Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18-12-2024 07:28
Behavioral task
behavioral1
Sample
f7f62498fbbe8864ff93b80d3e30ef58e27d36e16926c1df3315cce0644e3c83.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
f7f62498fbbe8864ff93b80d3e30ef58e27d36e16926c1df3315cce0644e3c83.exe
-
Size
331KB
-
MD5
66c41fcd25a3f167c7e660f07ab216e0
-
SHA1
649fd91841a87af119689e5fa820e28ba35117fd
-
SHA256
f7f62498fbbe8864ff93b80d3e30ef58e27d36e16926c1df3315cce0644e3c83
-
SHA512
c54f19ed259b24728a117664b7b13921942df050767bfbb45ff9ac6b0b1c5b9c47e5714feacc7ed51aed3efd656912b2dbd8038b46d94e493d9b52f826c5a2bb
-
SSDEEP
6144:vcm4FmowdHoStJdJIjaRleL42bL37BoTPkhu9gX5yGsTshQc8R0nxA5ij8+RC7t4:94wFHoStJdSjylh2b77BoTMA9gX59sTA
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/2152-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2236-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2236-16-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2708-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2140-38-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2140-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2504-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2748-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2652-69-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/948-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2872-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/372-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1684-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1656-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1908-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1928-155-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1296-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1964-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2220-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/952-199-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1032-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1356-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1732-238-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2328-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1444-262-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2920-275-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2020-286-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2720-297-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2136-298-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1856-320-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2884-331-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2620-332-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2696-360-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2696-358-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2904-387-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/1300-414-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1236-468-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2120-521-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/2344-531-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2344-530-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2236-577-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2860-606-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2860-605-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2604-628-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2960-732-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/1708-774-0x0000000001B80000-0x0000000001BA7000-memory.dmp family_blackmoon behavioral1/memory/1444-808-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2304-14153-0x0000000077190000-0x00000000772AF000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2236 jpvpp.exe 2680 pvdjv.exe 2708 9xlrlxr.exe 2140 rlxfxxl.exe 2504 ttnnth.exe 2748 rrxlxlx.exe 2652 9xxrrlx.exe 2428 rrlrrfr.exe 1728 frrfxxf.exe 948 ppdvj.exe 2872 rxfrrfr.exe 372 3ddpj.exe 1684 rlfrfrx.exe 1656 7dpvd.exe 1908 jjpjj.exe 1740 bthhbt.exe 2384 3frllxl.exe 1928 3jvdp.exe 1296 9lfxfxx.exe 1964 djjdp.exe 2012 lrrlrxf.exe 2220 ddvdp.exe 952 flxxrll.exe 1032 nhtbht.exe 1096 jdvdp.exe 1356 fffrflx.exe 700 jdjpd.exe 1732 xrlrxrx.exe 2452 9bthth.exe 2328 dpvvp.exe 1444 xffxxrr.exe 3028 jdvdv.exe 2920 lffrxfx.exe 2216 nnhnth.exe 2020 ppdjp.exe 2348 lfffllr.exe 2720 nhntnb.exe 2136 nnhhnb.exe 1544 djpvv.exe 2788 7lflxxl.exe 1856 1thtbn.exe 2736 nhtbhn.exe 2884 ppjpv.exe 2620 rrrxlxf.exe 3044 xrlxflf.exe 2748 ttnntb.exe 1660 9vvpj.exe 2696 3ffxxrx.exe 1428 rlrllfr.exe 1468 hbtbnn.exe 2636 vvjdp.exe 2752 rxrlrrl.exe 2904 tnttnt.exe 372 ddpvv.exe 1992 vjdpp.exe 1480 rxlflrr.exe 1300 bhnhnh.exe 1704 jvjdd.exe 1908 rrxrllf.exe 308 hhthbh.exe 2412 vdpdj.exe 2056 fxflxxx.exe 2164 lrfxxrl.exe 2956 bbhthb.exe -
resource yara_rule behavioral1/memory/2152-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000a0000000122ea-7.dat upx behavioral1/memory/2236-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2152-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2236-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016edb-17.dat upx behavioral1/files/0x00070000000173f3-25.dat upx behavioral1/files/0x0007000000017400-33.dat upx behavioral1/memory/2708-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2140-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2504-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000017403-42.dat upx behavioral1/files/0x000900000001746a-52.dat upx behavioral1/memory/2748-54-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2504-53-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000017488-62.dat upx behavioral1/memory/2748-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000191d2-70.dat upx behavioral1/files/0x00050000000191f6-77.dat upx behavioral1/files/0x0005000000019217-85.dat upx behavioral1/memory/948-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019240-94.dat upx behavioral1/memory/948-93-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019259-101.dat upx behavioral1/memory/372-103-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2872-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019268-111.dat upx behavioral1/memory/372-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1656-121-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001926c-122.dat upx behavioral1/memory/1684-120-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1908-130-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019275-129.dat upx behavioral1/memory/1656-128-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0031000000016dd0-139.dat upx behavioral1/memory/1908-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019278-146.dat upx behavioral1/files/0x000500000001929a-153.dat upx behavioral1/memory/1928-155-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019319-161.dat upx behavioral1/files/0x0005000000019365-169.dat upx behavioral1/memory/1296-168-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019377-177.dat upx behavioral1/memory/1964-176-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019387-184.dat upx behavioral1/memory/2220-192-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193a4-191.dat upx behavioral1/files/0x00050000000193b3-202.dat upx behavioral1/memory/1032-201-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193c1-210.dat upx behavioral1/memory/1032-208-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1356-218-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019433-217.dat upx behavioral1/files/0x0005000000019446-224.dat upx behavioral1/files/0x0005000000019450-232.dat upx behavioral1/files/0x000500000001945b-239.dat upx behavioral1/memory/1732-238-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019465-247.dat upx behavioral1/memory/2328-249-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001946a-255.dat upx behavioral1/memory/1444-262-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019479-263.dat upx behavioral1/memory/2920-275-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2020-286-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lffrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bthth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rlllrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2152 wrote to memory of 2236 2152 f7f62498fbbe8864ff93b80d3e30ef58e27d36e16926c1df3315cce0644e3c83.exe 30 PID 2152 wrote to memory of 2236 2152 f7f62498fbbe8864ff93b80d3e30ef58e27d36e16926c1df3315cce0644e3c83.exe 30 PID 2152 wrote to memory of 2236 2152 f7f62498fbbe8864ff93b80d3e30ef58e27d36e16926c1df3315cce0644e3c83.exe 30 PID 2152 wrote to memory of 2236 2152 f7f62498fbbe8864ff93b80d3e30ef58e27d36e16926c1df3315cce0644e3c83.exe 30 PID 2236 wrote to memory of 2680 2236 jpvpp.exe 31 PID 2236 wrote to memory of 2680 2236 jpvpp.exe 31 PID 2236 wrote to memory of 2680 2236 jpvpp.exe 31 PID 2236 wrote to memory of 2680 2236 jpvpp.exe 31 PID 2680 wrote to memory of 2708 2680 pvdjv.exe 32 PID 2680 wrote to memory of 2708 2680 pvdjv.exe 32 PID 2680 wrote to memory of 2708 2680 pvdjv.exe 32 PID 2680 wrote to memory of 2708 2680 pvdjv.exe 32 PID 2708 wrote to memory of 2140 2708 9xlrlxr.exe 33 PID 2708 wrote to memory of 2140 2708 9xlrlxr.exe 33 PID 2708 wrote to memory of 2140 2708 9xlrlxr.exe 33 PID 2708 wrote to memory of 2140 2708 9xlrlxr.exe 33 PID 2140 wrote to memory of 2504 2140 rlxfxxl.exe 34 PID 2140 wrote to memory of 2504 2140 rlxfxxl.exe 34 PID 2140 wrote to memory of 2504 2140 rlxfxxl.exe 34 PID 2140 wrote to memory of 2504 2140 rlxfxxl.exe 34 PID 2504 wrote to memory of 2748 2504 ttnnth.exe 35 PID 2504 wrote to memory of 2748 2504 ttnnth.exe 35 PID 2504 wrote to memory of 2748 2504 ttnnth.exe 35 PID 2504 wrote to memory of 2748 2504 ttnnth.exe 35 PID 2748 wrote to memory of 2652 2748 rrxlxlx.exe 36 PID 2748 wrote to memory of 2652 2748 rrxlxlx.exe 36 PID 2748 wrote to memory of 2652 2748 rrxlxlx.exe 36 PID 2748 wrote to memory of 2652 2748 rrxlxlx.exe 36 PID 2652 wrote to memory of 2428 2652 9xxrrlx.exe 37 PID 2652 wrote to memory of 2428 2652 9xxrrlx.exe 37 PID 2652 wrote to memory of 2428 2652 9xxrrlx.exe 37 PID 2652 wrote to memory of 2428 2652 9xxrrlx.exe 37 PID 2428 wrote to memory of 1728 2428 rrlrrfr.exe 38 PID 2428 wrote to memory of 1728 2428 rrlrrfr.exe 38 PID 2428 wrote to memory of 1728 2428 rrlrrfr.exe 38 PID 2428 wrote to memory of 1728 2428 rrlrrfr.exe 38 PID 1728 wrote to memory of 948 1728 frrfxxf.exe 39 PID 1728 wrote to memory of 948 1728 frrfxxf.exe 39 PID 1728 wrote to memory of 948 1728 frrfxxf.exe 39 PID 1728 wrote to memory of 948 1728 frrfxxf.exe 39 PID 948 wrote to memory of 2872 948 ppdvj.exe 40 PID 948 wrote to memory of 2872 948 ppdvj.exe 40 PID 948 wrote to memory of 2872 948 ppdvj.exe 40 PID 948 wrote to memory of 2872 948 ppdvj.exe 40 PID 2872 wrote to memory of 372 2872 rxfrrfr.exe 41 PID 2872 wrote to memory of 372 2872 rxfrrfr.exe 41 PID 2872 wrote to memory of 372 2872 rxfrrfr.exe 41 PID 2872 wrote to memory of 372 2872 rxfrrfr.exe 41 PID 372 wrote to memory of 1684 372 3ddpj.exe 42 PID 372 wrote to memory of 1684 372 3ddpj.exe 42 PID 372 wrote to memory of 1684 372 3ddpj.exe 42 PID 372 wrote to memory of 1684 372 3ddpj.exe 42 PID 1684 wrote to memory of 1656 1684 rlfrfrx.exe 43 PID 1684 wrote to memory of 1656 1684 rlfrfrx.exe 43 PID 1684 wrote to memory of 1656 1684 rlfrfrx.exe 43 PID 1684 wrote to memory of 1656 1684 rlfrfrx.exe 43 PID 1656 wrote to memory of 1908 1656 7dpvd.exe 44 PID 1656 wrote to memory of 1908 1656 7dpvd.exe 44 PID 1656 wrote to memory of 1908 1656 7dpvd.exe 44 PID 1656 wrote to memory of 1908 1656 7dpvd.exe 44 PID 1908 wrote to memory of 1740 1908 jjpjj.exe 45 PID 1908 wrote to memory of 1740 1908 jjpjj.exe 45 PID 1908 wrote to memory of 1740 1908 jjpjj.exe 45 PID 1908 wrote to memory of 1740 1908 jjpjj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\f7f62498fbbe8864ff93b80d3e30ef58e27d36e16926c1df3315cce0644e3c83.exe"C:\Users\Admin\AppData\Local\Temp\f7f62498fbbe8864ff93b80d3e30ef58e27d36e16926c1df3315cce0644e3c83.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\jpvpp.exec:\jpvpp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\pvdjv.exec:\pvdjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\9xlrlxr.exec:\9xlrlxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\rlxfxxl.exec:\rlxfxxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\ttnnth.exec:\ttnnth.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\rrxlxlx.exec:\rrxlxlx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\9xxrrlx.exec:\9xxrrlx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\rrlrrfr.exec:\rrlrrfr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\frrfxxf.exec:\frrfxxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\ppdvj.exec:\ppdvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
\??\c:\rxfrrfr.exec:\rxfrrfr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\3ddpj.exec:\3ddpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:372 -
\??\c:\rlfrfrx.exec:\rlfrfrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\7dpvd.exec:\7dpvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\jjpjj.exec:\jjpjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\bthhbt.exec:\bthhbt.exe17⤵
- Executes dropped EXE
PID:1740 -
\??\c:\3frllxl.exec:\3frllxl.exe18⤵
- Executes dropped EXE
PID:2384 -
\??\c:\3jvdp.exec:\3jvdp.exe19⤵
- Executes dropped EXE
PID:1928 -
\??\c:\9lfxfxx.exec:\9lfxfxx.exe20⤵
- Executes dropped EXE
PID:1296 -
\??\c:\djjdp.exec:\djjdp.exe21⤵
- Executes dropped EXE
PID:1964 -
\??\c:\lrrlrxf.exec:\lrrlrxf.exe22⤵
- Executes dropped EXE
PID:2012 -
\??\c:\ddvdp.exec:\ddvdp.exe23⤵
- Executes dropped EXE
PID:2220 -
\??\c:\flxxrll.exec:\flxxrll.exe24⤵
- Executes dropped EXE
PID:952 -
\??\c:\nhtbht.exec:\nhtbht.exe25⤵
- Executes dropped EXE
PID:1032 -
\??\c:\jdvdp.exec:\jdvdp.exe26⤵
- Executes dropped EXE
PID:1096 -
\??\c:\fffrflx.exec:\fffrflx.exe27⤵
- Executes dropped EXE
PID:1356 -
\??\c:\jdjpd.exec:\jdjpd.exe28⤵
- Executes dropped EXE
PID:700 -
\??\c:\xrlrxrx.exec:\xrlrxrx.exe29⤵
- Executes dropped EXE
PID:1732 -
\??\c:\9bthth.exec:\9bthth.exe30⤵
- Executes dropped EXE
PID:2452 -
\??\c:\dpvvp.exec:\dpvvp.exe31⤵
- Executes dropped EXE
PID:2328 -
\??\c:\xffxxrr.exec:\xffxxrr.exe32⤵
- Executes dropped EXE
PID:1444 -
\??\c:\jdvdv.exec:\jdvdv.exe33⤵
- Executes dropped EXE
PID:3028 -
\??\c:\lffrxfx.exec:\lffrxfx.exe34⤵
- Executes dropped EXE
PID:2920 -
\??\c:\nnhnth.exec:\nnhnth.exe35⤵
- Executes dropped EXE
PID:2216 -
\??\c:\ppdjp.exec:\ppdjp.exe36⤵
- Executes dropped EXE
PID:2020 -
\??\c:\lfffllr.exec:\lfffllr.exe37⤵
- Executes dropped EXE
PID:2348 -
\??\c:\nhntnb.exec:\nhntnb.exe38⤵
- Executes dropped EXE
PID:2720 -
\??\c:\nnhhnb.exec:\nnhhnb.exe39⤵
- Executes dropped EXE
PID:2136 -
\??\c:\djpvv.exec:\djpvv.exe40⤵
- Executes dropped EXE
PID:1544 -
\??\c:\7lflxxl.exec:\7lflxxl.exe41⤵
- Executes dropped EXE
PID:2788 -
\??\c:\1thtbn.exec:\1thtbn.exe42⤵
- Executes dropped EXE
PID:1856 -
\??\c:\nhtbhn.exec:\nhtbhn.exe43⤵
- Executes dropped EXE
PID:2736 -
\??\c:\ppjpv.exec:\ppjpv.exe44⤵
- Executes dropped EXE
PID:2884 -
\??\c:\rrrxlxf.exec:\rrrxlxf.exe45⤵
- Executes dropped EXE
PID:2620 -
\??\c:\xrlxflf.exec:\xrlxflf.exe46⤵
- Executes dropped EXE
PID:3044 -
\??\c:\ttnntb.exec:\ttnntb.exe47⤵
- Executes dropped EXE
PID:2748 -
\??\c:\9vvpj.exec:\9vvpj.exe48⤵
- Executes dropped EXE
PID:1660 -
\??\c:\3ffxxrx.exec:\3ffxxrx.exe49⤵
- Executes dropped EXE
PID:2696 -
\??\c:\rlrllfr.exec:\rlrllfr.exe50⤵
- Executes dropped EXE
PID:1428 -
\??\c:\hbtbnn.exec:\hbtbnn.exe51⤵
- Executes dropped EXE
PID:1468 -
\??\c:\vvjdp.exec:\vvjdp.exe52⤵
- Executes dropped EXE
PID:2636 -
\??\c:\rxrlrrl.exec:\rxrlrrl.exe53⤵
- Executes dropped EXE
PID:2752 -
\??\c:\tnttnt.exec:\tnttnt.exe54⤵
- Executes dropped EXE
PID:2904 -
\??\c:\ddpvv.exec:\ddpvv.exe55⤵
- Executes dropped EXE
PID:372 -
\??\c:\vjdpp.exec:\vjdpp.exe56⤵
- Executes dropped EXE
PID:1992 -
\??\c:\rxlflrr.exec:\rxlflrr.exe57⤵
- Executes dropped EXE
PID:1480 -
\??\c:\bhnhnh.exec:\bhnhnh.exe58⤵
- Executes dropped EXE
PID:1300 -
\??\c:\jvjdd.exec:\jvjdd.exe59⤵
- Executes dropped EXE
PID:1704 -
\??\c:\rrxrllf.exec:\rrxrllf.exe60⤵
- Executes dropped EXE
PID:1908 -
\??\c:\hhthbh.exec:\hhthbh.exe61⤵
- Executes dropped EXE
PID:308 -
\??\c:\vdpdj.exec:\vdpdj.exe62⤵
- Executes dropped EXE
PID:2412 -
\??\c:\fxflxxx.exec:\fxflxxx.exe63⤵
- Executes dropped EXE
PID:2056 -
\??\c:\lrfxxrl.exec:\lrfxxrl.exe64⤵
- Executes dropped EXE
PID:2164 -
\??\c:\bbhthb.exec:\bbhthb.exe65⤵
- Executes dropped EXE
PID:2956 -
\??\c:\ppvvj.exec:\ppvvj.exe66⤵PID:2996
-
\??\c:\lrxrlxx.exec:\lrxrlxx.exe67⤵PID:2916
-
\??\c:\thbhhh.exec:\thbhhh.exe68⤵PID:1236
-
\??\c:\djjvd.exec:\djjvd.exe69⤵PID:1744
-
\??\c:\rrxfllx.exec:\rrxfllx.exe70⤵PID:868
-
\??\c:\nhtnbt.exec:\nhtnbt.exe71⤵PID:2280
-
\??\c:\nhnntn.exec:\nhnntn.exe72⤵PID:1508
-
\??\c:\9vdpd.exec:\9vdpd.exe73⤵PID:3032
-
\??\c:\fflllff.exec:\fflllff.exe74⤵PID:1708
-
\??\c:\xrxxrfl.exec:\xrxxrfl.exe75⤵PID:1712
-
\??\c:\7tnbbn.exec:\7tnbbn.exe76⤵PID:1688
-
\??\c:\vvdpp.exec:\vvdpp.exe77⤵PID:2308
-
\??\c:\jjjvd.exec:\jjjvd.exe78⤵PID:2120
-
\??\c:\lfxlrrl.exec:\lfxlrrl.exe79⤵PID:2344
-
\??\c:\9hbbbn.exec:\9hbbbn.exe80⤵PID:2980
-
\??\c:\1djjv.exec:\1djjv.exe81⤵PID:2064
-
\??\c:\lrflfxl.exec:\lrflfxl.exe82⤵PID:288
-
\??\c:\ttnhbn.exec:\ttnhbn.exe83⤵PID:2920
-
\??\c:\tthhhn.exec:\tthhhn.exe84⤵PID:2028
-
\??\c:\fxrflrf.exec:\fxrflrf.exe85⤵PID:1336
-
\??\c:\1xrlrrr.exec:\1xrlrrr.exe86⤵PID:2704
-
\??\c:\1bhbnn.exec:\1bhbnn.exe87⤵PID:2236
-
\??\c:\pvpjp.exec:\pvpjp.exe88⤵
- System Location Discovery: System Language Discovery
PID:1696 -
\??\c:\rrlxxxf.exec:\rrlxxxf.exe89⤵PID:2700
-
\??\c:\bbtbnb.exec:\bbtbnb.exe90⤵PID:2800
-
\??\c:\dvvpj.exec:\dvvpj.exe91⤵PID:2868
-
\??\c:\vdjdv.exec:\vdjdv.exe92⤵PID:2860
-
\??\c:\ffxllfx.exec:\ffxllfx.exe93⤵PID:2844
-
\??\c:\hhbnbt.exec:\hhbnbt.exe94⤵PID:2584
-
\??\c:\vjpjp.exec:\vjpjp.exe95⤵PID:2744
-
\??\c:\fxlflfl.exec:\fxlflfl.exe96⤵PID:2604
-
\??\c:\3bbnhh.exec:\3bbnhh.exe97⤵PID:3020
-
\??\c:\bbnnht.exec:\bbnnht.exe98⤵PID:768
-
\??\c:\jjvdp.exec:\jjvdp.exe99⤵PID:1868
-
\??\c:\3flfxrl.exec:\3flfxrl.exe100⤵PID:2864
-
\??\c:\ttntnb.exec:\ttntnb.exe101⤵PID:2896
-
\??\c:\vvpjj.exec:\vvpjj.exe102⤵PID:2872
-
\??\c:\1frrxll.exec:\1frrxll.exe103⤵PID:2004
-
\??\c:\fxfrfxf.exec:\fxfrfxf.exe104⤵PID:1680
-
\??\c:\ntbnnt.exec:\ntbnnt.exe105⤵PID:1684
-
\??\c:\1jjdj.exec:\1jjdj.exe106⤵PID:1716
-
\??\c:\rlllrrl.exec:\rlllrrl.exe107⤵PID:1364
-
\??\c:\lrrrlfx.exec:\lrrrlfx.exe108⤵PID:1300
-
\??\c:\1vpdp.exec:\1vpdp.exe109⤵PID:2008
-
\??\c:\rxrfxxr.exec:\rxrfxxr.exe110⤵PID:1908
-
\??\c:\1frlrrf.exec:\1frlrrf.exe111⤵PID:2468
-
\??\c:\bbhnhh.exec:\bbhnhh.exe112⤵PID:2156
-
\??\c:\jvvdd.exec:\jvvdd.exe113⤵PID:2960
-
\??\c:\rlfrfrf.exec:\rlfrfrf.exe114⤵PID:3024
-
\??\c:\tnbnnt.exec:\tnbnnt.exe115⤵PID:1964
-
\??\c:\xllxflf.exec:\xllxflf.exe116⤵PID:2996
-
\??\c:\hthbhh.exec:\hthbhh.exe117⤵PID:836
-
\??\c:\9jdjd.exec:\9jdjd.exe118⤵PID:1588
-
\??\c:\rxllfxl.exec:\rxllfxl.exe119⤵PID:840
-
\??\c:\llfrfrl.exec:\llfrfrl.exe120⤵PID:1032
-
\??\c:\9bbnht.exec:\9bbnht.exe121⤵PID:932
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-