Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-11-2024 03:23
Behavioral task
behavioral1
Sample
bc3f27b09d33760545ead7e9a7c21a636ba43d937c6a698e08dc80efeaa9581c.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
bc3f27b09d33760545ead7e9a7c21a636ba43d937c6a698e08dc80efeaa9581c.exe
-
Size
332KB
-
MD5
34eba087a74dc09e5d847edba740b5a5
-
SHA1
52371284d5d82f9cb70f9b968e24e2a5d9684a8f
-
SHA256
bc3f27b09d33760545ead7e9a7c21a636ba43d937c6a698e08dc80efeaa9581c
-
SHA512
07d546cb863a5cfd1dd8aad24e17ba59b4edbe714921147d3363dbbb671a96c9e7fa671c53e001f31b1b61ad83ba4f99ef19a9f718a989cb0bc79541fe3e700f
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeN:R4wFHoSHYHUrAwfMp3CDN
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/2732-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/560-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2272-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2732-296-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1496-295-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2752-307-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1704-517-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1004-725-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2368-698-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1088-655-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3016-434-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/292-335-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2160-323-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1520-285-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1708-248-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1620-243-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/892-238-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2324-215-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2188-200-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2272-181-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1244-166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1568-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3060-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2808-133-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3024-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1640-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2360-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2360-96-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/1412-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1412-78-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/576-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2316-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2588-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2748-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2948-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2696-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2792-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2104-14625-0x0000000077290000-0x00000000773AF000-memory.dmp family_blackmoon behavioral1/memory/2104-24858-0x0000000077290000-0x00000000773AF000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2732 vvvjd.exe 2696 vpdjd.exe 2948 7flrrfl.exe 2748 ttnnhb.exe 2588 vpddp.exe 2316 lllrxxl.exe 576 3rllrfr.exe 1412 5tnnht.exe 560 pppdv.exe 2360 xxxxffl.exe 1640 vdddp.exe 3024 7jvpv.exe 2980 rrllxlx.exe 2808 tbbnnt.exe 2992 pppvd.exe 3060 flrfrlf.exe 1568 9nnthn.exe 1244 7pddp.exe 1840 lfxrlrf.exe 2272 3rfffxf.exe 2216 1ddvp.exe 2188 fxrxlxr.exe 672 nhbntn.exe 2324 djvpp.exe 1620 lfxrxfr.exe 1708 hhhbtb.exe 892 dpppv.exe 1600 rlfllxf.exe 236 9bthtt.exe 1888 djpjp.exe 2660 rfxffxf.exe 2492 rlrllrl.exe 2036 1nnbth.exe 2104 ppdjp.exe 1496 lxxrrrr.exe 2732 9bthbt.exe 2752 djjvj.exe 2572 xxxrflf.exe 1940 lfxfxfl.exe 2160 hhbhbb.exe 448 pvpvj.exe 292 lrffrrr.exe 1412 9bhhth.exe 1736 ppvpp.exe 2476 jdjjp.exe 2860 llxxxlf.exe 588 tthbhn.exe 2068 9ttnbh.exe 2960 vdpdv.exe 2840 fxrrxrr.exe 2124 xrflrfl.exe 3040 hbhbhn.exe 684 jdddd.exe 1088 ddpvj.exe 1580 fxxlrlx.exe 2936 bhnthb.exe 2260 nnbhnh.exe 2176 5jjvd.exe 2436 9vvdd.exe 2700 rrxlxrf.exe 3016 bbbnnb.exe 1400 bthhtt.exe 2420 vpvjd.exe 2984 7jvpv.exe -
resource yara_rule behavioral1/files/0x00090000000120f6-8.dat upx behavioral1/memory/2732-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016d69-26.dat upx behavioral1/files/0x0008000000016d6d-35.dat upx behavioral1/files/0x0007000000016de0-54.dat upx behavioral1/files/0x0007000000016dea-63.dat upx behavioral1/files/0x0008000000016eb4-72.dat upx behavioral1/files/0x0008000000017047-80.dat upx behavioral1/files/0x0005000000019227-89.dat upx behavioral1/memory/560-88-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019261-118.dat upx behavioral1/files/0x000500000001926a-125.dat upx behavioral1/files/0x0005000000019284-141.dat upx behavioral1/files/0x00050000000192a9-150.dat upx behavioral1/files/0x0005000000019379-158.dat upx behavioral1/files/0x000500000001939d-167.dat upx behavioral1/files/0x00050000000193a4-175.dat upx behavioral1/memory/2272-183-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001942c-192.dat upx behavioral1/files/0x0005000000019456-209.dat upx behavioral1/files/0x000500000001945c-216.dat upx behavioral1/files/0x0034000000016d3f-223.dat upx behavioral1/files/0x0005000000019467-231.dat upx behavioral1/files/0x0005000000019496-240.dat upx behavioral1/files/0x00050000000194ad-249.dat upx behavioral1/files/0x00050000000194d0-256.dat upx behavioral1/memory/2732-296-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1496-295-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2752-307-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/448-324-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1704-517-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1780-577-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2140-819-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1944-893-0x00000000001B0000-0x00000000001D7000-memory.dmp upx behavioral1/memory/1436-1000-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2376-988-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2260-919-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1736-851-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1520-790-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2800-789-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2800-783-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1004-725-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2176-676-0x00000000003C0000-0x00000000003E7000-memory.dmp upx behavioral1/memory/1088-655-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2424-561-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2620-539-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1004-460-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3016-434-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/292-335-0x00000000003A0000-0x00000000003C7000-memory.dmp upx behavioral1/memory/2160-323-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1520-285-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194fc-271.dat upx behavioral1/files/0x00050000000194ef-263.dat upx behavioral1/memory/1708-248-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1620-243-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/892-238-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1708-224-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019438-201.dat upx behavioral1/memory/2188-200-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193ac-184.dat upx behavioral1/memory/1840-174-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/1244-166-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1568-157-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3060-148-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nthnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfxlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrxlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhthnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2792 wrote to memory of 2732 2792 bc3f27b09d33760545ead7e9a7c21a636ba43d937c6a698e08dc80efeaa9581c.exe 30 PID 2792 wrote to memory of 2732 2792 bc3f27b09d33760545ead7e9a7c21a636ba43d937c6a698e08dc80efeaa9581c.exe 30 PID 2792 wrote to memory of 2732 2792 bc3f27b09d33760545ead7e9a7c21a636ba43d937c6a698e08dc80efeaa9581c.exe 30 PID 2792 wrote to memory of 2732 2792 bc3f27b09d33760545ead7e9a7c21a636ba43d937c6a698e08dc80efeaa9581c.exe 30 PID 2732 wrote to memory of 2696 2732 vvvjd.exe 255 PID 2732 wrote to memory of 2696 2732 vvvjd.exe 255 PID 2732 wrote to memory of 2696 2732 vvvjd.exe 255 PID 2732 wrote to memory of 2696 2732 vvvjd.exe 255 PID 2696 wrote to memory of 2948 2696 vpdjd.exe 32 PID 2696 wrote to memory of 2948 2696 vpdjd.exe 32 PID 2696 wrote to memory of 2948 2696 vpdjd.exe 32 PID 2696 wrote to memory of 2948 2696 vpdjd.exe 32 PID 2948 wrote to memory of 2748 2948 7flrrfl.exe 33 PID 2948 wrote to memory of 2748 2948 7flrrfl.exe 33 PID 2948 wrote to memory of 2748 2948 7flrrfl.exe 33 PID 2948 wrote to memory of 2748 2948 7flrrfl.exe 33 PID 2748 wrote to memory of 2588 2748 ttnnhb.exe 34 PID 2748 wrote to memory of 2588 2748 ttnnhb.exe 34 PID 2748 wrote to memory of 2588 2748 ttnnhb.exe 34 PID 2748 wrote to memory of 2588 2748 ttnnhb.exe 34 PID 2588 wrote to memory of 2316 2588 vpddp.exe 35 PID 2588 wrote to memory of 2316 2588 vpddp.exe 35 PID 2588 wrote to memory of 2316 2588 vpddp.exe 35 PID 2588 wrote to memory of 2316 2588 vpddp.exe 35 PID 2316 wrote to memory of 576 2316 lllrxxl.exe 36 PID 2316 wrote to memory of 576 2316 lllrxxl.exe 36 PID 2316 wrote to memory of 576 2316 lllrxxl.exe 36 PID 2316 wrote to memory of 576 2316 lllrxxl.exe 36 PID 576 wrote to memory of 1412 576 3rllrfr.exe 37 PID 576 wrote to memory of 1412 576 3rllrfr.exe 37 PID 576 wrote to memory of 1412 576 3rllrfr.exe 37 PID 576 wrote to memory of 1412 576 3rllrfr.exe 37 PID 1412 wrote to memory of 560 1412 5tnnht.exe 38 PID 1412 wrote to memory of 560 1412 5tnnht.exe 38 PID 1412 wrote to memory of 560 1412 5tnnht.exe 38 PID 1412 wrote to memory of 560 1412 5tnnht.exe 38 PID 560 wrote to memory of 2360 560 pppdv.exe 39 PID 560 wrote to memory of 2360 560 pppdv.exe 39 PID 560 wrote to memory of 2360 560 pppdv.exe 39 PID 560 wrote to memory of 2360 560 pppdv.exe 39 PID 2360 wrote to memory of 1640 2360 xxxxffl.exe 40 PID 2360 wrote to memory of 1640 2360 xxxxffl.exe 40 PID 2360 wrote to memory of 1640 2360 xxxxffl.exe 40 PID 2360 wrote to memory of 1640 2360 xxxxffl.exe 40 PID 1640 wrote to memory of 3024 1640 vdddp.exe 473 PID 1640 wrote to memory of 3024 1640 vdddp.exe 473 PID 1640 wrote to memory of 3024 1640 vdddp.exe 473 PID 1640 wrote to memory of 3024 1640 vdddp.exe 473 PID 3024 wrote to memory of 2980 3024 7jvpv.exe 42 PID 3024 wrote to memory of 2980 3024 7jvpv.exe 42 PID 3024 wrote to memory of 2980 3024 7jvpv.exe 42 PID 3024 wrote to memory of 2980 3024 7jvpv.exe 42 PID 2980 wrote to memory of 2808 2980 rrllxlx.exe 43 PID 2980 wrote to memory of 2808 2980 rrllxlx.exe 43 PID 2980 wrote to memory of 2808 2980 rrllxlx.exe 43 PID 2980 wrote to memory of 2808 2980 rrllxlx.exe 43 PID 2808 wrote to memory of 2992 2808 tbbnnt.exe 44 PID 2808 wrote to memory of 2992 2808 tbbnnt.exe 44 PID 2808 wrote to memory of 2992 2808 tbbnnt.exe 44 PID 2808 wrote to memory of 2992 2808 tbbnnt.exe 44 PID 2992 wrote to memory of 3060 2992 pppvd.exe 45 PID 2992 wrote to memory of 3060 2992 pppvd.exe 45 PID 2992 wrote to memory of 3060 2992 pppvd.exe 45 PID 2992 wrote to memory of 3060 2992 pppvd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\bc3f27b09d33760545ead7e9a7c21a636ba43d937c6a698e08dc80efeaa9581c.exe"C:\Users\Admin\AppData\Local\Temp\bc3f27b09d33760545ead7e9a7c21a636ba43d937c6a698e08dc80efeaa9581c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\vvvjd.exec:\vvvjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\vpdjd.exec:\vpdjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\7flrrfl.exec:\7flrrfl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\ttnnhb.exec:\ttnnhb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\vpddp.exec:\vpddp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\lllrxxl.exec:\lllrxxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\3rllrfr.exec:\3rllrfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:576 -
\??\c:\5tnnht.exec:\5tnnht.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
\??\c:\pppdv.exec:\pppdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
\??\c:\xxxxffl.exec:\xxxxffl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\vdddp.exec:\vdddp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\7jvpv.exec:\7jvpv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\rrllxlx.exec:\rrllxlx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\tbbnnt.exec:\tbbnnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\pppvd.exec:\pppvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\flrfrlf.exec:\flrfrlf.exe17⤵
- Executes dropped EXE
PID:3060 -
\??\c:\9nnthn.exec:\9nnthn.exe18⤵
- Executes dropped EXE
PID:1568 -
\??\c:\7pddp.exec:\7pddp.exe19⤵
- Executes dropped EXE
PID:1244 -
\??\c:\lfxrlrf.exec:\lfxrlrf.exe20⤵
- Executes dropped EXE
PID:1840 -
\??\c:\3rfffxf.exec:\3rfffxf.exe21⤵
- Executes dropped EXE
PID:2272 -
\??\c:\1ddvp.exec:\1ddvp.exe22⤵
- Executes dropped EXE
PID:2216 -
\??\c:\fxrxlxr.exec:\fxrxlxr.exe23⤵
- Executes dropped EXE
PID:2188 -
\??\c:\nhbntn.exec:\nhbntn.exe24⤵
- Executes dropped EXE
PID:672 -
\??\c:\djvpp.exec:\djvpp.exe25⤵
- Executes dropped EXE
PID:2324 -
\??\c:\lfxrxfr.exec:\lfxrxfr.exe26⤵
- Executes dropped EXE
PID:1620 -
\??\c:\hhhbtb.exec:\hhhbtb.exe27⤵
- Executes dropped EXE
PID:1708 -
\??\c:\dpppv.exec:\dpppv.exe28⤵
- Executes dropped EXE
PID:892 -
\??\c:\rlfllxf.exec:\rlfllxf.exe29⤵
- Executes dropped EXE
PID:1600 -
\??\c:\9bthtt.exec:\9bthtt.exe30⤵
- Executes dropped EXE
PID:236 -
\??\c:\djpjp.exec:\djpjp.exe31⤵
- Executes dropped EXE
PID:1888 -
\??\c:\rfxffxf.exec:\rfxffxf.exe32⤵
- Executes dropped EXE
PID:2660 -
\??\c:\rlrllrl.exec:\rlrllrl.exe33⤵
- Executes dropped EXE
PID:2492 -
\??\c:\1nnbth.exec:\1nnbth.exe34⤵
- Executes dropped EXE
PID:2036 -
\??\c:\ppdjp.exec:\ppdjp.exe35⤵
- Executes dropped EXE
PID:2104 -
\??\c:\rxrffrf.exec:\rxrffrf.exe36⤵PID:1520
-
\??\c:\lxxrrrr.exec:\lxxrrrr.exe37⤵
- Executes dropped EXE
PID:1496 -
\??\c:\9bthbt.exec:\9bthbt.exe38⤵
- Executes dropped EXE
PID:2732 -
\??\c:\djjvj.exec:\djjvj.exe39⤵
- Executes dropped EXE
PID:2752 -
\??\c:\xxxrflf.exec:\xxxrflf.exe40⤵
- Executes dropped EXE
PID:2572 -
\??\c:\lfxfxfl.exec:\lfxfxfl.exe41⤵
- Executes dropped EXE
PID:1940 -
\??\c:\hhbhbb.exec:\hhbhbb.exe42⤵
- Executes dropped EXE
PID:2160 -
\??\c:\pvpvj.exec:\pvpvj.exe43⤵
- Executes dropped EXE
PID:448 -
\??\c:\lrffrrr.exec:\lrffrrr.exe44⤵
- Executes dropped EXE
PID:292 -
\??\c:\9bhhth.exec:\9bhhth.exe45⤵
- Executes dropped EXE
PID:1412 -
\??\c:\ppvpp.exec:\ppvpp.exe46⤵
- Executes dropped EXE
PID:1736 -
\??\c:\jdjjp.exec:\jdjjp.exe47⤵
- Executes dropped EXE
PID:2476 -
\??\c:\llxxxlf.exec:\llxxxlf.exe48⤵
- Executes dropped EXE
PID:2860 -
\??\c:\tthbhn.exec:\tthbhn.exe49⤵
- Executes dropped EXE
PID:588 -
\??\c:\9ttnbh.exec:\9ttnbh.exe50⤵
- Executes dropped EXE
PID:2068 -
\??\c:\vdpdv.exec:\vdpdv.exe51⤵
- Executes dropped EXE
PID:2960 -
\??\c:\fxrrxrr.exec:\fxrrxrr.exe52⤵
- Executes dropped EXE
PID:2840 -
\??\c:\xrflrfl.exec:\xrflrfl.exe53⤵
- Executes dropped EXE
PID:2124 -
\??\c:\hbhbhn.exec:\hbhbhn.exe54⤵
- Executes dropped EXE
PID:3040 -
\??\c:\jdddd.exec:\jdddd.exe55⤵
- Executes dropped EXE
PID:684 -
\??\c:\ddpvj.exec:\ddpvj.exe56⤵
- Executes dropped EXE
PID:1088 -
\??\c:\fxxlrlx.exec:\fxxlrlx.exe57⤵
- Executes dropped EXE
PID:1580 -
\??\c:\bhnthb.exec:\bhnthb.exe58⤵
- Executes dropped EXE
PID:2936 -
\??\c:\nnbhnh.exec:\nnbhnh.exe59⤵
- Executes dropped EXE
PID:2260 -
\??\c:\5jjvd.exec:\5jjvd.exe60⤵
- Executes dropped EXE
PID:2176 -
\??\c:\9vvdd.exec:\9vvdd.exe61⤵
- Executes dropped EXE
PID:2436 -
\??\c:\rrxlxrf.exec:\rrxlxrf.exe62⤵
- Executes dropped EXE
PID:2700 -
\??\c:\bbbnnb.exec:\bbbnnb.exe63⤵
- Executes dropped EXE
PID:3016 -
\??\c:\bthhtt.exec:\bthhtt.exe64⤵
- Executes dropped EXE
PID:1400 -
\??\c:\vpvjd.exec:\vpvjd.exe65⤵
- Executes dropped EXE
PID:2420 -
\??\c:\7jvpv.exec:\7jvpv.exe66⤵
- Executes dropped EXE
PID:2984 -
\??\c:\ffxrflf.exec:\ffxrflf.exe67⤵PID:1972
-
\??\c:\xflffxf.exec:\xflffxf.exe68⤵PID:1688
-
\??\c:\bnbtbb.exec:\bnbtbb.exe69⤵PID:1004
-
\??\c:\ppjvp.exec:\ppjvp.exe70⤵PID:1656
-
\??\c:\9vpdp.exec:\9vpdp.exe71⤵PID:1576
-
\??\c:\lflxffx.exec:\lflxffx.exe72⤵PID:1852
-
\??\c:\tnbnbh.exec:\tnbnbh.exe73⤵PID:1140
-
\??\c:\ppjjv.exec:\ppjjv.exe74⤵PID:1600
-
\??\c:\ppvpp.exec:\ppvpp.exe75⤵PID:2352
-
\??\c:\5rflxfr.exec:\5rflxfr.exe76⤵PID:1888
-
\??\c:\ntnhth.exec:\ntnhth.exe77⤵PID:972
-
\??\c:\nnhntb.exec:\nnhntb.exe78⤵PID:1752
-
\??\c:\3ddpd.exec:\3ddpd.exe79⤵PID:1704
-
\??\c:\rfrrffr.exec:\rfrrffr.exe80⤵PID:2036
-
\??\c:\fxlxllr.exec:\fxlxllr.exe81⤵PID:2824
-
\??\c:\tnbnhn.exec:\tnbnhn.exe82⤵PID:1520
-
\??\c:\3btnth.exec:\3btnth.exe83⤵PID:2880
-
\??\c:\3dvdj.exec:\3dvdj.exe84⤵PID:2620
-
\??\c:\llfrlrl.exec:\llfrlrl.exe85⤵PID:2632
-
\??\c:\rrfrllf.exec:\rrfrllf.exe86⤵PID:2712
-
\??\c:\rlxfrrx.exec:\rlxfrrx.exe87⤵PID:2592
-
\??\c:\tnnbnb.exec:\tnnbnb.exe88⤵PID:2424
-
\??\c:\pvpdv.exec:\pvpdv.exe89⤵PID:2284
-
\??\c:\fflrffl.exec:\fflrffl.exe90⤵PID:2504
-
\??\c:\xlfrxfr.exec:\xlfrxfr.exe91⤵PID:1780
-
\??\c:\tnhtht.exec:\tnhtht.exe92⤵PID:2184
-
\??\c:\nnhnbn.exec:\nnhnbn.exe93⤵PID:2672
-
\??\c:\jppvv.exec:\jppvv.exe94⤵PID:1240
-
\??\c:\1xlllrx.exec:\1xlllrx.exe95⤵PID:2828
-
\??\c:\xllfrfl.exec:\xllfrfl.exe96⤵PID:2796
-
\??\c:\nhthbb.exec:\nhthbb.exe97⤵PID:2576
-
\??\c:\bhhthb.exec:\bhhthb.exe98⤵PID:1928
-
\??\c:\vdjdd.exec:\vdjdd.exe99⤵PID:2644
-
\??\c:\5jjpd.exec:\5jjpd.exe100⤵PID:1072
-
\??\c:\lflfxlr.exec:\lflfxlr.exe101⤵PID:2180
-
\??\c:\1thnnb.exec:\1thnnb.exe102⤵PID:2580
-
\??\c:\ntttbn.exec:\ntttbn.exe103⤵PID:784
-
\??\c:\9jjvd.exec:\9jjvd.exe104⤵PID:3060
-
\??\c:\3vpdp.exec:\3vpdp.exe105⤵
- System Location Discovery: System Language Discovery
PID:1088 -
\??\c:\rxxlffr.exec:\rxxlffr.exe106⤵PID:592
-
\??\c:\llrrffx.exec:\llrrffx.exe107⤵PID:1244
-
\??\c:\bbhnbn.exec:\bbhnbn.exe108⤵PID:1784
-
\??\c:\bbnbnb.exec:\bbnbnb.exe109⤵PID:2176
-
\??\c:\1pjdp.exec:\1pjdp.exe110⤵PID:2436
-
\??\c:\pdpvv.exec:\pdpvv.exe111⤵PID:2700
-
\??\c:\lfrrxxl.exec:\lfrrxxl.exe112⤵PID:2868
-
\??\c:\thttnt.exec:\thttnt.exe113⤵PID:2368
-
\??\c:\nbnhhh.exec:\nbnhhh.exe114⤵PID:2188
-
\??\c:\3vjpv.exec:\3vjpv.exe115⤵PID:2836
-
\??\c:\3pddj.exec:\3pddj.exe116⤵PID:672
-
\??\c:\xfxlffx.exec:\xfxlffx.exe117⤵PID:1504
-
\??\c:\xxfxxlf.exec:\xxfxxlf.exe118⤵PID:1004
-
\??\c:\5htbnn.exec:\5htbnn.exe119⤵PID:1656
-
\??\c:\7nhhnn.exec:\7nhhnn.exe120⤵PID:1576
-
\??\c:\3dvvj.exec:\3dvvj.exe121⤵PID:1852
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-