Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 22:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
31361a9ea82726e631b7317dcc2d3fe10df57e5c370a97e03ebf764071cb9638.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
31361a9ea82726e631b7317dcc2d3fe10df57e5c370a97e03ebf764071cb9638.exe
-
Size
453KB
-
MD5
82ef3b69ce334a2addbbb2c2f1513f94
-
SHA1
7894dde28b156bd8b6a7c094eae645e7c72c413f
-
SHA256
31361a9ea82726e631b7317dcc2d3fe10df57e5c370a97e03ebf764071cb9638
-
SHA512
581a8e35c1dbab70d1c9b53b02dbaefb9c9abb039b5b4675a97911ef417159d891e6540abd6768993934bdeafc86385a6d70dc127869cb0b727b1cb8cae0c344
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeY:q7Tc2NYHUrAwfMp3CDY
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/2792-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1632-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-18-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1852-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1852-38-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1852-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2516-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1680-58-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2784-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1680-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2444-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2472-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2460-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/680-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1608-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1516-167-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2220-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1268-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/996-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1452-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/824-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1596-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1872-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1640-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2308-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-421-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2484-428-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2376-435-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/1516-471-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2004-490-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2056-543-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3028-550-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/532-557-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/532-564-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1500-571-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-617-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1264-774-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2432-993-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-1006-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2072-1195-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2288-1208-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2792 thtttn.exe 2840 xfxfrlr.exe 1852 1bnnnn.exe 2516 vpdpd.exe 1680 1nhnnt.exe 2784 vpjpp.exe 2264 lxrrrrf.exe 2672 5thbbb.exe 2444 ppjvj.exe 2472 vvjvd.exe 2460 tnbbhn.exe 864 pjdjp.exe 2508 1lxflrl.exe 2880 hbtbhh.exe 680 9pddj.exe 1608 hbnbhn.exe 1516 dvpdd.exe 812 5fxxffr.exe 2220 nttbbh.exe 2000 5jjjv.exe 1268 5xxfflr.exe 2180 tbhtht.exe 2820 7pdjj.exe 2532 lfrrxxx.exe 996 bbnthh.exe 2476 vpjjp.exe 1452 lrxllff.exe 824 nhtbhh.exe 2972 5frxflr.exe 2988 5tnbhn.exe 1596 9dvdd.exe 2976 9xllrxf.exe 2836 tntthb.exe 1872 5bnttb.exe 1640 1jvdj.exe 2260 lfxxxxl.exe 1020 xxlrrrf.exe 1912 9ttbnn.exe 1916 3jvvd.exe 1668 lfxrxxl.exe 1684 fxlrxxf.exe 2308 btnntb.exe 2932 pjppp.exe 2624 lfxxxxl.exe 2264 7lrffxx.exe 2672 hthnbn.exe 2588 vjddd.exe 2768 fxrrffl.exe 2892 nhtnbb.exe 2440 vjjjp.exe 2556 jdddv.exe 2484 lfxlrxr.exe 2376 nnhhbh.exe 112 pvpdp.exe 344 ffxfflr.exe 1736 rlrrfxf.exe 2348 1nhthb.exe 1516 dddvj.exe 2020 vjddd.exe 2216 3xlxrlr.exe 2004 tnhntt.exe 1564 vvjdj.exe 284 jvpvj.exe 2180 9lflxxf.exe -
resource yara_rule behavioral1/memory/2792-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1852-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1852-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/864-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/680-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/812-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1268-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/996-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1452-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/824-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1596-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1872-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1640-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1912-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/112-442-0x0000000000430000-0x000000000045A000-memory.dmp upx behavioral1/memory/2004-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-503-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/352-510-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-543-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/532-557-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1500-571-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-584-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-649-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1480-748-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-761-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1264-774-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1304-805-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1288-812-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-939-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-993-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-1079-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1884-1188-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2244-1203-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2288-1204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-1236-0x0000000000320000-0x000000000034A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffflxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lxrllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlfrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lxrlfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rlrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bnttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fxxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1632 wrote to memory of 2792 1632 31361a9ea82726e631b7317dcc2d3fe10df57e5c370a97e03ebf764071cb9638.exe 28 PID 1632 wrote to memory of 2792 1632 31361a9ea82726e631b7317dcc2d3fe10df57e5c370a97e03ebf764071cb9638.exe 28 PID 1632 wrote to memory of 2792 1632 31361a9ea82726e631b7317dcc2d3fe10df57e5c370a97e03ebf764071cb9638.exe 28 PID 1632 wrote to memory of 2792 1632 31361a9ea82726e631b7317dcc2d3fe10df57e5c370a97e03ebf764071cb9638.exe 28 PID 2792 wrote to memory of 2840 2792 thtttn.exe 29 PID 2792 wrote to memory of 2840 2792 thtttn.exe 29 PID 2792 wrote to memory of 2840 2792 thtttn.exe 29 PID 2792 wrote to memory of 2840 2792 thtttn.exe 29 PID 2840 wrote to memory of 1852 2840 xfxfrlr.exe 30 PID 2840 wrote to memory of 1852 2840 xfxfrlr.exe 30 PID 2840 wrote to memory of 1852 2840 xfxfrlr.exe 30 PID 2840 wrote to memory of 1852 2840 xfxfrlr.exe 30 PID 1852 wrote to memory of 2516 1852 1bnnnn.exe 31 PID 1852 wrote to memory of 2516 1852 1bnnnn.exe 31 PID 1852 wrote to memory of 2516 1852 1bnnnn.exe 31 PID 1852 wrote to memory of 2516 1852 1bnnnn.exe 31 PID 2516 wrote to memory of 1680 2516 vpdpd.exe 32 PID 2516 wrote to memory of 1680 2516 vpdpd.exe 32 PID 2516 wrote to memory of 1680 2516 vpdpd.exe 32 PID 2516 wrote to memory of 1680 2516 vpdpd.exe 32 PID 1680 wrote to memory of 2784 1680 1nhnnt.exe 33 PID 1680 wrote to memory of 2784 1680 1nhnnt.exe 33 PID 1680 wrote to memory of 2784 1680 1nhnnt.exe 33 PID 1680 wrote to memory of 2784 1680 1nhnnt.exe 33 PID 2784 wrote to memory of 2264 2784 vpjpp.exe 34 PID 2784 wrote to memory of 2264 2784 vpjpp.exe 34 PID 2784 wrote to memory of 2264 2784 vpjpp.exe 34 PID 2784 wrote to memory of 2264 2784 vpjpp.exe 34 PID 2264 wrote to memory of 2672 2264 lxrrrrf.exe 35 PID 2264 wrote to memory of 2672 2264 lxrrrrf.exe 35 PID 2264 wrote to memory of 2672 2264 lxrrrrf.exe 35 PID 2264 wrote to memory of 2672 2264 lxrrrrf.exe 35 PID 2672 wrote to memory of 2444 2672 5thbbb.exe 36 PID 2672 wrote to memory of 2444 2672 5thbbb.exe 36 PID 2672 wrote to memory of 2444 2672 5thbbb.exe 36 PID 2672 wrote to memory of 2444 2672 5thbbb.exe 36 PID 2444 wrote to memory of 2472 2444 ppjvj.exe 37 PID 2444 wrote to memory of 2472 2444 ppjvj.exe 37 PID 2444 wrote to memory of 2472 2444 ppjvj.exe 37 PID 2444 wrote to memory of 2472 2444 ppjvj.exe 37 PID 2472 wrote to memory of 2460 2472 vvjvd.exe 38 PID 2472 wrote to memory of 2460 2472 vvjvd.exe 38 PID 2472 wrote to memory of 2460 2472 vvjvd.exe 38 PID 2472 wrote to memory of 2460 2472 vvjvd.exe 38 PID 2460 wrote to memory of 864 2460 tnbbhn.exe 39 PID 2460 wrote to memory of 864 2460 tnbbhn.exe 39 PID 2460 wrote to memory of 864 2460 tnbbhn.exe 39 PID 2460 wrote to memory of 864 2460 tnbbhn.exe 39 PID 864 wrote to memory of 2508 864 pjdjp.exe 40 PID 864 wrote to memory of 2508 864 pjdjp.exe 40 PID 864 wrote to memory of 2508 864 pjdjp.exe 40 PID 864 wrote to memory of 2508 864 pjdjp.exe 40 PID 2508 wrote to memory of 2880 2508 1lxflrl.exe 41 PID 2508 wrote to memory of 2880 2508 1lxflrl.exe 41 PID 2508 wrote to memory of 2880 2508 1lxflrl.exe 41 PID 2508 wrote to memory of 2880 2508 1lxflrl.exe 41 PID 2880 wrote to memory of 680 2880 hbtbhh.exe 42 PID 2880 wrote to memory of 680 2880 hbtbhh.exe 42 PID 2880 wrote to memory of 680 2880 hbtbhh.exe 42 PID 2880 wrote to memory of 680 2880 hbtbhh.exe 42 PID 680 wrote to memory of 1608 680 9pddj.exe 43 PID 680 wrote to memory of 1608 680 9pddj.exe 43 PID 680 wrote to memory of 1608 680 9pddj.exe 43 PID 680 wrote to memory of 1608 680 9pddj.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\31361a9ea82726e631b7317dcc2d3fe10df57e5c370a97e03ebf764071cb9638.exe"C:\Users\Admin\AppData\Local\Temp\31361a9ea82726e631b7317dcc2d3fe10df57e5c370a97e03ebf764071cb9638.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\thtttn.exec:\thtttn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\xfxfrlr.exec:\xfxfrlr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\1bnnnn.exec:\1bnnnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\vpdpd.exec:\vpdpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\1nhnnt.exec:\1nhnnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\vpjpp.exec:\vpjpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\lxrrrrf.exec:\lxrrrrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\5thbbb.exec:\5thbbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\ppjvj.exec:\ppjvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\vvjvd.exec:\vvjvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\tnbbhn.exec:\tnbbhn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\pjdjp.exec:\pjdjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\1lxflrl.exec:\1lxflrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\hbtbhh.exec:\hbtbhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\9pddj.exec:\9pddj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:680 -
\??\c:\hbnbhn.exec:\hbnbhn.exe17⤵
- Executes dropped EXE
PID:1608 -
\??\c:\dvpdd.exec:\dvpdd.exe18⤵
- Executes dropped EXE
PID:1516 -
\??\c:\5fxxffr.exec:\5fxxffr.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:812 -
\??\c:\nttbbh.exec:\nttbbh.exe20⤵
- Executes dropped EXE
PID:2220 -
\??\c:\5jjjv.exec:\5jjjv.exe21⤵
- Executes dropped EXE
PID:2000 -
\??\c:\5xxfflr.exec:\5xxfflr.exe22⤵
- Executes dropped EXE
PID:1268 -
\??\c:\tbhtht.exec:\tbhtht.exe23⤵
- Executes dropped EXE
PID:2180 -
\??\c:\7pdjj.exec:\7pdjj.exe24⤵
- Executes dropped EXE
PID:2820 -
\??\c:\lfrrxxx.exec:\lfrrxxx.exe25⤵
- Executes dropped EXE
PID:2532 -
\??\c:\bbnthh.exec:\bbnthh.exe26⤵
- Executes dropped EXE
PID:996 -
\??\c:\vpjjp.exec:\vpjjp.exe27⤵
- Executes dropped EXE
PID:2476 -
\??\c:\lrxllff.exec:\lrxllff.exe28⤵
- Executes dropped EXE
PID:1452 -
\??\c:\nhtbhh.exec:\nhtbhh.exe29⤵
- Executes dropped EXE
PID:824 -
\??\c:\5frxflr.exec:\5frxflr.exe30⤵
- Executes dropped EXE
PID:2972 -
\??\c:\5tnbhn.exec:\5tnbhn.exe31⤵
- Executes dropped EXE
PID:2988 -
\??\c:\9dvdd.exec:\9dvdd.exe32⤵
- Executes dropped EXE
PID:1596 -
\??\c:\9xllrxf.exec:\9xllrxf.exe33⤵
- Executes dropped EXE
PID:2976 -
\??\c:\tntthb.exec:\tntthb.exe34⤵
- Executes dropped EXE
PID:2836 -
\??\c:\5bnttb.exec:\5bnttb.exe35⤵
- Executes dropped EXE
PID:1872 -
\??\c:\1jvdj.exec:\1jvdj.exe36⤵
- Executes dropped EXE
PID:1640 -
\??\c:\lfxxxxl.exec:\lfxxxxl.exe37⤵
- Executes dropped EXE
PID:2260 -
\??\c:\xxlrrrf.exec:\xxlrrrf.exe38⤵
- Executes dropped EXE
PID:1020 -
\??\c:\9ttbnn.exec:\9ttbnn.exe39⤵
- Executes dropped EXE
PID:1912 -
\??\c:\3jvvd.exec:\3jvvd.exe40⤵
- Executes dropped EXE
PID:1916 -
\??\c:\lfxrxxl.exec:\lfxrxxl.exe41⤵
- Executes dropped EXE
PID:1668 -
\??\c:\fxlrxxf.exec:\fxlrxxf.exe42⤵
- Executes dropped EXE
PID:1684 -
\??\c:\btnntb.exec:\btnntb.exe43⤵
- Executes dropped EXE
PID:2308 -
\??\c:\pjppp.exec:\pjppp.exe44⤵
- Executes dropped EXE
PID:2932 -
\??\c:\lfxxxxl.exec:\lfxxxxl.exe45⤵
- Executes dropped EXE
PID:2624 -
\??\c:\7lrffxx.exec:\7lrffxx.exe46⤵
- Executes dropped EXE
PID:2264 -
\??\c:\hthnbn.exec:\hthnbn.exe47⤵
- Executes dropped EXE
PID:2672 -
\??\c:\vjddd.exec:\vjddd.exe48⤵
- Executes dropped EXE
PID:2588 -
\??\c:\fxrrffl.exec:\fxrrffl.exe49⤵
- Executes dropped EXE
PID:2768 -
\??\c:\nhtnbb.exec:\nhtnbb.exe50⤵
- Executes dropped EXE
PID:2892 -
\??\c:\vjjjp.exec:\vjjjp.exe51⤵
- Executes dropped EXE
PID:2440 -
\??\c:\jdddv.exec:\jdddv.exe52⤵
- Executes dropped EXE
PID:2556 -
\??\c:\lfxlrxr.exec:\lfxlrxr.exe53⤵
- Executes dropped EXE
PID:2484 -
\??\c:\nnhhbh.exec:\nnhhbh.exe54⤵
- Executes dropped EXE
PID:2376 -
\??\c:\pvpdp.exec:\pvpdp.exe55⤵
- Executes dropped EXE
PID:112 -
\??\c:\ffxfflr.exec:\ffxfflr.exe56⤵
- Executes dropped EXE
PID:344 -
\??\c:\rlrrfxf.exec:\rlrrfxf.exe57⤵
- Executes dropped EXE
PID:1736 -
\??\c:\1nhthb.exec:\1nhthb.exe58⤵
- Executes dropped EXE
PID:2348 -
\??\c:\dddvj.exec:\dddvj.exe59⤵
- Executes dropped EXE
PID:1516 -
\??\c:\vjddd.exec:\vjddd.exe60⤵
- Executes dropped EXE
PID:2020 -
\??\c:\3xlxrlr.exec:\3xlxrlr.exe61⤵
- Executes dropped EXE
PID:2216 -
\??\c:\tnhntt.exec:\tnhntt.exe62⤵
- Executes dropped EXE
PID:2004 -
\??\c:\vvjdj.exec:\vvjdj.exe63⤵
- Executes dropped EXE
PID:1564 -
\??\c:\jvpvj.exec:\jvpvj.exe64⤵
- Executes dropped EXE
PID:284 -
\??\c:\9lflxxf.exec:\9lflxxf.exe65⤵
- Executes dropped EXE
PID:2180 -
\??\c:\nhhbbh.exec:\nhhbbh.exe66⤵PID:352
-
\??\c:\bbhntt.exec:\bbhntt.exe67⤵PID:1208
-
\??\c:\7jjvp.exec:\7jjvp.exe68⤵PID:3028
-
\??\c:\7ffxfff.exec:\7ffxfff.exe69⤵PID:1004
-
\??\c:\bnntbb.exec:\bnntbb.exe70⤵PID:2056
-
\??\c:\nhtthh.exec:\nhtthh.exe71⤵PID:924
-
\??\c:\dpdpp.exec:\dpdpp.exe72⤵PID:3004
-
\??\c:\3frllfl.exec:\3frllfl.exe73⤵PID:532
-
\??\c:\7tnntt.exec:\7tnntt.exe74⤵PID:1012
-
\??\c:\ttnnbb.exec:\ttnnbb.exe75⤵PID:1500
-
\??\c:\pjvvd.exec:\pjvvd.exe76⤵PID:1596
-
\??\c:\xxrxflr.exec:\xxrxflr.exe77⤵PID:2332
-
\??\c:\hhtbhb.exec:\hhtbhb.exe78⤵PID:2860
-
\??\c:\nhbbbh.exec:\nhbbbh.exe79⤵PID:1872
-
\??\c:\vpjpj.exec:\vpjpj.exe80⤵PID:1520
-
\??\c:\rrlfrxl.exec:\rrlfrxl.exe81⤵
- System Location Discovery: System Language Discovery
PID:2908 -
\??\c:\tbntbb.exec:\tbntbb.exe82⤵PID:1924
-
\??\c:\5pddj.exec:\5pddj.exe83⤵PID:2320
-
\??\c:\5xrrllx.exec:\5xrrllx.exe84⤵PID:2888
-
\??\c:\7rrrrll.exec:\7rrrrll.exe85⤵PID:2252
-
\??\c:\bnhhnn.exec:\bnhhnn.exe86⤵PID:2080
-
\??\c:\dvjjp.exec:\dvjjp.exe87⤵PID:2712
-
\??\c:\xrlxlrf.exec:\xrlxlrf.exe88⤵PID:2584
-
\??\c:\rfrllrx.exec:\rfrllrx.exe89⤵PID:2544
-
\??\c:\3btbhn.exec:\3btbhn.exe90⤵PID:2800
-
\??\c:\9pddd.exec:\9pddd.exe91⤵PID:2552
-
\??\c:\vvpjv.exec:\vvpjv.exe92⤵PID:2680
-
\??\c:\rrlxlrx.exec:\rrlxlrx.exe93⤵PID:2472
-
\??\c:\htntbb.exec:\htntbb.exe94⤵PID:2604
-
\??\c:\hbtbnt.exec:\hbtbnt.exe95⤵PID:2892
-
\??\c:\vpjpv.exec:\vpjpv.exe96⤵PID:2876
-
\??\c:\lfflxxl.exec:\lfflxxl.exe97⤵PID:1900
-
\??\c:\ffxrffl.exec:\ffxrffl.exe98⤵PID:2884
-
\??\c:\5hnttt.exec:\5hnttt.exe99⤵PID:308
-
\??\c:\jdpjp.exec:\jdpjp.exe100⤵PID:112
-
\??\c:\7pppp.exec:\7pppp.exe101⤵PID:1044
-
\??\c:\rfrfxfx.exec:\rfrfxfx.exe102⤵PID:2172
-
\??\c:\nhhtbh.exec:\nhhtbh.exe103⤵PID:1480
-
\??\c:\bbbthn.exec:\bbbthn.exe104⤵PID:2352
-
\??\c:\pjdvv.exec:\pjdvv.exe105⤵PID:2212
-
\??\c:\llffffr.exec:\llffffr.exe106⤵PID:1264
-
\??\c:\1xllllr.exec:\1xllllr.exe107⤵PID:2012
-
\??\c:\hhbhbh.exec:\hhbhbh.exe108⤵PID:1276
-
\??\c:\nhhntb.exec:\nhhntb.exe109⤵PID:1268
-
\??\c:\jvjjp.exec:\jvjjp.exe110⤵PID:2092
-
\??\c:\1frlllx.exec:\1frlllx.exe111⤵PID:2088
-
\??\c:\fxrxlrf.exec:\fxrxlrf.exe112⤵PID:1304
-
\??\c:\9thntt.exec:\9thntt.exe113⤵PID:1288
-
\??\c:\dvjvv.exec:\dvjvv.exe114⤵PID:1696
-
\??\c:\9jdjp.exec:\9jdjp.exe115⤵PID:1212
-
\??\c:\lxlrxxf.exec:\lxlrxxf.exe116⤵PID:652
-
\??\c:\9ttnbt.exec:\9ttnbt.exe117⤵PID:924
-
\??\c:\hthhtt.exec:\hthhtt.exe118⤵PID:3004
-
\??\c:\7vddd.exec:\7vddd.exe119⤵PID:532
-
\??\c:\5lrrllr.exec:\5lrrllr.exe120⤵PID:1848
-
\??\c:\xlfflrr.exec:\xlfflrr.exe121⤵PID:564
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-