Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18-12-2024 02:58
Behavioral task
behavioral1
Sample
a2fc275d335e5ec9de13b543500fa370e97d1269147be07220779d678b266420.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
a2fc275d335e5ec9de13b543500fa370e97d1269147be07220779d678b266420.exe
-
Size
331KB
-
MD5
958137e15ddb683bdab8ef037d82db90
-
SHA1
0ae6dd802f6b7e43f069b94c3d3894f5f5d3896b
-
SHA256
a2fc275d335e5ec9de13b543500fa370e97d1269147be07220779d678b266420
-
SHA512
938fe091f9a99a6429b75a3dbab82d71a37cd38fe83c0985ec1fb8b09629c11652ac5be42c964197ba76e2f63cbe53f9d90b3ed45840135121656d7bf39468bf
-
SSDEEP
6144:vcm4FmowdHoStJdJIjaRleL42bL37BoTPkhu9gX5yGsTshQc8R0nxA5ij8+RC7tB:94wFHoStJdSjylh2b77BoTMA9gX59sT5
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/1640-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1332-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2908-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2524-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2888-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2756-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2828-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2728-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2640-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2724-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2644-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/308-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/980-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1200-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2680-143-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2680-146-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/1996-166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2164-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2568-189-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1728-199-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1736-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/656-231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2472-244-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/276-262-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/276-259-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1760-269-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3032-280-0x0000000076C40000-0x0000000076D5F000-memory.dmp family_blackmoon behavioral1/memory/3032-283-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2400-296-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2400-295-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2704-307-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2236-319-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1804-321-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2804-334-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2880-346-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1900-357-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1448-384-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1760-542-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2112-630-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1888-667-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1852-716-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/876-815-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2888-851-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2800-857-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2808-864-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2172-1047-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3032-8288-0x0000000076C40000-0x0000000076D5F000-memory.dmp family_blackmoon behavioral1/memory/3032-9299-0x0000000076C40000-0x0000000076D5F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1332 fffxlrl.exe 2524 5tnhnb.exe 2908 1vdjp.exe 2756 fxlrxfl.exe 2888 5bnbnn.exe 2828 jjpdd.exe 2728 fxrlrlx.exe 2640 xrlrxfl.exe 2724 dddvp.exe 2644 btntbb.exe 308 dvpdj.exe 980 1htttb.exe 1596 jdpvv.exe 2792 fxfflrf.exe 1200 1jppv.exe 2916 lfxfrrf.exe 2680 lfxflrf.exe 1556 tthbtb.exe 1996 dvvpd.exe 2164 hbthht.exe 2324 jpvvp.exe 2568 llxfllx.exe 1728 djjpj.exe 1916 lfxfffr.exe 1736 vpjvd.exe 1820 1xrfrrx.exe 1612 1llflrx.exe 656 dvpvd.exe 2472 pdpvv.exe 1608 7nnthh.exe 276 tntthh.exe 2192 rlxrffl.exe 1760 rllrllr.exe 1696 1thhnh.exe 3032 pvjvd.exe 2400 xlffffl.exe 2544 3xrrxff.exe 2704 1ffxffr.exe 2800 7bnhnn.exe 2236 pddvv.exe 1804 pjvpp.exe 2804 9ffflrx.exe 2820 7tnhtt.exe 2728 bthbnn.exe 2880 vjpdd.exe 1900 ffxxffx.exe 2684 5lxxxxx.exe 2644 9ttnth.exe 2184 vpdvd.exe 308 1jvjp.exe 1448 xrxfffl.exe 1132 rrrfxrl.exe 2876 5hhtbh.exe 2792 pjpjv.exe 2868 vjddd.exe 2368 xxrxffr.exe 2712 nhhnbh.exe 1704 bthbhb.exe 1568 ddppv.exe 1356 1vvpp.exe 2488 bntntt.exe 2708 3tbbnn.exe 1812 pjvvd.exe 1548 frlfrlx.exe -
resource yara_rule behavioral1/memory/1640-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1640-3-0x00000000003A0000-0x00000000003C7000-memory.dmp upx behavioral1/files/0x0007000000012117-9.dat upx behavioral1/memory/1640-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d0e-19.dat upx behavioral1/memory/2524-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1332-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2908-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d18-27.dat upx behavioral1/memory/2524-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d21-34.dat upx behavioral1/memory/2888-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016d31-43.dat upx behavioral1/memory/2756-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2828-53-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016d3a-51.dat upx behavioral1/files/0x0009000000016d5e-67.dat upx behavioral1/memory/2728-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016d42-59.dat upx behavioral1/files/0x0005000000018683-75.dat upx behavioral1/memory/2640-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2724-82-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x00050000000186e4-83.dat upx behavioral1/memory/2724-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000186ea-92.dat upx behavioral1/memory/2644-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/308-101-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000186ee-100.dat upx behavioral1/memory/980-109-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000186fd-108.dat upx behavioral1/files/0x0005000000018728-117.dat upx behavioral1/files/0x000500000001873d-124.dat upx behavioral1/files/0x0005000000018784-133.dat upx behavioral1/memory/1200-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001878f-141.dat upx behavioral1/memory/2680-143-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000187a5-150.dat upx behavioral1/memory/1556-151-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000019023-158.dat upx behavioral1/files/0x000500000001925e-165.dat upx behavioral1/memory/2164-167-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1996-166-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2164-175-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016c9d-174.dat upx behavioral1/files/0x0005000000019261-182.dat upx behavioral1/files/0x0005000000019282-190.dat upx behavioral1/memory/2568-189-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019334-198.dat upx behavioral1/memory/1728-199-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019350-206.dat upx behavioral1/memory/1736-213-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193b4-215.dat upx behavioral1/files/0x00050000000193c2-221.dat upx behavioral1/memory/656-231-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193e1-230.dat upx behavioral1/files/0x000500000001941e-237.dat upx behavioral1/files/0x0005000000019427-246.dat upx behavioral1/files/0x0005000000019431-252.dat upx behavioral1/files/0x0005000000019441-263.dat upx behavioral1/memory/276-262-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1760-269-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2400-296-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2236-318-0x0000000000230000-0x0000000000257000-memory.dmp upx behavioral1/memory/2236-319-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllrrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrlllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xrrrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rffllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlflrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1640 wrote to memory of 1332 1640 a2fc275d335e5ec9de13b543500fa370e97d1269147be07220779d678b266420.exe 30 PID 1640 wrote to memory of 1332 1640 a2fc275d335e5ec9de13b543500fa370e97d1269147be07220779d678b266420.exe 30 PID 1640 wrote to memory of 1332 1640 a2fc275d335e5ec9de13b543500fa370e97d1269147be07220779d678b266420.exe 30 PID 1640 wrote to memory of 1332 1640 a2fc275d335e5ec9de13b543500fa370e97d1269147be07220779d678b266420.exe 30 PID 1332 wrote to memory of 2524 1332 fffxlrl.exe 31 PID 1332 wrote to memory of 2524 1332 fffxlrl.exe 31 PID 1332 wrote to memory of 2524 1332 fffxlrl.exe 31 PID 1332 wrote to memory of 2524 1332 fffxlrl.exe 31 PID 2524 wrote to memory of 2908 2524 5tnhnb.exe 32 PID 2524 wrote to memory of 2908 2524 5tnhnb.exe 32 PID 2524 wrote to memory of 2908 2524 5tnhnb.exe 32 PID 2524 wrote to memory of 2908 2524 5tnhnb.exe 32 PID 2908 wrote to memory of 2756 2908 1vdjp.exe 33 PID 2908 wrote to memory of 2756 2908 1vdjp.exe 33 PID 2908 wrote to memory of 2756 2908 1vdjp.exe 33 PID 2908 wrote to memory of 2756 2908 1vdjp.exe 33 PID 2756 wrote to memory of 2888 2756 fxlrxfl.exe 34 PID 2756 wrote to memory of 2888 2756 fxlrxfl.exe 34 PID 2756 wrote to memory of 2888 2756 fxlrxfl.exe 34 PID 2756 wrote to memory of 2888 2756 fxlrxfl.exe 34 PID 2888 wrote to memory of 2828 2888 5bnbnn.exe 35 PID 2888 wrote to memory of 2828 2888 5bnbnn.exe 35 PID 2888 wrote to memory of 2828 2888 5bnbnn.exe 35 PID 2888 wrote to memory of 2828 2888 5bnbnn.exe 35 PID 2828 wrote to memory of 2728 2828 jjpdd.exe 36 PID 2828 wrote to memory of 2728 2828 jjpdd.exe 36 PID 2828 wrote to memory of 2728 2828 jjpdd.exe 36 PID 2828 wrote to memory of 2728 2828 jjpdd.exe 36 PID 2728 wrote to memory of 2640 2728 fxrlrlx.exe 37 PID 2728 wrote to memory of 2640 2728 fxrlrlx.exe 37 PID 2728 wrote to memory of 2640 2728 fxrlrlx.exe 37 PID 2728 wrote to memory of 2640 2728 fxrlrlx.exe 37 PID 2640 wrote to memory of 2724 2640 xrlrxfl.exe 38 PID 2640 wrote to memory of 2724 2640 xrlrxfl.exe 38 PID 2640 wrote to memory of 2724 2640 xrlrxfl.exe 38 PID 2640 wrote to memory of 2724 2640 xrlrxfl.exe 38 PID 2724 wrote to memory of 2644 2724 dddvp.exe 39 PID 2724 wrote to memory of 2644 2724 dddvp.exe 39 PID 2724 wrote to memory of 2644 2724 dddvp.exe 39 PID 2724 wrote to memory of 2644 2724 dddvp.exe 39 PID 2644 wrote to memory of 308 2644 btntbb.exe 40 PID 2644 wrote to memory of 308 2644 btntbb.exe 40 PID 2644 wrote to memory of 308 2644 btntbb.exe 40 PID 2644 wrote to memory of 308 2644 btntbb.exe 40 PID 308 wrote to memory of 980 308 dvpdj.exe 41 PID 308 wrote to memory of 980 308 dvpdj.exe 41 PID 308 wrote to memory of 980 308 dvpdj.exe 41 PID 308 wrote to memory of 980 308 dvpdj.exe 41 PID 980 wrote to memory of 1596 980 1htttb.exe 42 PID 980 wrote to memory of 1596 980 1htttb.exe 42 PID 980 wrote to memory of 1596 980 1htttb.exe 42 PID 980 wrote to memory of 1596 980 1htttb.exe 42 PID 1596 wrote to memory of 2792 1596 jdpvv.exe 43 PID 1596 wrote to memory of 2792 1596 jdpvv.exe 43 PID 1596 wrote to memory of 2792 1596 jdpvv.exe 43 PID 1596 wrote to memory of 2792 1596 jdpvv.exe 43 PID 2792 wrote to memory of 1200 2792 fxfflrf.exe 44 PID 2792 wrote to memory of 1200 2792 fxfflrf.exe 44 PID 2792 wrote to memory of 1200 2792 fxfflrf.exe 44 PID 2792 wrote to memory of 1200 2792 fxfflrf.exe 44 PID 1200 wrote to memory of 2916 1200 1jppv.exe 45 PID 1200 wrote to memory of 2916 1200 1jppv.exe 45 PID 1200 wrote to memory of 2916 1200 1jppv.exe 45 PID 1200 wrote to memory of 2916 1200 1jppv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2fc275d335e5ec9de13b543500fa370e97d1269147be07220779d678b266420.exe"C:\Users\Admin\AppData\Local\Temp\a2fc275d335e5ec9de13b543500fa370e97d1269147be07220779d678b266420.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\fffxlrl.exec:\fffxlrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
\??\c:\5tnhnb.exec:\5tnhnb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\1vdjp.exec:\1vdjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\fxlrxfl.exec:\fxlrxfl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\5bnbnn.exec:\5bnbnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\jjpdd.exec:\jjpdd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\fxrlrlx.exec:\fxrlrlx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\xrlrxfl.exec:\xrlrxfl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\dddvp.exec:\dddvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\btntbb.exec:\btntbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\dvpdj.exec:\dvpdj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:308 -
\??\c:\1htttb.exec:\1htttb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
\??\c:\jdpvv.exec:\jdpvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\fxfflrf.exec:\fxfflrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\1jppv.exec:\1jppv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
\??\c:\lfxfrrf.exec:\lfxfrrf.exe17⤵
- Executes dropped EXE
PID:2916 -
\??\c:\lfxflrf.exec:\lfxflrf.exe18⤵
- Executes dropped EXE
PID:2680 -
\??\c:\tthbtb.exec:\tthbtb.exe19⤵
- Executes dropped EXE
PID:1556 -
\??\c:\dvvpd.exec:\dvvpd.exe20⤵
- Executes dropped EXE
PID:1996 -
\??\c:\hbthht.exec:\hbthht.exe21⤵
- Executes dropped EXE
PID:2164 -
\??\c:\jpvvp.exec:\jpvvp.exe22⤵
- Executes dropped EXE
PID:2324 -
\??\c:\llxfllx.exec:\llxfllx.exe23⤵
- Executes dropped EXE
PID:2568 -
\??\c:\djjpj.exec:\djjpj.exe24⤵
- Executes dropped EXE
PID:1728 -
\??\c:\lfxfffr.exec:\lfxfffr.exe25⤵
- Executes dropped EXE
PID:1916 -
\??\c:\vpjvd.exec:\vpjvd.exe26⤵
- Executes dropped EXE
PID:1736 -
\??\c:\1xrfrrx.exec:\1xrfrrx.exe27⤵
- Executes dropped EXE
PID:1820 -
\??\c:\1llflrx.exec:\1llflrx.exe28⤵
- Executes dropped EXE
PID:1612 -
\??\c:\dvpvd.exec:\dvpvd.exe29⤵
- Executes dropped EXE
PID:656 -
\??\c:\pdpvv.exec:\pdpvv.exe30⤵
- Executes dropped EXE
PID:2472 -
\??\c:\7nnthh.exec:\7nnthh.exe31⤵
- Executes dropped EXE
PID:1608 -
\??\c:\tntthh.exec:\tntthh.exe32⤵
- Executes dropped EXE
PID:276 -
\??\c:\rlxrffl.exec:\rlxrffl.exe33⤵
- Executes dropped EXE
PID:2192 -
\??\c:\rllrllr.exec:\rllrllr.exe34⤵
- Executes dropped EXE
PID:1760 -
\??\c:\1thhnh.exec:\1thhnh.exe35⤵
- Executes dropped EXE
PID:1696 -
\??\c:\pvjvd.exec:\pvjvd.exe36⤵
- Executes dropped EXE
PID:3032 -
\??\c:\ffxxxfr.exec:\ffxxxfr.exe37⤵PID:2904
-
\??\c:\xlffffl.exec:\xlffffl.exe38⤵
- Executes dropped EXE
PID:2400 -
\??\c:\3xrrxff.exec:\3xrrxff.exe39⤵
- Executes dropped EXE
PID:2544 -
\??\c:\1ffxffr.exec:\1ffxffr.exe40⤵
- Executes dropped EXE
PID:2704 -
\??\c:\7bnhnn.exec:\7bnhnn.exe41⤵
- Executes dropped EXE
PID:2800 -
\??\c:\pddvv.exec:\pddvv.exe42⤵
- Executes dropped EXE
PID:2236 -
\??\c:\pjvpp.exec:\pjvpp.exe43⤵
- Executes dropped EXE
PID:1804 -
\??\c:\9ffflrx.exec:\9ffflrx.exe44⤵
- Executes dropped EXE
PID:2804 -
\??\c:\7tnhtt.exec:\7tnhtt.exe45⤵
- Executes dropped EXE
PID:2820 -
\??\c:\bthbnn.exec:\bthbnn.exe46⤵
- Executes dropped EXE
PID:2728 -
\??\c:\vjpdd.exec:\vjpdd.exe47⤵
- Executes dropped EXE
PID:2880 -
\??\c:\ffxxffx.exec:\ffxxffx.exe48⤵
- Executes dropped EXE
PID:1900 -
\??\c:\5lxxxxx.exec:\5lxxxxx.exe49⤵
- Executes dropped EXE
PID:2684 -
\??\c:\9ttnth.exec:\9ttnth.exe50⤵
- Executes dropped EXE
PID:2644 -
\??\c:\vpdvd.exec:\vpdvd.exe51⤵
- Executes dropped EXE
PID:2184 -
\??\c:\1jvjp.exec:\1jvjp.exe52⤵
- Executes dropped EXE
PID:308 -
\??\c:\xrxfffl.exec:\xrxfffl.exe53⤵
- Executes dropped EXE
PID:1448 -
\??\c:\rrrfxrl.exec:\rrrfxrl.exe54⤵
- Executes dropped EXE
PID:1132 -
\??\c:\5hhtbh.exec:\5hhtbh.exe55⤵
- Executes dropped EXE
PID:2876 -
\??\c:\pjpjv.exec:\pjpjv.exe56⤵
- Executes dropped EXE
PID:2792 -
\??\c:\vjddd.exec:\vjddd.exe57⤵
- Executes dropped EXE
PID:2868 -
\??\c:\xxrxffr.exec:\xxrxffr.exe58⤵
- Executes dropped EXE
PID:2368 -
\??\c:\nhhnbh.exec:\nhhnbh.exe59⤵
- Executes dropped EXE
PID:2712 -
\??\c:\bthbhb.exec:\bthbhb.exe60⤵
- Executes dropped EXE
PID:1704 -
\??\c:\ddppv.exec:\ddppv.exe61⤵
- Executes dropped EXE
PID:1568 -
\??\c:\1vvpp.exec:\1vvpp.exe62⤵
- Executes dropped EXE
PID:1356 -
\??\c:\bntntt.exec:\bntntt.exe63⤵
- Executes dropped EXE
PID:2488 -
\??\c:\3tbbnn.exec:\3tbbnn.exe64⤵
- Executes dropped EXE
PID:2708 -
\??\c:\pjvvd.exec:\pjvvd.exe65⤵
- Executes dropped EXE
PID:1812 -
\??\c:\frlfrlx.exec:\frlfrlx.exe66⤵
- Executes dropped EXE
PID:1548 -
\??\c:\lxxllfr.exec:\lxxllfr.exe67⤵PID:2492
-
\??\c:\nbhhhh.exec:\nbhhhh.exe68⤵PID:1944
-
\??\c:\jvddd.exec:\jvddd.exe69⤵PID:1728
-
\??\c:\jdpdd.exec:\jdpdd.exe70⤵PID:2596
-
\??\c:\xrlrlrf.exec:\xrlrlrf.exe71⤵PID:2304
-
\??\c:\9bnttn.exec:\9bnttn.exe72⤵PID:1820
-
\??\c:\btbhnt.exec:\btbhnt.exe73⤵PID:1620
-
\??\c:\pjdvd.exec:\pjdvd.exe74⤵PID:2284
-
\??\c:\ppddj.exec:\ppddj.exe75⤵PID:2256
-
\??\c:\lfxxxfr.exec:\lfxxxfr.exe76⤵PID:2212
-
\??\c:\tnnhbb.exec:\tnnhbb.exe77⤵PID:1424
-
\??\c:\jddjd.exec:\jddjd.exe78⤵PID:2452
-
\??\c:\7pdjv.exec:\7pdjv.exe79⤵PID:2280
-
\??\c:\rlxflfx.exec:\rlxflfx.exe80⤵PID:2192
-
\??\c:\hhtbhh.exec:\hhtbhh.exe81⤵PID:876
-
\??\c:\tnbtbt.exec:\tnbtbt.exe82⤵PID:1760
-
\??\c:\3vjpd.exec:\3vjpd.exe83⤵PID:2696
-
\??\c:\9rrxxxx.exec:\9rrxxxx.exe84⤵PID:1524
-
\??\c:\frfflxl.exec:\frfflxl.exe85⤵PID:1492
-
\??\c:\9hnhhb.exec:\9hnhhb.exe86⤵PID:2540
-
\??\c:\9jvpp.exec:\9jvpp.exe87⤵PID:2980
-
\??\c:\5vpjj.exec:\5vpjj.exe88⤵PID:2704
-
\??\c:\rfxllxf.exec:\rfxllxf.exe89⤵PID:2800
-
\??\c:\btbhhn.exec:\btbhhn.exe90⤵PID:2716
-
\??\c:\nhnnnh.exec:\nhnnnh.exe91⤵PID:1804
-
\??\c:\9djvd.exec:\9djvd.exe92⤵PID:2736
-
\??\c:\7jvjj.exec:\7jvjj.exe93⤵PID:2648
-
\??\c:\lfrrfff.exec:\lfrrfff.exe94⤵PID:2748
-
\??\c:\3tnbhn.exec:\3tnbhn.exe95⤵PID:2964
-
\??\c:\hbnntt.exec:\hbnntt.exe96⤵PID:2880
-
\??\c:\jvjdv.exec:\jvjdv.exe97⤵PID:2724
-
\??\c:\jdjjd.exec:\jdjjd.exe98⤵PID:2676
-
\??\c:\xxxxxfl.exec:\xxxxxfl.exe99⤵PID:2112
-
\??\c:\rllrxxf.exec:\rllrxxf.exe100⤵PID:2664
-
\??\c:\1htbhh.exec:\1htbhh.exe101⤵PID:676
-
\??\c:\ppvdd.exec:\ppvdd.exe102⤵PID:1444
-
\??\c:\jdjjp.exec:\jdjjp.exe103⤵PID:1748
-
\??\c:\rlxflrx.exec:\rlxflrx.exe104⤵PID:1196
-
\??\c:\9lxxfxf.exec:\9lxxfxf.exe105⤵PID:1252
-
\??\c:\hbtbnt.exec:\hbtbnt.exe106⤵PID:1888
-
\??\c:\jdpdp.exec:\jdpdp.exe107⤵PID:2700
-
\??\c:\5vdpv.exec:\5vdpv.exe108⤵PID:2940
-
\??\c:\lxfffxf.exec:\lxfffxf.exe109⤵PID:1692
-
\??\c:\hhbbhb.exec:\hhbbhb.exe110⤵PID:1556
-
\??\c:\nhtbht.exec:\nhtbht.exe111⤵PID:1668
-
\??\c:\7jvvd.exec:\7jvvd.exe112⤵PID:2156
-
\??\c:\3pjjp.exec:\3pjjp.exe113⤵PID:1792
-
\??\c:\lfllrxx.exec:\lfllrxx.exe114⤵PID:2324
-
\??\c:\ttbhnn.exec:\ttbhnn.exe115⤵PID:1852
-
\??\c:\3ttttb.exec:\3ttttb.exe116⤵PID:1548
-
\??\c:\vvpdp.exec:\vvpdp.exe117⤵PID:948
-
\??\c:\flfrllx.exec:\flfrllx.exe118⤵PID:1464
-
\??\c:\frllfff.exec:\frllfff.exe119⤵PID:284
-
\??\c:\hthbhn.exec:\hthbhn.exe120⤵PID:1588
-
\??\c:\vpdvv.exec:\vpdvv.exe121⤵PID:2248
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-