵PID:2932
-
\??\c:\k08488.exec:\k08488.exe100⤵PID:2252
-
\??\c:\04624.exec:\04624.exe101⤵PID:2236
-
\??\c:\68002.exec:\68002.exe102⤵PID:2984
-
\??\c:\g4262.exec:\g4262.exe103⤵PID:2432
-
\??\c:\3pjvd.exec:\3pjvd.exe104⤵PID:2948
-
\??\c:\jjpdp.exec:\jjpdp.exe105⤵PID:3020
-
\??\c:\7btbnn.exec:\7btbnn.exe106⤵PID:1596
-
\??\c:\6080242.exec:\6080242.exe107⤵PID:1336
-
\??\c:\tnhbnn.exec:\tnhbnn.exe108⤵PID:2488
-
\??\c:\3vjpv.exec:\3vjpv.exe109⤵PID:1188
-
\??\c:\fffrlrx.exec:\fffrlrx.exe110⤵PID:556
-
\??\c:\7hbthn.exec:\7hbthn.exe111⤵PID:1040
-
\??\c:\82060.exec:\82060.exe112⤵PID:2212
-
\??\c:\g0848.exec:\g0848.exe113⤵PID:1888
-
\??\c:\5rllxxx.exec:\5rllxxx.exe114⤵PID:2996
-
\??\c:\i640284.exec:\i640284.exe115⤵PID:2548
-
\??\c:\9jddp.exec:\9jddp.exe116⤵
- System Location Discovery: System Language Discovery
PID:2148 -
\??\c:\vvpdj.exec:\vvpdj.exe117⤵PID:2016
-
\??\c:\xlrrlrx.exec:\xlrrlrx.exe118⤵PID:2272
-
\??\c:\xlxflll.exec:\xlxflll.exe119⤵PID:2688
-
\??\c:\5pvvd.exec:\5pvvd.exe120⤵PID:2888
-
\??\c:\u480602.exec:\u480602.exe121⤵PID:2736
-
\??\c:\9hbnth.exec:\9hbnth.exe122⤵PID:1580
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-