Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24-11-2024 10:59
Behavioral task
behavioral1
Sample
d07852c288f661f8b16077a5f3c86579e2a2827ca8906787db2cfa159d9e005a.exe
Resource
win7-20240903-en
General
-
Target
d07852c288f661f8b16077a5f3c86579e2a2827ca8906787db2cfa159d9e005a.exe
-
Size
71KB
-
MD5
52d6350fc10a9e0f8208bc588a97bbea
-
SHA1
4fb858b8b0942c736796f8b5bb3274205420aec3
-
SHA256
d07852c288f661f8b16077a5f3c86579e2a2827ca8906787db2cfa159d9e005a
-
SHA512
b2c32c976fa0e01ec5e807e2b41070d599d099e39b76cf291b01d91be40ef4f5cc74e61836978f70b3202e22a225b80c10433e358a82a567fb94ffd9800c5e4d
-
SSDEEP
1536:cvQBeOGtrYS3srx93UBWfwC6Ggnouy8HglW8waWaN:chOmTsF93UYfwC6GIout3t7aN
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 53 IoCs
Processes:
resource yara_rule behavioral1/memory/2516-1-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1644-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2476-22-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2704-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2744-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2240-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2624-95-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2224-106-0x00000000001C0000-0x00000000001E7000-memory.dmp family_blackmoon behavioral1/memory/2224-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/808-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1984-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2972-151-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2996-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/804-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2412-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2096-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/772-210-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/772-208-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/772-206-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/316-226-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/316-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/928-244-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2288-271-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/348-261-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/976-280-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/884-283-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2388-312-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2924-326-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3020-346-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2744-353-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2784-367-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2652-374-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2164-406-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1988-419-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2932-438-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2072-451-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2592-464-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2592-485-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/1308-501-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/960-776-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1624-783-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/1776-815-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/888-823-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2768-848-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2844-867-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1880-984-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/964-1027-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2480-1283-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1540-1288-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2752-1393-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2764-1410-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2660-1419-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/604-1456-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
vpjjv.exe7fxrrfr.exettntbb.exe7ppjd.exe9xrrllx.exentnnnh.exe1dvjp.exedddjj.exe5lrfxfr.exehbhnbb.exenbbtnh.exedvvpd.exe3flrrxf.exebnbhhb.exe3thnbh.exe9jvpv.exejvddd.exe7lfxflf.exennbthb.exenthhbb.exepjvpd.exepjdvp.exe9frxxrx.exenbnhhb.exehhhbbh.exeddjdv.exedjddv.exefxlrllr.exetnhbbb.exejvdjp.exejdvdd.exerlxxffr.exe5rrxxxx.exenbhbtn.exetnnbbt.exehtbbhh.exejpdjp.exepdvjj.exexffrrlx.exelffxxfl.exenbbbbb.exe9pvjd.exe9pddj.exe1xxxrrr.exefxrlfxr.exehhhtnb.exejvdvv.exejjpdv.exexffffxf.exe5httbb.exethnhhb.exe9pdvd.exepjpvp.exefflxfxf.exenhntbh.exetntttt.exevjvdv.exevjvpp.exenbnntt.exenhhtnb.exe9ppvj.exevpvdj.exe5fffrfr.exexrxlrrx.exepid process 1644 vpjjv.exe 2476 7fxrrfr.exe 2704 ttntbb.exe 2740 7ppjd.exe 2912 9xrrllx.exe 2744 ntnnnh.exe 2240 1dvjp.exe 2784 dddjj.exe 2624 5lrfxfr.exe 2224 hbhnbb.exe 808 nbbtnh.exe 2044 dvvpd.exe 1984 3flrrxf.exe 2292 bnbhhb.exe 2972 3thnbh.exe 2996 9jvpv.exe 804 jvddd.exe 2412 7lfxflf.exe 2096 nnbthb.exe 3028 nthhbb.exe 772 pjvpd.exe 848 pjdvp.exe 316 9frxxrx.exe 1944 nbnhhb.exe 928 hhhbbh.exe 2576 ddjdv.exe 348 djddv.exe 2288 fxlrllr.exe 976 tnhbbb.exe 884 jvdjp.exe 2384 jdvdd.exe 2452 rlxxffr.exe 2388 5rrxxxx.exe 1608 nbhbtn.exe 2924 tnnbbt.exe 2716 htbbhh.exe 2736 jpdjp.exe 3020 pdvjj.exe 2744 xffrrlx.exe 2648 lffxxfl.exe 2784 nbbbbb.exe 2652 9pvjd.exe 2688 9pddj.exe 2336 1xxxrrr.exe 1100 fxrlfxr.exe 2184 hhhtnb.exe 2164 jvdvv.exe 2880 jjpdv.exe 1988 xffffxf.exe 2960 5httbb.exe 2980 thnhhb.exe 2932 9pdvd.exe 1708 pjpvp.exe 2072 fflxfxf.exe 1480 nhntbh.exe 2592 tntttt.exe 2092 vjvdv.exe 376 vjvpp.exe 772 nbnntt.exe 484 nhhtnb.exe 2252 9ppvj.exe 1308 vpvdj.exe 636 5fffrfr.exe 1268 xrxlrrx.exe -
Processes:
resource yara_rule behavioral1/memory/2516-1-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vpjjv.exe upx behavioral1/memory/1644-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2516-3-0x0000000000220000-0x0000000000247000-memory.dmp upx \??\c:\7fxrrfr.exe upx behavioral1/memory/1644-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2476-22-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ttntbb.exe upx behavioral1/memory/2704-30-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7ppjd.exe upx behavioral1/memory/2740-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2704-38-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9xrrllx.exe upx \??\c:\ntnnnh.exe upx behavioral1/memory/2744-56-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\1dvjp.exe upx behavioral1/memory/2240-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2744-64-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\dddjj.exe upx behavioral1/memory/2624-85-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5lrfxfr.exe upx behavioral1/memory/2240-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2624-93-0x00000000003C0000-0x00000000003E7000-memory.dmp upx \??\c:\hbhnbb.exe upx behavioral1/memory/2624-95-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nbbtnh.exe upx behavioral1/memory/2224-105-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dvvpd.exe upx behavioral1/memory/808-116-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3flrrxf.exe upx \??\c:\bnbhhb.exe upx behavioral1/memory/1984-134-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3thnbh.exe upx behavioral1/memory/2972-151-0x0000000000220000-0x0000000000247000-memory.dmp upx \??\c:\9jvpv.exe upx behavioral1/memory/2996-153-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jvddd.exe upx behavioral1/memory/2996-161-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7lfxflf.exe upx behavioral1/memory/804-171-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2412-172-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2412-180-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nnbthb.exe upx C:\nthhbb.exe upx behavioral1/memory/2096-190-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3028-191-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pjvpd.exe upx \??\c:\pjdvp.exe upx behavioral1/memory/772-210-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9frxxrx.exe upx \??\c:\nbnhhb.exe upx behavioral1/memory/316-228-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hhhbbh.exe upx \??\c:\ddjdv.exe upx behavioral1/memory/928-244-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\djddv.exe upx C:\tnhbbb.exe upx behavioral1/memory/2288-271-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2288-264-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\fxlrllr.exe upx C:\jdvdd.exe upx behavioral1/memory/884-283-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jvdjp.exe upx C:\rlxxffr.exe upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
hbhnhn.exerrlrlxl.exe7btttt.exevpjdj.exe1hnbhn.exe7lrllrr.exeffxlrfx.exetnbhnn.exe3frfrlr.exejjvjd.exevppjj.exe7hbbhn.exeddpvj.exe9frfffl.exe7jdjj.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlrlxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7btttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hnbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lrllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxlrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3frfrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9frfffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d07852c288f661f8b16077a5f3c86579e2a2827ca8906787db2cfa159d9e005a.exevpjjv.exe7fxrrfr.exettntbb.exe7ppjd.exe9xrrllx.exentnnnh.exe1dvjp.exedddjj.exe5lrfxfr.exehbhnbb.exenbbtnh.exedvvpd.exe3flrrxf.exebnbhhb.exe3thnbh.exedescription pid process target process PID 2516 wrote to memory of 1644 2516 d07852c288f661f8b16077a5f3c86579e2a2827ca8906787db2cfa159d9e005a.exe vpjjv.exe PID 2516 wrote to memory of 1644 2516 d07852c288f661f8b16077a5f3c86579e2a2827ca8906787db2cfa159d9e005a.exe vpjjv.exe PID 2516 wrote to memory of 1644 2516 d07852c288f661f8b16077a5f3c86579e2a2827ca8906787db2cfa159d9e005a.exe vpjjv.exe PID 2516 wrote to memory of 1644 2516 d07852c288f661f8b16077a5f3c86579e2a2827ca8906787db2cfa159d9e005a.exe vpjjv.exe PID 1644 wrote to memory of 2476 1644 vpjjv.exe 7fxrrfr.exe PID 1644 wrote to memory of 2476 1644 vpjjv.exe 7fxrrfr.exe PID 1644 wrote to memory of 2476 1644 vpjjv.exe 7fxrrfr.exe PID 1644 wrote to memory of 2476 1644 vpjjv.exe 7fxrrfr.exe PID 2476 wrote to memory of 2704 2476 7fxrrfr.exe ttntbb.exe PID 2476 wrote to memory of 2704 2476 7fxrrfr.exe ttntbb.exe PID 2476 wrote to memory of 2704 2476 7fxrrfr.exe ttntbb.exe PID 2476 wrote to memory of 2704 2476 7fxrrfr.exe ttntbb.exe PID 2704 wrote to memory of 2740 2704 ttntbb.exe 7ppjd.exe PID 2704 wrote to memory of 2740 2704 ttntbb.exe 7ppjd.exe PID 2704 wrote to memory of 2740 2704 ttntbb.exe 7ppjd.exe PID 2704 wrote to memory of 2740 2704 ttntbb.exe 7ppjd.exe PID 2740 wrote to memory of 2912 2740 7ppjd.exe 9xrrllx.exe PID 2740 wrote to memory of 2912 2740 7ppjd.exe 9xrrllx.exe PID 2740 wrote to memory of 2912 2740 7ppjd.exe 9xrrllx.exe PID 2740 wrote to memory of 2912 2740 7ppjd.exe 9xrrllx.exe PID 2912 wrote to memory of 2744 2912 9xrrllx.exe ntnnnh.exe PID 2912 wrote to memory of 2744 2912 9xrrllx.exe ntnnnh.exe PID 2912 wrote to memory of 2744 2912 9xrrllx.exe ntnnnh.exe PID 2912 wrote to memory of 2744 2912 9xrrllx.exe ntnnnh.exe PID 2744 wrote to memory of 2240 2744 ntnnnh.exe 1dvjp.exe PID 2744 wrote to memory of 2240 2744 ntnnnh.exe 1dvjp.exe PID 2744 wrote to memory of 2240 2744 ntnnnh.exe 1dvjp.exe PID 2744 wrote to memory of 2240 2744 ntnnnh.exe 1dvjp.exe PID 2240 wrote to memory of 2784 2240 1dvjp.exe dddjj.exe PID 2240 wrote to memory of 2784 2240 1dvjp.exe dddjj.exe PID 2240 wrote to memory of 2784 2240 1dvjp.exe dddjj.exe PID 2240 wrote to memory of 2784 2240 1dvjp.exe dddjj.exe PID 2784 wrote to memory of 2624 2784 dddjj.exe 5lrfxfr.exe PID 2784 wrote to memory of 2624 2784 dddjj.exe 5lrfxfr.exe PID 2784 wrote to memory of 2624 2784 dddjj.exe 5lrfxfr.exe PID 2784 wrote to memory of 2624 2784 dddjj.exe 5lrfxfr.exe PID 2624 wrote to memory of 2224 2624 5lrfxfr.exe hbhnbb.exe PID 2624 wrote to memory of 2224 2624 5lrfxfr.exe hbhnbb.exe PID 2624 wrote to memory of 2224 2624 5lrfxfr.exe hbhnbb.exe PID 2624 wrote to memory of 2224 2624 5lrfxfr.exe hbhnbb.exe PID 2224 wrote to memory of 808 2224 hbhnbb.exe nbbtnh.exe PID 2224 wrote to memory of 808 2224 hbhnbb.exe nbbtnh.exe PID 2224 wrote to memory of 808 2224 hbhnbb.exe nbbtnh.exe PID 2224 wrote to memory of 808 2224 hbhnbb.exe nbbtnh.exe PID 808 wrote to memory of 2044 808 nbbtnh.exe dvvpd.exe PID 808 wrote to memory of 2044 808 nbbtnh.exe dvvpd.exe PID 808 wrote to memory of 2044 808 nbbtnh.exe dvvpd.exe PID 808 wrote to memory of 2044 808 nbbtnh.exe dvvpd.exe PID 2044 wrote to memory of 1984 2044 dvvpd.exe 3flrrxf.exe PID 2044 wrote to memory of 1984 2044 dvvpd.exe 3flrrxf.exe PID 2044 wrote to memory of 1984 2044 dvvpd.exe 3flrrxf.exe PID 2044 wrote to memory of 1984 2044 dvvpd.exe 3flrrxf.exe PID 1984 wrote to memory of 2292 1984 3flrrxf.exe bnbhhb.exe PID 1984 wrote to memory of 2292 1984 3flrrxf.exe bnbhhb.exe PID 1984 wrote to memory of 2292 1984 3flrrxf.exe bnbhhb.exe PID 1984 wrote to memory of 2292 1984 3flrrxf.exe bnbhhb.exe PID 2292 wrote to memory of 2972 2292 bnbhhb.exe 3thnbh.exe PID 2292 wrote to memory of 2972 2292 bnbhhb.exe 3thnbh.exe PID 2292 wrote to memory of 2972 2292 bnbhhb.exe 3thnbh.exe PID 2292 wrote to memory of 2972 2292 bnbhhb.exe 3thnbh.exe PID 2972 wrote to memory of 2996 2972 3thnbh.exe 9jvpv.exe PID 2972 wrote to memory of 2996 2972 3thnbh.exe 9jvpv.exe PID 2972 wrote to memory of 2996 2972 3thnbh.exe 9jvpv.exe PID 2972 wrote to memory of 2996 2972 3thnbh.exe 9jvpv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d07852c288f661f8b16077a5f3c86579e2a2827ca8906787db2cfa159d9e005a.exe"C:\Users\Admin\AppData\Local\Temp\d07852c288f661f8b16077a5f3c86579e2a2827ca8906787db2cfa159d9e005a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\vpjjv.exec:\vpjjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\7fxrrfr.exec:\7fxrrfr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\ttntbb.exec:\ttntbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\7ppjd.exec:\7ppjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\9xrrllx.exec:\9xrrllx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\ntnnnh.exec:\ntnnnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\1dvjp.exec:\1dvjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\dddjj.exec:\dddjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\5lrfxfr.exec:\5lrfxfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\hbhnbb.exec:\hbhnbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\nbbtnh.exec:\nbbtnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
\??\c:\dvvpd.exec:\dvvpd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\3flrrxf.exec:\3flrrxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\bnbhhb.exec:\bnbhhb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\3thnbh.exec:\3thnbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\9jvpv.exec:\9jvpv.exe17⤵
- Executes dropped EXE
PID:2996 -
\??\c:\jvddd.exec:\jvddd.exe18⤵
- Executes dropped EXE
PID:804 -
\??\c:\7lfxflf.exec:\7lfxflf.exe19⤵
- Executes dropped EXE
PID:2412 -
\??\c:\nnbthb.exec:\nnbthb.exe20⤵
- Executes dropped EXE
PID:2096 -
\??\c:\nthhbb.exec:\nthhbb.exe21⤵
- Executes dropped EXE
PID:3028 -
\??\c:\pjvpd.exec:\pjvpd.exe22⤵
- Executes dropped EXE
PID:772 -
\??\c:\pjdvp.exec:\pjdvp.exe23⤵
- Executes dropped EXE
PID:848 -
\??\c:\9frxxrx.exec:\9frxxrx.exe24⤵
- Executes dropped EXE
PID:316 -
\??\c:\nbnhhb.exec:\nbnhhb.exe25⤵
- Executes dropped EXE
PID:1944 -
\??\c:\hhhbbh.exec:\hhhbbh.exe26⤵
- Executes dropped EXE
PID:928 -
\??\c:\ddjdv.exec:\ddjdv.exe27⤵
- Executes dropped EXE
PID:2576 -
\??\c:\djddv.exec:\djddv.exe28⤵
- Executes dropped EXE
PID:348 -
\??\c:\fxlrllr.exec:\fxlrllr.exe29⤵
- Executes dropped EXE
PID:2288 -
\??\c:\tnhbbb.exec:\tnhbbb.exe30⤵
- Executes dropped EXE
PID:976 -
\??\c:\jvdjp.exec:\jvdjp.exe31⤵
- Executes dropped EXE
PID:884 -
\??\c:\jdvdd.exec:\jdvdd.exe32⤵
- Executes dropped EXE
PID:2384 -
\??\c:\rlxxffr.exec:\rlxxffr.exe33⤵
- Executes dropped EXE
PID:2452 -
\??\c:\5rrxxxx.exec:\5rrxxxx.exe34⤵
- Executes dropped EXE
PID:2388 -
\??\c:\nbhbtn.exec:\nbhbtn.exe35⤵
- Executes dropped EXE
PID:1608 -
\??\c:\tnnbbt.exec:\tnnbbt.exe36⤵
- Executes dropped EXE
PID:2924 -
\??\c:\htbbhh.exec:\htbbhh.exe37⤵
- Executes dropped EXE
PID:2716 -
\??\c:\jpdjp.exec:\jpdjp.exe38⤵
- Executes dropped EXE
PID:2736 -
\??\c:\pdvjj.exec:\pdvjj.exe39⤵
- Executes dropped EXE
PID:3020 -
\??\c:\xffrrlx.exec:\xffrrlx.exe40⤵
- Executes dropped EXE
PID:2744 -
\??\c:\lffxxfl.exec:\lffxxfl.exe41⤵
- Executes dropped EXE
PID:2648 -
\??\c:\nbbbbb.exec:\nbbbbb.exe42⤵
- Executes dropped EXE
PID:2784 -
\??\c:\9pvjd.exec:\9pvjd.exe43⤵
- Executes dropped EXE
PID:2652 -
\??\c:\9pddj.exec:\9pddj.exe44⤵
- Executes dropped EXE
PID:2688 -
\??\c:\1xxxrrr.exec:\1xxxrrr.exe45⤵
- Executes dropped EXE
PID:2336 -
\??\c:\fxrlfxr.exec:\fxrlfxr.exe46⤵
- Executes dropped EXE
PID:1100 -
\??\c:\hhhtnb.exec:\hhhtnb.exe47⤵
- Executes dropped EXE
PID:2184 -
\??\c:\jvdvv.exec:\jvdvv.exe48⤵
- Executes dropped EXE
PID:2164 -
\??\c:\jjpdv.exec:\jjpdv.exe49⤵
- Executes dropped EXE
PID:2880 -
\??\c:\xffffxf.exec:\xffffxf.exe50⤵
- Executes dropped EXE
PID:1988 -
\??\c:\5httbb.exec:\5httbb.exe51⤵
- Executes dropped EXE
PID:2960 -
\??\c:\thnhhb.exec:\thnhhb.exe52⤵
- Executes dropped EXE
PID:2980 -
\??\c:\9pdvd.exec:\9pdvd.exe53⤵
- Executes dropped EXE
PID:2932 -
\??\c:\pjpvp.exec:\pjpvp.exe54⤵
- Executes dropped EXE
PID:1708 -
\??\c:\fflxfxf.exec:\fflxfxf.exe55⤵
- Executes dropped EXE
PID:2072 -
\??\c:\nhntbh.exec:\nhntbh.exe56⤵
- Executes dropped EXE
PID:1480 -
\??\c:\tntttt.exec:\tntttt.exe57⤵
- Executes dropped EXE
PID:2592 -
\??\c:\vjvdv.exec:\vjvdv.exe58⤵
- Executes dropped EXE
PID:2092 -
\??\c:\vjvpp.exec:\vjvpp.exe59⤵
- Executes dropped EXE
PID:376 -
\??\c:\nbnntt.exec:\nbnntt.exe60⤵
- Executes dropped EXE
PID:772 -
\??\c:\nhhtnb.exec:\nhhtnb.exe61⤵
- Executes dropped EXE
PID:484 -
\??\c:\9ppvj.exec:\9ppvj.exe62⤵
- Executes dropped EXE
PID:2252 -
\??\c:\vpvdj.exec:\vpvdj.exe63⤵
- Executes dropped EXE
PID:1308 -
\??\c:\5fffrfr.exec:\5fffrfr.exe64⤵
- Executes dropped EXE
PID:636 -
\??\c:\xrxlrrx.exec:\xrxlrrx.exe65⤵
- Executes dropped EXE
PID:1268 -
\??\c:\9bnhnn.exec:\9bnhnn.exe66⤵PID:1620
-
\??\c:\vpdjp.exec:\vpdjp.exe67⤵PID:1664
-
\??\c:\jjpjd.exec:\jjpjd.exe68⤵PID:1780
-
\??\c:\dpppj.exec:\dpppj.exe69⤵PID:2536
-
\??\c:\lrfrrlr.exec:\lrfrrlr.exe70⤵PID:2124
-
\??\c:\xrlllfl.exec:\xrlllfl.exe71⤵PID:1804
-
\??\c:\3thbtt.exec:\3thbtt.exe72⤵PID:2024
-
\??\c:\bnnntt.exec:\bnnntt.exe73⤵PID:2352
-
\??\c:\5pjdj.exec:\5pjdj.exe74⤵PID:2992
-
\??\c:\jvpdj.exec:\jvpdj.exe75⤵PID:372
-
\??\c:\xrffllr.exec:\xrffllr.exe76⤵PID:2388
-
\??\c:\lxlrlfx.exec:\lxlrlfx.exe77⤵PID:1720
-
\??\c:\bntbbt.exec:\bntbbt.exe78⤵PID:2704
-
\??\c:\htbtnn.exec:\htbtnn.exe79⤵PID:2908
-
\??\c:\dvjdp.exec:\dvjdp.exe80⤵PID:2892
-
\??\c:\3dpjj.exec:\3dpjj.exe81⤵PID:1056
-
\??\c:\frxrxff.exec:\frxrxff.exe82⤵PID:2968
-
\??\c:\rrlrlxl.exec:\rrlrlxl.exe83⤵
- System Location Discovery: System Language Discovery
PID:2744 -
\??\c:\nbntbh.exec:\nbntbh.exe84⤵PID:2648
-
\??\c:\btthbt.exec:\btthbt.exe85⤵PID:2728
-
\??\c:\vjppp.exec:\vjppp.exe86⤵PID:2664
-
\??\c:\jdjpd.exec:\jdjpd.exe87⤵PID:2220
-
\??\c:\9rxxrrl.exec:\9rxxrrl.exe88⤵PID:2904
-
\??\c:\7frlrxf.exec:\7frlrxf.exe89⤵PID:808
-
\??\c:\1bhhbt.exec:\1bhhbt.exe90⤵PID:2208
-
\??\c:\nhnntn.exec:\nhnntn.exe91⤵PID:2700
-
\??\c:\jddpp.exec:\jddpp.exe92⤵PID:1008
-
\??\c:\dvpvv.exec:\dvpvv.exe93⤵PID:2712
-
\??\c:\rflfffl.exec:\rflfffl.exe94⤵PID:2052
-
\??\c:\7fxrrlf.exec:\7fxrrlf.exe95⤵PID:1956
-
\??\c:\ntnbbt.exec:\ntnbbt.exe96⤵PID:2996
-
\??\c:\hhtnhb.exec:\hhtnhb.exe97⤵PID:1764
-
\??\c:\jdvdd.exec:\jdvdd.exe98⤵PID:1424
-
\??\c:\fxlrlrr.exec:\fxlrlrr.exe99⤵PID:388
-
\??\c:\7rxxflr.exec:\7rxxflr.exe100⤵PID:1480
-
\??\c:\xrlrxxf.exec:\xrlrxxf.exe101⤵PID:1728
-
\??\c:\nnbbhh.exec:\nnbbhh.exe102⤵PID:400
-
\??\c:\hbntbt.exec:\hbntbt.exe103⤵PID:2016
-
\??\c:\ddjjj.exec:\ddjjj.exe104⤵PID:1084
-
\??\c:\5lxxfff.exec:\5lxxfff.exe105⤵PID:2432
-
\??\c:\rlxflff.exec:\rlxflff.exe106⤵PID:1088
-
\??\c:\9tbnhn.exec:\9tbnhn.exe107⤵PID:1944
-
\??\c:\hbhbhh.exec:\hbhbhh.exe108⤵PID:960
-
\??\c:\vvvjj.exec:\vvvjj.exe109⤵PID:1624
-
\??\c:\jpjjp.exec:\jpjjp.exe110⤵PID:2576
-
\??\c:\3llflll.exec:\3llflll.exe111⤵PID:2552
-
\??\c:\btbtbb.exec:\btbtbb.exe112⤵PID:944
-
\??\c:\bbtnbt.exec:\bbtnbt.exe113⤵PID:612
-
\??\c:\jvpvj.exec:\jvpvj.exe114⤵PID:1776
-
\??\c:\1dpvv.exec:\1dpvv.exe115⤵PID:3040
-
\??\c:\rffllff.exec:\rffllff.exe116⤵PID:888
-
\??\c:\rffllff.exec:\rffllff.exe117⤵PID:2488
-
\??\c:\5rlxxxx.exec:\5rlxxxx.exe118⤵PID:1788
-
\??\c:\thnbtn.exec:\thnbtn.exe119⤵PID:1612
-
\??\c:\hbnttn.exec:\hbnttn.exe120⤵PID:1588
-
\??\c:\vjjjj.exec:\vjjjj.exe121⤵PID:2768
-
\??\c:\pdvvv.exec:\pdvvv.exe122⤵PID:2924
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-