Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18-12-2024 02:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
983ae61f1e514ab6d62e0c198fb1d6a934c16f09d57efddd38daca758484f6f8.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
983ae61f1e514ab6d62e0c198fb1d6a934c16f09d57efddd38daca758484f6f8.exe
-
Size
454KB
-
MD5
4fe4a5ea04793e11b04f113e672f0e2f
-
SHA1
ba830c6806044a7eaec4d9d353c88dffc3018b5e
-
SHA256
983ae61f1e514ab6d62e0c198fb1d6a934c16f09d57efddd38daca758484f6f8
-
SHA512
8a805bc007a59753ffb0f7b71e8a805acc2b96aed0f1d26d228c7d2b18f4d5c8f318c5b40e6f5192e87a8b339235e1ddb60c41120190cfd2618aeb5714b5165b
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeA:q7Tc2NYHUrAwfMp3CDA
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 52 IoCs
resource yara_rule behavioral1/memory/1920-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1880-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/568-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-95-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2076-114-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1648-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1664-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1936-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1664-165-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/1152-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-183-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2268-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2268-221-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1712-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1772-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1624-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2136-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/888-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1784-328-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2720-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-343-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2780-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1908-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-377-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/288-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1752-451-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-465-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-480-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3020-536-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2524-545-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-597-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2020-668-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/3060-675-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1672-682-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2672-740-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1608-751-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1236-758-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2400-779-0x00000000001C0000-0x00000000001EA000-memory.dmp family_blackmoon behavioral1/memory/896-786-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon behavioral1/memory/896-804-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon behavioral1/memory/1072-831-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2340-838-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/532-851-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-866-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1880 bthhnn.exe 2968 jvvjv.exe 2504 djjdp.exe 568 lxrxflr.exe 2784 bntbbh.exe 2984 dpddj.exe 2612 hbnnhh.exe 2836 1fflxfl.exe 2576 ddpvv.exe 2744 1jpvj.exe 2076 ddvdd.exe 1648 xffllrr.exe 1664 dvjpd.exe 1936 nnbnhn.exe 2000 xfxfrrf.exe 2312 hthhnn.exe 1152 rlflrfl.exe 2664 vpddj.exe 2268 nbhhtt.exe 2960 vvjpd.exe 1036 nnntht.exe 1712 5jdjj.exe 2176 pjppj.exe 1772 rlfrxfr.exe 1624 pjdvj.exe 2136 3rflrxl.exe 2344 1llrxfl.exe 2228 1rrxfrl.exe 1764 1vpvd.exe 2552 rllxffl.exe 2512 hbhntt.exe 480 jdvvj.exe 888 3htbnn.exe 2968 ppjpv.exe 1784 rrffxxf.exe 2720 ntbbht.exe 2856 pjddd.exe 2780 9pppj.exe 2700 9xrfxfx.exe 2600 tthhhh.exe 1908 pppvv.exe 2588 9lfrxfl.exe 3064 lflflfl.exe 1580 7nhbhn.exe 1888 jddvd.exe 2844 rlllrrf.exe 1972 3lxflrx.exe 1376 tnnbnt.exe 1968 jvvpd.exe 2104 dvjpd.exe 1936 llxfllr.exe 1976 nbhhtn.exe 288 tnbbnn.exe 1752 jpppv.exe 1152 rlrflrx.exe 2812 9tnhbh.exe 2252 3hbthn.exe 1588 9jddd.exe 2960 xrlllrf.exe 348 nhtntt.exe 1592 ppdvd.exe 680 ddvpv.exe 1424 1flrlrx.exe 2460 ttthnb.exe -
resource yara_rule behavioral1/memory/1920-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1880-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/568-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1152-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-183-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2268-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1772-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/888-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/288-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-465-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-480-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1424-510-0x00000000001C0000-0x00000000001EA000-memory.dmp upx behavioral1/memory/3020-536-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-545-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-572-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-597-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-610-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-642-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-668-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/1084-689-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-740-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1608-751-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2400-772-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/896-804-0x0000000000530000-0x000000000055A000-memory.dmp upx behavioral1/memory/532-851-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-859-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-866-0x0000000000530000-0x000000000055A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrffxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rlxfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxflrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrxxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfxlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rlrflr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1920 wrote to memory of 1880 1920 983ae61f1e514ab6d62e0c198fb1d6a934c16f09d57efddd38daca758484f6f8.exe 31 PID 1920 wrote to memory of 1880 1920 983ae61f1e514ab6d62e0c198fb1d6a934c16f09d57efddd38daca758484f6f8.exe 31 PID 1920 wrote to memory of 1880 1920 983ae61f1e514ab6d62e0c198fb1d6a934c16f09d57efddd38daca758484f6f8.exe 31 PID 1920 wrote to memory of 1880 1920 983ae61f1e514ab6d62e0c198fb1d6a934c16f09d57efddd38daca758484f6f8.exe 31 PID 1880 wrote to memory of 2968 1880 bthhnn.exe 32 PID 1880 wrote to memory of 2968 1880 bthhnn.exe 32 PID 1880 wrote to memory of 2968 1880 bthhnn.exe 32 PID 1880 wrote to memory of 2968 1880 bthhnn.exe 32 PID 2968 wrote to memory of 2504 2968 jvvjv.exe 33 PID 2968 wrote to memory of 2504 2968 jvvjv.exe 33 PID 2968 wrote to memory of 2504 2968 jvvjv.exe 33 PID 2968 wrote to memory of 2504 2968 jvvjv.exe 33 PID 2504 wrote to memory of 568 2504 djjdp.exe 34 PID 2504 wrote to memory of 568 2504 djjdp.exe 34 PID 2504 wrote to memory of 568 2504 djjdp.exe 34 PID 2504 wrote to memory of 568 2504 djjdp.exe 34 PID 568 wrote to memory of 2784 568 lxrxflr.exe 35 PID 568 wrote to memory of 2784 568 lxrxflr.exe 35 PID 568 wrote to memory of 2784 568 lxrxflr.exe 35 PID 568 wrote to memory of 2784 568 lxrxflr.exe 35 PID 2784 wrote to memory of 2984 2784 bntbbh.exe 36 PID 2784 wrote to memory of 2984 2784 bntbbh.exe 36 PID 2784 wrote to memory of 2984 2784 bntbbh.exe 36 PID 2784 wrote to memory of 2984 2784 bntbbh.exe 36 PID 2984 wrote to memory of 2612 2984 dpddj.exe 37 PID 2984 wrote to memory of 2612 2984 dpddj.exe 37 PID 2984 wrote to memory of 2612 2984 dpddj.exe 37 PID 2984 wrote to memory of 2612 2984 dpddj.exe 37 PID 2612 wrote to memory of 2836 2612 hbnnhh.exe 38 PID 2612 wrote to memory of 2836 2612 hbnnhh.exe 38 PID 2612 wrote to memory of 2836 2612 hbnnhh.exe 38 PID 2612 wrote to memory of 2836 2612 hbnnhh.exe 38 PID 2836 wrote to memory of 2576 2836 1fflxfl.exe 39 PID 2836 wrote to memory of 2576 2836 1fflxfl.exe 39 PID 2836 wrote to memory of 2576 2836 1fflxfl.exe 39 PID 2836 wrote to memory of 2576 2836 1fflxfl.exe 39 PID 2576 wrote to memory of 2744 2576 ddpvv.exe 40 PID 2576 wrote to memory of 2744 2576 ddpvv.exe 40 PID 2576 wrote to memory of 2744 2576 ddpvv.exe 40 PID 2576 wrote to memory of 2744 2576 ddpvv.exe 40 PID 2744 wrote to memory of 2076 2744 1jpvj.exe 41 PID 2744 wrote to memory of 2076 2744 1jpvj.exe 41 PID 2744 wrote to memory of 2076 2744 1jpvj.exe 41 PID 2744 wrote to memory of 2076 2744 1jpvj.exe 41 PID 2076 wrote to memory of 1648 2076 ddvdd.exe 42 PID 2076 wrote to memory of 1648 2076 ddvdd.exe 42 PID 2076 wrote to memory of 1648 2076 ddvdd.exe 42 PID 2076 wrote to memory of 1648 2076 ddvdd.exe 42 PID 1648 wrote to memory of 1664 1648 xffllrr.exe 43 PID 1648 wrote to memory of 1664 1648 xffllrr.exe 43 PID 1648 wrote to memory of 1664 1648 xffllrr.exe 43 PID 1648 wrote to memory of 1664 1648 xffllrr.exe 43 PID 1664 wrote to memory of 1936 1664 dvjpd.exe 44 PID 1664 wrote to memory of 1936 1664 dvjpd.exe 44 PID 1664 wrote to memory of 1936 1664 dvjpd.exe 44 PID 1664 wrote to memory of 1936 1664 dvjpd.exe 44 PID 1936 wrote to memory of 2000 1936 nnbnhn.exe 45 PID 1936 wrote to memory of 2000 1936 nnbnhn.exe 45 PID 1936 wrote to memory of 2000 1936 nnbnhn.exe 45 PID 1936 wrote to memory of 2000 1936 nnbnhn.exe 45 PID 2000 wrote to memory of 2312 2000 xfxfrrf.exe 46 PID 2000 wrote to memory of 2312 2000 xfxfrrf.exe 46 PID 2000 wrote to memory of 2312 2000 xfxfrrf.exe 46 PID 2000 wrote to memory of 2312 2000 xfxfrrf.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\983ae61f1e514ab6d62e0c198fb1d6a934c16f09d57efddd38daca758484f6f8.exe"C:\Users\Admin\AppData\Local\Temp\983ae61f1e514ab6d62e0c198fb1d6a934c16f09d57efddd38daca758484f6f8.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\bthhnn.exec:\bthhnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\jvvjv.exec:\jvvjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\djjdp.exec:\djjdp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\lxrxflr.exec:\lxrxflr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:568 -
\??\c:\bntbbh.exec:\bntbbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\dpddj.exec:\dpddj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\hbnnhh.exec:\hbnnhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\1fflxfl.exec:\1fflxfl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\ddpvv.exec:\ddpvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\1jpvj.exec:\1jpvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\ddvdd.exec:\ddvdd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\xffllrr.exec:\xffllrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\dvjpd.exec:\dvjpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\nnbnhn.exec:\nnbnhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\xfxfrrf.exec:\xfxfrrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\hthhnn.exec:\hthhnn.exe17⤵
- Executes dropped EXE
PID:2312 -
\??\c:\rlflrfl.exec:\rlflrfl.exe18⤵
- Executes dropped EXE
PID:1152 -
\??\c:\vpddj.exec:\vpddj.exe19⤵
- Executes dropped EXE
PID:2664 -
\??\c:\nbhhtt.exec:\nbhhtt.exe20⤵
- Executes dropped EXE
PID:2268 -
\??\c:\vvjpd.exec:\vvjpd.exe21⤵
- Executes dropped EXE
PID:2960 -
\??\c:\nnntht.exec:\nnntht.exe22⤵
- Executes dropped EXE
PID:1036 -
\??\c:\5jdjj.exec:\5jdjj.exe23⤵
- Executes dropped EXE
PID:1712 -
\??\c:\pjppj.exec:\pjppj.exe24⤵
- Executes dropped EXE
PID:2176 -
\??\c:\rlfrxfr.exec:\rlfrxfr.exe25⤵
- Executes dropped EXE
PID:1772 -
\??\c:\pjdvj.exec:\pjdvj.exe26⤵
- Executes dropped EXE
PID:1624 -
\??\c:\3rflrxl.exec:\3rflrxl.exe27⤵
- Executes dropped EXE
PID:2136 -
\??\c:\1llrxfl.exec:\1llrxfl.exe28⤵
- Executes dropped EXE
PID:2344 -
\??\c:\1rrxfrl.exec:\1rrxfrl.exe29⤵
- Executes dropped EXE
PID:2228 -
\??\c:\1vpvd.exec:\1vpvd.exe30⤵
- Executes dropped EXE
PID:1764 -
\??\c:\rllxffl.exec:\rllxffl.exe31⤵
- Executes dropped EXE
PID:2552 -
\??\c:\hbhntt.exec:\hbhntt.exe32⤵
- Executes dropped EXE
PID:2512 -
\??\c:\jdvvj.exec:\jdvvj.exe33⤵
- Executes dropped EXE
PID:480 -
\??\c:\3htbnn.exec:\3htbnn.exe34⤵
- Executes dropped EXE
PID:888 -
\??\c:\ppjpv.exec:\ppjpv.exe35⤵
- Executes dropped EXE
PID:2968 -
\??\c:\rrffxxf.exec:\rrffxxf.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1784 -
\??\c:\ntbbht.exec:\ntbbht.exe37⤵
- Executes dropped EXE
PID:2720 -
\??\c:\pjddd.exec:\pjddd.exe38⤵
- Executes dropped EXE
PID:2856 -
\??\c:\9pppj.exec:\9pppj.exe39⤵
- Executes dropped EXE
PID:2780 -
\??\c:\9xrfxfx.exec:\9xrfxfx.exe40⤵
- Executes dropped EXE
PID:2700 -
\??\c:\tthhhh.exec:\tthhhh.exe41⤵
- Executes dropped EXE
PID:2600 -
\??\c:\pppvv.exec:\pppvv.exe42⤵
- Executes dropped EXE
PID:1908 -
\??\c:\9lfrxfl.exec:\9lfrxfl.exe43⤵
- Executes dropped EXE
PID:2588 -
\??\c:\lflflfl.exec:\lflflfl.exe44⤵
- Executes dropped EXE
PID:3064 -
\??\c:\7nhbhn.exec:\7nhbhn.exe45⤵
- Executes dropped EXE
PID:1580 -
\??\c:\jddvd.exec:\jddvd.exe46⤵
- Executes dropped EXE
PID:1888 -
\??\c:\rlllrrf.exec:\rlllrrf.exe47⤵
- Executes dropped EXE
PID:2844 -
\??\c:\3lxflrx.exec:\3lxflrx.exe48⤵
- Executes dropped EXE
PID:1972 -
\??\c:\tnnbnt.exec:\tnnbnt.exe49⤵
- Executes dropped EXE
PID:1376 -
\??\c:\jvvpd.exec:\jvvpd.exe50⤵
- Executes dropped EXE
PID:1968 -
\??\c:\dvjpd.exec:\dvjpd.exe51⤵
- Executes dropped EXE
PID:2104 -
\??\c:\llxfllr.exec:\llxfllr.exe52⤵
- Executes dropped EXE
PID:1936 -
\??\c:\nbhhtn.exec:\nbhhtn.exe53⤵
- Executes dropped EXE
PID:1976 -
\??\c:\tnbbnn.exec:\tnbbnn.exe54⤵
- Executes dropped EXE
PID:288 -
\??\c:\jpppv.exec:\jpppv.exe55⤵
- Executes dropped EXE
PID:1752 -
\??\c:\rlrflrx.exec:\rlrflrx.exe56⤵
- Executes dropped EXE
PID:1152 -
\??\c:\9tnhbh.exec:\9tnhbh.exe57⤵
- Executes dropped EXE
PID:2812 -
\??\c:\3hbthn.exec:\3hbthn.exe58⤵
- Executes dropped EXE
PID:2252 -
\??\c:\9jddd.exec:\9jddd.exe59⤵
- Executes dropped EXE
PID:1588 -
\??\c:\xrlllrf.exec:\xrlllrf.exe60⤵
- Executes dropped EXE
PID:2960 -
\??\c:\nhtntt.exec:\nhtntt.exe61⤵
- Executes dropped EXE
PID:348 -
\??\c:\ppdvd.exec:\ppdvd.exe62⤵
- Executes dropped EXE
PID:1592 -
\??\c:\ddvpv.exec:\ddvpv.exe63⤵
- Executes dropped EXE
PID:680 -
\??\c:\1flrlrx.exec:\1flrlrx.exe64⤵
- Executes dropped EXE
PID:1424 -
\??\c:\ttthnb.exec:\ttthnb.exe65⤵
- Executes dropped EXE
PID:2460 -
\??\c:\5hbhnb.exec:\5hbhnb.exe66⤵PID:2372
-
\??\c:\ddvjp.exec:\ddvjp.exe67⤵PID:1468
-
\??\c:\rfxxffr.exec:\rfxxffr.exe68⤵PID:3020
-
\??\c:\hbtthn.exec:\hbtthn.exe69⤵PID:616
-
\??\c:\jvppd.exec:\jvppd.exe70⤵PID:2524
-
\??\c:\dvpvj.exec:\dvpvj.exe71⤵PID:1732
-
\??\c:\1fxflrx.exec:\1fxflrx.exe72⤵PID:2068
-
\??\c:\bbthbb.exec:\bbthbb.exe73⤵PID:2544
-
\??\c:\1vjjj.exec:\1vjjj.exe74⤵PID:2972
-
\??\c:\jvddp.exec:\jvddp.exe75⤵PID:768
-
\??\c:\xxxxrrx.exec:\xxxxrrx.exe76⤵PID:1688
-
\??\c:\bbbhtt.exec:\bbbhtt.exe77⤵PID:2504
-
\??\c:\nhbthh.exec:\nhbthh.exe78⤵PID:2776
-
\??\c:\1vpvv.exec:\1vpvv.exe79⤵PID:2724
-
\??\c:\rlfrxlf.exec:\rlfrxlf.exe80⤵PID:2784
-
\??\c:\hthbhn.exec:\hthbhn.exe81⤵PID:2736
-
\??\c:\hbnnhb.exec:\hbnnhb.exe82⤵PID:2604
-
\??\c:\vvvjp.exec:\vvvjp.exe83⤵PID:2624
-
\??\c:\5rrrlrx.exec:\5rrrlrx.exe84⤵PID:2240
-
\??\c:\ffrrxfx.exec:\ffrrxfx.exe85⤵PID:2696
-
\??\c:\nhbbnt.exec:\nhbbnt.exe86⤵
- System Location Discovery: System Language Discovery
PID:3060 -
\??\c:\9pjpd.exec:\9pjpd.exe87⤵PID:2744
-
\??\c:\djpjd.exec:\djpjd.exe88⤵
- System Location Discovery: System Language Discovery
PID:2020 -
\??\c:\xrflrxf.exec:\xrflrxf.exe89⤵PID:2764
-
\??\c:\tthnnt.exec:\tthnnt.exe90⤵PID:1672
-
\??\c:\jdjpd.exec:\jdjpd.exe91⤵PID:1884
-
\??\c:\xfxflrl.exec:\xfxflrl.exe92⤵
- System Location Discovery: System Language Discovery
PID:1084 -
\??\c:\nhttbt.exec:\nhttbt.exe93⤵PID:1604
-
\??\c:\vjddj.exec:\vjddj.exe94⤵PID:1936
-
\??\c:\1rffxxl.exec:\1rffxxl.exe95⤵PID:1980
-
\??\c:\tntbhb.exec:\tntbhb.exe96⤵PID:2908
-
\??\c:\bbhtnt.exec:\bbhtnt.exe97⤵PID:2676
-
\??\c:\9jdpd.exec:\9jdpd.exe98⤵PID:2824
-
\??\c:\frllrlr.exec:\frllrlr.exe99⤵PID:2244
-
\??\c:\9rrrfff.exec:\9rrrfff.exe100⤵PID:2672
-
\??\c:\nhhnhb.exec:\nhhnhb.exe101⤵PID:1608
-
\??\c:\dpjjv.exec:\dpjjv.exe102⤵PID:1236
-
\??\c:\fflxrrf.exec:\fflxrrf.exe103⤵PID:2296
-
\??\c:\xlxrxrx.exec:\xlxrxrx.exe104⤵PID:1524
-
\??\c:\7nhnbh.exec:\7nhnbh.exe105⤵PID:2400
-
\??\c:\jdvdp.exec:\jdvdp.exe106⤵PID:896
-
\??\c:\llrlfrr.exec:\llrlfrr.exe107⤵PID:2088
-
\??\c:\hhbhhh.exec:\hhbhhh.exe108⤵PID:2372
-
\??\c:\1jvdv.exec:\1jvdv.exe109⤵PID:556
-
\??\c:\frrxlrf.exec:\frrxlrf.exe110⤵PID:1072
-
\??\c:\ttnthh.exec:\ttnthh.exe111⤵PID:616
-
\??\c:\tthntt.exec:\tthntt.exe112⤵PID:2140
-
\??\c:\pjvpj.exec:\pjvpj.exe113⤵PID:2992
-
\??\c:\xrlrffr.exec:\xrlrffr.exe114⤵PID:2340
-
\??\c:\rrxflxl.exec:\rrxflxl.exe115⤵PID:1464
-
\??\c:\thtttn.exec:\thtttn.exe116⤵PID:532
-
\??\c:\1vdjv.exec:\1vdjv.exe117⤵PID:1444
-
\??\c:\ffffxxf.exec:\ffffxxf.exe118⤵PID:2668
-
\??\c:\rfllfxf.exec:\rfllfxf.exe119⤵PID:1784
-
\??\c:\thbbbn.exec:\thbbbn.exe120⤵PID:804
-
\??\c:\5pvvv.exec:\5pvvv.exe121⤵PID:1148
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-