Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18-12-2024 23:07
Behavioral task
behavioral1
Sample
677ceadc1d1e9673c3dcce269b93e6036ec5564f1f9b43cd25e57763327a1507.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
677ceadc1d1e9673c3dcce269b93e6036ec5564f1f9b43cd25e57763327a1507.exe
-
Size
333KB
-
MD5
9b4eed62a5625d53da749c7a6cd54d81
-
SHA1
85bef3b9fbb59257e3645cde5f26becd134d16e8
-
SHA256
677ceadc1d1e9673c3dcce269b93e6036ec5564f1f9b43cd25e57763327a1507
-
SHA512
ba4bf4255460f7f5154c28c0b60b9f79457304ebb632e993fbbf3f1737948810ce7838afd331295244bd72dc675012fc85a7628771b2f01cf4d54de5b2d54624
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbel:R4wFHoSHYHUrAwfMp3CDl
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 51 IoCs
resource yara_rule behavioral1/memory/1840-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1768-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1828-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2440-34-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2440-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2604-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2652-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2740-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2184-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2636-75-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2692-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2632-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3008-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1968-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2488-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1664-140-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1664-137-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1944-149-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1888-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1032-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1452-187-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/1452-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1452-188-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/792-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/588-243-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2416-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2552-273-0x00000000773C0000-0x00000000774DF000-memory.dmp family_blackmoon behavioral1/memory/2552-275-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2288-281-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1500-287-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1848-293-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1848-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2780-331-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2516-353-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2984-364-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/1180-380-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2324-391-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/292-412-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1864-423-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2688-454-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/588-500-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2832-593-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2808-600-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2388-789-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1828-796-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/896-912-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2284-972-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2552-1443-0x00000000773C0000-0x00000000774DF000-memory.dmp family_blackmoon behavioral1/memory/2552-18051-0x00000000773C0000-0x00000000774DF000-memory.dmp family_blackmoon behavioral1/memory/2552-20534-0x00000000772C0000-0x00000000773BA000-memory.dmp family_blackmoon behavioral1/memory/2552-22188-0x00000000772C0000-0x00000000773BA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1768 7pdpv.exe 1828 vpjdv.exe 2440 lllrlxr.exe 2604 flrrlxf.exe 2652 hbnntb.exe 2740 vvpdd.exe 2184 xffrxrx.exe 2636 nhhhtt.exe 2692 vjjpp.exe 2568 rrrxfrf.exe 2632 1nnntb.exe 3008 ppjjv.exe 1968 fxrxffl.exe 2488 bhbbhb.exe 1664 llxllxl.exe 1944 frrlxlf.exe 316 jddjv.exe 1712 9lffrrf.exe 1888 hbbtbn.exe 1032 bhnnnt.exe 1452 rrflxfl.exe 2960 bbnbbb.exe 792 pppvv.exe 1400 rllxlxl.exe 408 tnnbth.exe 1008 dvdvp.exe 1688 9rflrlx.exe 588 bttbnn.exe 2416 ppddj.exe 1556 7fxxllx.exe 580 bnnnhb.exe 2872 dpvvv.exe 2552 rrlrxxl.exe 1500 xlxfrfl.exe 1848 xfxrlfx.exe 1828 7hhnbb.exe 2260 dvppd.exe 2440 3xrxlrx.exe 2660 lfxxlrf.exe 2724 bnhntt.exe 2884 hbnhbt.exe 2780 pdpdp.exe 1232 9flxxlf.exe 2548 hbtnth.exe 2676 bhhttt.exe 2516 1pdpd.exe 2588 lffrrrf.exe 2984 rlrllrx.exe 2564 hhnnnn.exe 1096 ppjdj.exe 1180 vvjvj.exe 896 rlflrrx.exe 2324 hbnhnn.exe 1928 btthtb.exe 1352 vpdjj.exe 1348 llfxflx.exe 292 ffxxflr.exe 1732 bbbntt.exe 1864 hnttnt.exe 2572 ppdjp.exe 2812 rrlxffl.exe 2828 fxxfrxf.exe 2964 hhttht.exe 1452 ddvjp.exe -
resource yara_rule behavioral1/memory/1840-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000120fe-9.dat upx behavioral1/memory/1768-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1840-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000019030-19.dat upx behavioral1/memory/1768-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1828-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000001920f-26.dat upx behavioral1/memory/2440-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000019228-35.dat upx behavioral1/memory/2604-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000019234-43.dat upx behavioral1/memory/2652-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000019241-52.dat upx behavioral1/files/0x000600000001925c-59.dat upx behavioral1/memory/2740-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000192f0-68.dat upx behavioral1/memory/2184-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194d4-76.dat upx behavioral1/memory/2692-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194da-84.dat upx behavioral1/files/0x00050000000194e2-93.dat upx behavioral1/memory/2632-94-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194ea-102.dat upx behavioral1/memory/2632-103-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2632-101-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/3008-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1968-112-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194f2-110.dat upx behavioral1/files/0x00050000000194f6-120.dat upx behavioral1/memory/1968-119-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019501-129.dat upx behavioral1/memory/2488-130-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1664-140-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019503-139.dat upx behavioral1/memory/1944-149-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019515-148.dat upx behavioral1/files/0x000500000001953a-156.dat upx behavioral1/files/0x000500000001957c-164.dat upx behavioral1/memory/1712-163-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/1888-171-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019589-172.dat upx behavioral1/files/0x0009000000018bcd-180.dat upx behavioral1/memory/1032-179-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1452-187-0x00000000002C0000-0x00000000002E7000-memory.dmp upx behavioral1/memory/1452-190-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001961b-189.dat upx behavioral1/files/0x000500000001961f-197.dat upx behavioral1/memory/792-204-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019624-205.dat upx behavioral1/files/0x0005000000019625-212.dat upx behavioral1/files/0x00050000000197c1-219.dat upx behavioral1/files/0x0005000000019aea-226.dat upx behavioral1/files/0x0005000000019aec-234.dat upx behavioral1/memory/588-243-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019aee-244.dat upx behavioral1/files/0x0005000000019c50-251.dat upx behavioral1/memory/2416-250-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019c66-258.dat upx behavioral1/files/0x0005000000019c68-265.dat upx behavioral1/memory/2552-275-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2288-281-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1500-287-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/1848-294-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfxlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1840 wrote to memory of 1768 1840 677ceadc1d1e9673c3dcce269b93e6036ec5564f1f9b43cd25e57763327a1507.exe 30 PID 1840 wrote to memory of 1768 1840 677ceadc1d1e9673c3dcce269b93e6036ec5564f1f9b43cd25e57763327a1507.exe 30 PID 1840 wrote to memory of 1768 1840 677ceadc1d1e9673c3dcce269b93e6036ec5564f1f9b43cd25e57763327a1507.exe 30 PID 1840 wrote to memory of 1768 1840 677ceadc1d1e9673c3dcce269b93e6036ec5564f1f9b43cd25e57763327a1507.exe 30 PID 1768 wrote to memory of 1828 1768 7pdpv.exe 31 PID 1768 wrote to memory of 1828 1768 7pdpv.exe 31 PID 1768 wrote to memory of 1828 1768 7pdpv.exe 31 PID 1768 wrote to memory of 1828 1768 7pdpv.exe 31 PID 1828 wrote to memory of 2440 1828 vpjdv.exe 32 PID 1828 wrote to memory of 2440 1828 vpjdv.exe 32 PID 1828 wrote to memory of 2440 1828 vpjdv.exe 32 PID 1828 wrote to memory of 2440 1828 vpjdv.exe 32 PID 2440 wrote to memory of 2604 2440 lllrlxr.exe 33 PID 2440 wrote to memory of 2604 2440 lllrlxr.exe 33 PID 2440 wrote to memory of 2604 2440 lllrlxr.exe 33 PID 2440 wrote to memory of 2604 2440 lllrlxr.exe 33 PID 2604 wrote to memory of 2652 2604 flrrlxf.exe 34 PID 2604 wrote to memory of 2652 2604 flrrlxf.exe 34 PID 2604 wrote to memory of 2652 2604 flrrlxf.exe 34 PID 2604 wrote to memory of 2652 2604 flrrlxf.exe 34 PID 2652 wrote to memory of 2740 2652 hbnntb.exe 35 PID 2652 wrote to memory of 2740 2652 hbnntb.exe 35 PID 2652 wrote to memory of 2740 2652 hbnntb.exe 35 PID 2652 wrote to memory of 2740 2652 hbnntb.exe 35 PID 2740 wrote to memory of 2184 2740 vvpdd.exe 36 PID 2740 wrote to memory of 2184 2740 vvpdd.exe 36 PID 2740 wrote to memory of 2184 2740 vvpdd.exe 36 PID 2740 wrote to memory of 2184 2740 vvpdd.exe 36 PID 2184 wrote to memory of 2636 2184 xffrxrx.exe 37 PID 2184 wrote to memory of 2636 2184 xffrxrx.exe 37 PID 2184 wrote to memory of 2636 2184 xffrxrx.exe 37 PID 2184 wrote to memory of 2636 2184 xffrxrx.exe 37 PID 2636 wrote to memory of 2692 2636 nhhhtt.exe 38 PID 2636 wrote to memory of 2692 2636 nhhhtt.exe 38 PID 2636 wrote to memory of 2692 2636 nhhhtt.exe 38 PID 2636 wrote to memory of 2692 2636 nhhhtt.exe 38 PID 2692 wrote to memory of 2568 2692 vjjpp.exe 39 PID 2692 wrote to memory of 2568 2692 vjjpp.exe 39 PID 2692 wrote to memory of 2568 2692 vjjpp.exe 39 PID 2692 wrote to memory of 2568 2692 vjjpp.exe 39 PID 2568 wrote to memory of 2632 2568 rrrxfrf.exe 40 PID 2568 wrote to memory of 2632 2568 rrrxfrf.exe 40 PID 2568 wrote to memory of 2632 2568 rrrxfrf.exe 40 PID 2568 wrote to memory of 2632 2568 rrrxfrf.exe 40 PID 2632 wrote to memory of 3008 2632 1nnntb.exe 41 PID 2632 wrote to memory of 3008 2632 1nnntb.exe 41 PID 2632 wrote to memory of 3008 2632 1nnntb.exe 41 PID 2632 wrote to memory of 3008 2632 1nnntb.exe 41 PID 3008 wrote to memory of 1968 3008 ppjjv.exe 42 PID 3008 wrote to memory of 1968 3008 ppjjv.exe 42 PID 3008 wrote to memory of 1968 3008 ppjjv.exe 42 PID 3008 wrote to memory of 1968 3008 ppjjv.exe 42 PID 1968 wrote to memory of 2488 1968 fxrxffl.exe 43 PID 1968 wrote to memory of 2488 1968 fxrxffl.exe 43 PID 1968 wrote to memory of 2488 1968 fxrxffl.exe 43 PID 1968 wrote to memory of 2488 1968 fxrxffl.exe 43 PID 2488 wrote to memory of 1664 2488 bhbbhb.exe 44 PID 2488 wrote to memory of 1664 2488 bhbbhb.exe 44 PID 2488 wrote to memory of 1664 2488 bhbbhb.exe 44 PID 2488 wrote to memory of 1664 2488 bhbbhb.exe 44 PID 1664 wrote to memory of 1944 1664 llxllxl.exe 45 PID 1664 wrote to memory of 1944 1664 llxllxl.exe 45 PID 1664 wrote to memory of 1944 1664 llxllxl.exe 45 PID 1664 wrote to memory of 1944 1664 llxllxl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\677ceadc1d1e9673c3dcce269b93e6036ec5564f1f9b43cd25e57763327a1507.exe"C:\Users\Admin\AppData\Local\Temp\677ceadc1d1e9673c3dcce269b93e6036ec5564f1f9b43cd25e57763327a1507.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1840 -
\??\c:\7pdpv.exec:\7pdpv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
\??\c:\vpjdv.exec:\vpjdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
\??\c:\lllrlxr.exec:\lllrlxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\flrrlxf.exec:\flrrlxf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\hbnntb.exec:\hbnntb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\vvpdd.exec:\vvpdd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\xffrxrx.exec:\xffrxrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\nhhhtt.exec:\nhhhtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\vjjpp.exec:\vjjpp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\rrrxfrf.exec:\rrrxfrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\1nnntb.exec:\1nnntb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\ppjjv.exec:\ppjjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\fxrxffl.exec:\fxrxffl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\bhbbhb.exec:\bhbbhb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\llxllxl.exec:\llxllxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\frrlxlf.exec:\frrlxlf.exe17⤵
- Executes dropped EXE
PID:1944 -
\??\c:\jddjv.exec:\jddjv.exe18⤵
- Executes dropped EXE
PID:316 -
\??\c:\9lffrrf.exec:\9lffrrf.exe19⤵
- Executes dropped EXE
PID:1712 -
\??\c:\hbbtbn.exec:\hbbtbn.exe20⤵
- Executes dropped EXE
PID:1888 -
\??\c:\bhnnnt.exec:\bhnnnt.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1032 -
\??\c:\rrflxfl.exec:\rrflxfl.exe22⤵
- Executes dropped EXE
PID:1452 -
\??\c:\bbnbbb.exec:\bbnbbb.exe23⤵
- Executes dropped EXE
PID:2960 -
\??\c:\pppvv.exec:\pppvv.exe24⤵
- Executes dropped EXE
PID:792 -
\??\c:\rllxlxl.exec:\rllxlxl.exe25⤵
- Executes dropped EXE
PID:1400 -
\??\c:\tnnbth.exec:\tnnbth.exe26⤵
- Executes dropped EXE
PID:408 -
\??\c:\dvdvp.exec:\dvdvp.exe27⤵
- Executes dropped EXE
PID:1008 -
\??\c:\9rflrlx.exec:\9rflrlx.exe28⤵
- Executes dropped EXE
PID:1688 -
\??\c:\bttbnn.exec:\bttbnn.exe29⤵
- Executes dropped EXE
PID:588 -
\??\c:\ppddj.exec:\ppddj.exe30⤵
- Executes dropped EXE
PID:2416 -
\??\c:\7fxxllx.exec:\7fxxllx.exe31⤵
- Executes dropped EXE
PID:1556 -
\??\c:\bnnnhb.exec:\bnnnhb.exe32⤵
- Executes dropped EXE
PID:580 -
\??\c:\dpvvv.exec:\dpvvv.exe33⤵
- Executes dropped EXE
PID:2872 -
\??\c:\rrlrxxl.exec:\rrlrxxl.exe34⤵
- Executes dropped EXE
PID:2552 -
\??\c:\hnhhtb.exec:\hnhhtb.exe35⤵PID:2288
-
\??\c:\xlxfrfl.exec:\xlxfrfl.exe36⤵
- Executes dropped EXE
PID:1500 -
\??\c:\xfxrlfx.exec:\xfxrlfx.exe37⤵
- Executes dropped EXE
PID:1848 -
\??\c:\7hhnbb.exec:\7hhnbb.exe38⤵
- Executes dropped EXE
PID:1828 -
\??\c:\dvppd.exec:\dvppd.exe39⤵
- Executes dropped EXE
PID:2260 -
\??\c:\3xrxlrx.exec:\3xrxlrx.exe40⤵
- Executes dropped EXE
PID:2440 -
\??\c:\lfxxlrf.exec:\lfxxlrf.exe41⤵
- Executes dropped EXE
PID:2660 -
\??\c:\bnhntt.exec:\bnhntt.exe42⤵
- Executes dropped EXE
PID:2724 -
\??\c:\hbnhbt.exec:\hbnhbt.exe43⤵
- Executes dropped EXE
PID:2884 -
\??\c:\pdpdp.exec:\pdpdp.exe44⤵
- Executes dropped EXE
PID:2780 -
\??\c:\9flxxlf.exec:\9flxxlf.exe45⤵
- Executes dropped EXE
PID:1232 -
\??\c:\hbtnth.exec:\hbtnth.exe46⤵
- Executes dropped EXE
PID:2548 -
\??\c:\bhhttt.exec:\bhhttt.exe47⤵
- Executes dropped EXE
PID:2676 -
\??\c:\1pdpd.exec:\1pdpd.exe48⤵
- Executes dropped EXE
PID:2516 -
\??\c:\lffrrrf.exec:\lffrrrf.exe49⤵
- Executes dropped EXE
PID:2588 -
\??\c:\rlrllrx.exec:\rlrllrx.exe50⤵
- Executes dropped EXE
PID:2984 -
\??\c:\hhnnnn.exec:\hhnnnn.exe51⤵
- Executes dropped EXE
PID:2564 -
\??\c:\ppjdj.exec:\ppjdj.exe52⤵
- Executes dropped EXE
PID:1096 -
\??\c:\vvjvj.exec:\vvjvj.exe53⤵
- Executes dropped EXE
PID:1180 -
\??\c:\rlflrrx.exec:\rlflrrx.exe54⤵
- Executes dropped EXE
PID:896 -
\??\c:\hbnhnn.exec:\hbnhnn.exe55⤵
- Executes dropped EXE
PID:2324 -
\??\c:\btthtb.exec:\btthtb.exe56⤵
- Executes dropped EXE
PID:1928 -
\??\c:\vpdjj.exec:\vpdjj.exe57⤵
- Executes dropped EXE
PID:1352 -
\??\c:\llfxflx.exec:\llfxflx.exe58⤵
- Executes dropped EXE
PID:1348 -
\??\c:\ffxxflr.exec:\ffxxflr.exe59⤵
- Executes dropped EXE
PID:292 -
\??\c:\bbbntt.exec:\bbbntt.exe60⤵
- Executes dropped EXE
PID:1732 -
\??\c:\hnttnt.exec:\hnttnt.exe61⤵
- Executes dropped EXE
PID:1864 -
\??\c:\ppdjp.exec:\ppdjp.exe62⤵
- Executes dropped EXE
PID:2572 -
\??\c:\rrlxffl.exec:\rrlxffl.exe63⤵
- Executes dropped EXE
PID:2812 -
\??\c:\fxxfrxf.exec:\fxxfrxf.exe64⤵
- Executes dropped EXE
PID:2828 -
\??\c:\hhttht.exec:\hhttht.exe65⤵
- Executes dropped EXE
PID:2964 -
\??\c:\ddvjp.exec:\ddvjp.exe66⤵
- Executes dropped EXE
PID:1452 -
\??\c:\ddpdp.exec:\ddpdp.exe67⤵PID:2688
-
\??\c:\fxlxrxl.exec:\fxlxrxl.exe68⤵PID:2580
-
\??\c:\ttnbtb.exec:\ttnbtb.exe69⤵PID:2912
-
\??\c:\hbnttt.exec:\hbnttt.exe70⤵PID:1400
-
\??\c:\pjddp.exec:\pjddp.exe71⤵PID:448
-
\??\c:\1lflfrf.exec:\1lflfrf.exe72⤵PID:1692
-
\??\c:\rfflxfr.exec:\rfflxfr.exe73⤵PID:892
-
\??\c:\nhbbtt.exec:\nhbbtt.exe74⤵PID:1844
-
\??\c:\pjpjp.exec:\pjpjp.exe75⤵PID:588
-
\??\c:\djjvj.exec:\djjvj.exe76⤵PID:3052
-
\??\c:\3xflrrx.exec:\3xflrrx.exe77⤵PID:2280
-
\??\c:\5bnhhh.exec:\5bnhhh.exe78⤵PID:2264
-
\??\c:\nthbnh.exec:\nthbnh.exe79⤵PID:580
-
\??\c:\ppppp.exec:\ppppp.exe80⤵PID:876
-
\??\c:\5xrlxrx.exec:\5xrlxrx.exe81⤵PID:2484
-
\??\c:\nnhthn.exec:\nnhthn.exe82⤵PID:2288
-
\??\c:\bbnbhn.exec:\bbnbhn.exe83⤵PID:1872
-
\??\c:\jjpjj.exec:\jjpjj.exe84⤵PID:1628
-
\??\c:\lrfrrfx.exec:\lrfrrfx.exe85⤵PID:2436
-
\??\c:\xlxlrrf.exec:\xlxlrrf.exe86⤵PID:816
-
\??\c:\7nhhtb.exec:\7nhhtb.exe87⤵PID:2124
-
\??\c:\nhbhtb.exec:\nhbhtb.exe88⤵PID:2604
-
\??\c:\ddvpp.exec:\ddvpp.exe89⤵PID:2768
-
\??\c:\3xrxfrx.exec:\3xrxfrx.exe90⤵PID:2772
-
\??\c:\nbhhhh.exec:\nbhhhh.exe91⤵PID:2628
-
\??\c:\nhbbtb.exec:\nhbbtb.exe92⤵PID:2748
-
\??\c:\jpppv.exec:\jpppv.exe93⤵PID:2832
-
\??\c:\fxrfflf.exec:\fxrfflf.exe94⤵PID:2808
-
\??\c:\1xlfrxl.exec:\1xlfrxl.exe95⤵PID:2508
-
\??\c:\nhtbhn.exec:\nhtbhn.exe96⤵PID:2544
-
\??\c:\dvpjj.exec:\dvpjj.exe97⤵PID:2464
-
\??\c:\dvppv.exec:\dvppv.exe98⤵PID:2680
-
\??\c:\ffxlxxl.exec:\ffxlxxl.exe99⤵PID:3008
-
\??\c:\3tthnh.exec:\3tthnh.exe100⤵PID:1356
-
\??\c:\tthbnn.exec:\tthbnn.exe101⤵PID:2320
-
\??\c:\5jdpd.exec:\5jdpd.exe102⤵PID:1652
-
\??\c:\jdvvj.exec:\jdvvj.exe103⤵PID:1972
-
\??\c:\7rfrfll.exec:\7rfrfll.exe104⤵PID:1980
-
\??\c:\1ttbhh.exec:\1ttbhh.exe105⤵PID:1352
-
\??\c:\hhbhnb.exec:\hhbhnb.exe106⤵PID:1348
-
\??\c:\jjvvd.exec:\jjvvd.exe107⤵PID:292
-
\??\c:\flrllxf.exec:\flrllxf.exe108⤵PID:1732
-
\??\c:\1xlrrlr.exec:\1xlrrlr.exe109⤵PID:2256
-
\??\c:\3thnth.exec:\3thnth.exe110⤵PID:2572
-
\??\c:\bnhntt.exec:\bnhntt.exe111⤵PID:1196
-
\??\c:\pjjpv.exec:\pjjpv.exe112⤵PID:2764
-
\??\c:\9rllxxl.exec:\9rllxxl.exe113⤵PID:2856
-
\??\c:\fxxfxxf.exec:\fxxfxxf.exe114⤵PID:2500
-
\??\c:\tnnnth.exec:\tnnnth.exe115⤵PID:2028
-
\??\c:\1pvdj.exec:\1pvdj.exe116⤵PID:2580
-
\??\c:\dppvp.exec:\dppvp.exe117⤵PID:2160
-
\??\c:\3rrfrxr.exec:\3rrfrxr.exe118⤵PID:1400
-
\??\c:\tthtbn.exec:\tthtbn.exe119⤵PID:448
-
\??\c:\nhhttn.exec:\nhhttn.exe120⤵PID:1692
-
\??\c:\vvddp.exec:\vvddp.exe121⤵PID:788
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-