Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 01:22
Behavioral task
behavioral1
Sample
2c869ba75101c8c383d68c4bab685c07a5a5436a6152c13c51936d2e7f3ddfda.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
2c869ba75101c8c383d68c4bab685c07a5a5436a6152c13c51936d2e7f3ddfda.exe
-
Size
334KB
-
MD5
110175f070cd0ff0983d94b3aaa4f9f7
-
SHA1
bdea063c8efdcc25587746af3d1545634bdba50b
-
SHA256
2c869ba75101c8c383d68c4bab685c07a5a5436a6152c13c51936d2e7f3ddfda
-
SHA512
6692e9a86dcdde691e4d1a38e9878009649980cfc8db74c7ed50b178d976b06375f861229fcf8aa5bc0ccff7aedaf676a99ed03d725e7b625d182e7bfa516a08
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeR4:R4wFHoSHYHUrAwfMp3CDR4
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 51 IoCs
resource yara_rule behavioral1/memory/2448-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1200-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2076-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2752-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2708-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2824-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2688-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2592-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2676-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3040-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2556-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1044-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2896-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/824-125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2868-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2744-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2200-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2044-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/848-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/848-227-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1972-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2488-245-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2432-257-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1976-269-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/908-275-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2472-297-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/972-309-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2112-321-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2664-327-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2688-338-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1984-375-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2896-396-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1824-414-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2384-431-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/1924-478-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/848-494-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/1692-541-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1800-584-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2024-590-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/400-631-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2020-647-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/320-669-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/916-729-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1200-792-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2268-808-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2296-916-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2040-986-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/348-1040-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2292-1053-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2124-7995-0x0000000077000000-0x000000007711F000-memory.dmp family_blackmoon behavioral1/memory/2124-12830-0x0000000077000000-0x000000007711F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1200 jdpvd.exe 2076 g0628.exe 2752 rlfflrf.exe 2708 600284.exe 2824 jdvdj.exe 2688 pjvdj.exe 2588 66024.exe 2592 048260.exe 2676 208468.exe 2600 jvjvd.exe 3040 vvjdp.exe 2556 jddvj.exe 1044 1tbhnn.exe 2896 82846.exe 824 g2028.exe 2868 042462.exe 2744 ppjjd.exe 3016 bttbhn.exe 2200 5dvdv.exe 2324 xxrrxxl.exe 2952 q24202.exe 1716 2608062.exe 2044 0046068.exe 1872 hhhbnh.exe 1972 m4844.exe 928 48246.exe 848 hhtbbh.exe 1348 vvjdp.exe 2488 486240.exe 1520 646688.exe 2432 dvjpj.exe 1976 rlfrxxl.exe 908 dppjv.exe 2412 vjvpv.exe 2360 xfxxlrl.exe 1684 9dvvd.exe 2472 fffrlrl.exe 1816 5thhbh.exe 972 k42800.exe 2772 pjvjp.exe 2112 268422.exe 2816 7rlrfrx.exe 2664 tthnth.exe 2688 26628.exe 2588 fxrrxfr.exe 2608 7rflrrx.exe 2736 lfrxflr.exe 2564 k68084.exe 1464 jdpdp.exe 3044 xrxflrx.exe 1984 vdvdp.exe 1480 vvpdv.exe 1864 e04466.exe 536 jvppd.exe 2896 hhhhnt.exe 2860 tntntb.exe 580 hbbbbh.exe 1824 1xlrrrr.exe 2912 1nbtbb.exe 2920 lfrrxxl.exe 2384 a6602.exe 2188 jjvdj.exe 960 nhbhtt.exe 2452 llflxfr.exe -
resource yara_rule behavioral1/memory/2448-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000d000000012272-8.dat upx behavioral1/memory/2448-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2448-6-0x00000000002C0000-0x00000000002E7000-memory.dmp upx behavioral1/memory/2076-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015fa6-17.dat upx behavioral1/memory/1200-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000160da-27.dat upx behavioral1/memory/2076-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2752-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016141-35.dat upx behavioral1/files/0x00070000000162e4-43.dat upx behavioral1/memory/2708-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2824-51-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016399-53.dat upx behavioral1/memory/2688-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000900000001660e-59.dat upx behavioral1/files/0x0008000000016de9-67.dat upx behavioral1/memory/2592-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016df5-76.dat upx behavioral1/memory/2676-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016df8-82.dat upx behavioral1/files/0x0006000000016edc-90.dat upx behavioral1/memory/3040-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016f02-98.dat upx behavioral1/files/0x0009000000015df1-106.dat upx behavioral1/memory/2556-107-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001707f-115.dat upx behavioral1/memory/1044-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000174b4-122.dat upx behavioral1/memory/2896-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/824-125-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/824-132-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x00060000000174f8-133.dat upx behavioral1/memory/2868-141-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017570-140.dat upx behavioral1/memory/2744-148-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000175f1-149.dat upx behavioral1/files/0x00060000000175f7-159.dat upx behavioral1/files/0x000d000000018683-166.dat upx behavioral1/memory/2200-162-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018697-173.dat upx behavioral1/memory/1716-181-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018706-180.dat upx behavioral1/files/0x000500000001870c-188.dat upx behavioral1/memory/2044-190-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001871c-196.dat upx behavioral1/files/0x0005000000018745-204.dat upx behavioral1/files/0x0006000000018be7-211.dat upx behavioral1/files/0x0006000000018d7b-218.dat upx behavioral1/memory/848-221-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016edc-228.dat upx behavioral1/memory/1972-235-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018d83-238.dat upx behavioral1/files/0x0006000000018fdf-246.dat upx behavioral1/files/0x0006000000019056-253.dat upx behavioral1/files/0x0005000000019203-261.dat upx behavioral1/memory/1976-269-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/908-275-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2360-281-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2472-297-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/972-303-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/972-309-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2472-315-0x0000000000220000-0x0000000000247000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 00602.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22024.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language k68084.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btthht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0422842.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language u600406.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6482484.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7thntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbhtb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2448 wrote to memory of 1200 2448 2c869ba75101c8c383d68c4bab685c07a5a5436a6152c13c51936d2e7f3ddfda.exe 31 PID 2448 wrote to memory of 1200 2448 2c869ba75101c8c383d68c4bab685c07a5a5436a6152c13c51936d2e7f3ddfda.exe 31 PID 2448 wrote to memory of 1200 2448 2c869ba75101c8c383d68c4bab685c07a5a5436a6152c13c51936d2e7f3ddfda.exe 31 PID 2448 wrote to memory of 1200 2448 2c869ba75101c8c383d68c4bab685c07a5a5436a6152c13c51936d2e7f3ddfda.exe 31 PID 1200 wrote to memory of 2076 1200 jdpvd.exe 32 PID 1200 wrote to memory of 2076 1200 jdpvd.exe 32 PID 1200 wrote to memory of 2076 1200 jdpvd.exe 32 PID 1200 wrote to memory of 2076 1200 jdpvd.exe 32 PID 2076 wrote to memory of 2752 2076 g0628.exe 33 PID 2076 wrote to memory of 2752 2076 g0628.exe 33 PID 2076 wrote to memory of 2752 2076 g0628.exe 33 PID 2076 wrote to memory of 2752 2076 g0628.exe 33 PID 2752 wrote to memory of 2708 2752 rlfflrf.exe 34 PID 2752 wrote to memory of 2708 2752 rlfflrf.exe 34 PID 2752 wrote to memory of 2708 2752 rlfflrf.exe 34 PID 2752 wrote to memory of 2708 2752 rlfflrf.exe 34 PID 2708 wrote to memory of 2824 2708 600284.exe 35 PID 2708 wrote to memory of 2824 2708 600284.exe 35 PID 2708 wrote to memory of 2824 2708 600284.exe 35 PID 2708 wrote to memory of 2824 2708 600284.exe 35 PID 2824 wrote to memory of 2688 2824 jdvdj.exe 36 PID 2824 wrote to memory of 2688 2824 jdvdj.exe 36 PID 2824 wrote to memory of 2688 2824 jdvdj.exe 36 PID 2824 wrote to memory of 2688 2824 jdvdj.exe 36 PID 2688 wrote to memory of 2588 2688 pjvdj.exe 37 PID 2688 wrote to memory of 2588 2688 pjvdj.exe 37 PID 2688 wrote to memory of 2588 2688 pjvdj.exe 37 PID 2688 wrote to memory of 2588 2688 pjvdj.exe 37 PID 2588 wrote to memory of 2592 2588 66024.exe 38 PID 2588 wrote to memory of 2592 2588 66024.exe 38 PID 2588 wrote to memory of 2592 2588 66024.exe 38 PID 2588 wrote to memory of 2592 2588 66024.exe 38 PID 2592 wrote to memory of 2676 2592 048260.exe 39 PID 2592 wrote to memory of 2676 2592 048260.exe 39 PID 2592 wrote to memory of 2676 2592 048260.exe 39 PID 2592 wrote to memory of 2676 2592 048260.exe 39 PID 2676 wrote to memory of 2600 2676 208468.exe 40 PID 2676 wrote to memory of 2600 2676 208468.exe 40 PID 2676 wrote to memory of 2600 2676 208468.exe 40 PID 2676 wrote to memory of 2600 2676 208468.exe 40 PID 2600 wrote to memory of 3040 2600 jvjvd.exe 41 PID 2600 wrote to memory of 3040 2600 jvjvd.exe 41 PID 2600 wrote to memory of 3040 2600 jvjvd.exe 41 PID 2600 wrote to memory of 3040 2600 jvjvd.exe 41 PID 3040 wrote to memory of 2556 3040 vvjdp.exe 42 PID 3040 wrote to memory of 2556 3040 vvjdp.exe 42 PID 3040 wrote to memory of 2556 3040 vvjdp.exe 42 PID 3040 wrote to memory of 2556 3040 vvjdp.exe 42 PID 2556 wrote to memory of 1044 2556 jddvj.exe 43 PID 2556 wrote to memory of 1044 2556 jddvj.exe 43 PID 2556 wrote to memory of 1044 2556 jddvj.exe 43 PID 2556 wrote to memory of 1044 2556 jddvj.exe 43 PID 1044 wrote to memory of 2896 1044 1tbhnn.exe 44 PID 1044 wrote to memory of 2896 1044 1tbhnn.exe 44 PID 1044 wrote to memory of 2896 1044 1tbhnn.exe 44 PID 1044 wrote to memory of 2896 1044 1tbhnn.exe 44 PID 2896 wrote to memory of 824 2896 82846.exe 45 PID 2896 wrote to memory of 824 2896 82846.exe 45 PID 2896 wrote to memory of 824 2896 82846.exe 45 PID 2896 wrote to memory of 824 2896 82846.exe 45 PID 824 wrote to memory of 2868 824 g2028.exe 46 PID 824 wrote to memory of 2868 824 g2028.exe 46 PID 824 wrote to memory of 2868 824 g2028.exe 46 PID 824 wrote to memory of 2868 824 g2028.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c869ba75101c8c383d68c4bab685c07a5a5436a6152c13c51936d2e7f3ddfda.exe"C:\Users\Admin\AppData\Local\Temp\2c869ba75101c8c383d68c4bab685c07a5a5436a6152c13c51936d2e7f3ddfda.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\jdpvd.exec:\jdpvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
\??\c:\g0628.exec:\g0628.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\rlfflrf.exec:\rlfflrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\600284.exec:\600284.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\jdvdj.exec:\jdvdj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\pjvdj.exec:\pjvdj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\66024.exec:\66024.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\048260.exec:\048260.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\208468.exec:\208468.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\jvjvd.exec:\jvjvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\vvjdp.exec:\vvjdp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\jddvj.exec:\jddvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\1tbhnn.exec:\1tbhnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
\??\c:\82846.exec:\82846.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\g2028.exec:\g2028.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
\??\c:\042462.exec:\042462.exe17⤵
- Executes dropped EXE
PID:2868 -
\??\c:\ppjjd.exec:\ppjjd.exe18⤵
- Executes dropped EXE
PID:2744 -
\??\c:\bttbhn.exec:\bttbhn.exe19⤵
- Executes dropped EXE
PID:3016 -
\??\c:\5dvdv.exec:\5dvdv.exe20⤵
- Executes dropped EXE
PID:2200 -
\??\c:\xxrrxxl.exec:\xxrrxxl.exe21⤵
- Executes dropped EXE
PID:2324 -
\??\c:\q24202.exec:\q24202.exe22⤵
- Executes dropped EXE
PID:2952 -
\??\c:\2608062.exec:\2608062.exe23⤵
- Executes dropped EXE
PID:1716 -
\??\c:\0046068.exec:\0046068.exe24⤵
- Executes dropped EXE
PID:2044 -
\??\c:\hhhbnh.exec:\hhhbnh.exe25⤵
- Executes dropped EXE
PID:1872 -
\??\c:\m4844.exec:\m4844.exe26⤵
- Executes dropped EXE
PID:1972 -
\??\c:\48246.exec:\48246.exe27⤵
- Executes dropped EXE
PID:928 -
\??\c:\hhtbbh.exec:\hhtbbh.exe28⤵
- Executes dropped EXE
PID:848 -
\??\c:\vvjdp.exec:\vvjdp.exe29⤵
- Executes dropped EXE
PID:1348 -
\??\c:\486240.exec:\486240.exe30⤵
- Executes dropped EXE
PID:2488 -
\??\c:\646688.exec:\646688.exe31⤵
- Executes dropped EXE
PID:1520 -
\??\c:\dvjpj.exec:\dvjpj.exe32⤵
- Executes dropped EXE
PID:2432 -
\??\c:\rlfrxxl.exec:\rlfrxxl.exe33⤵
- Executes dropped EXE
PID:1976 -
\??\c:\dppjv.exec:\dppjv.exe34⤵
- Executes dropped EXE
PID:908 -
\??\c:\vjvpv.exec:\vjvpv.exe35⤵
- Executes dropped EXE
PID:2412 -
\??\c:\xfxxlrl.exec:\xfxxlrl.exe36⤵
- Executes dropped EXE
PID:2360 -
\??\c:\9dvvd.exec:\9dvvd.exe37⤵
- Executes dropped EXE
PID:1684 -
\??\c:\fffrlrl.exec:\fffrlrl.exe38⤵
- Executes dropped EXE
PID:2472 -
\??\c:\5thhbh.exec:\5thhbh.exe39⤵
- Executes dropped EXE
PID:1816 -
\??\c:\k42800.exec:\k42800.exe40⤵
- Executes dropped EXE
PID:972 -
\??\c:\pjvjp.exec:\pjvjp.exe41⤵
- Executes dropped EXE
PID:2772 -
\??\c:\268422.exec:\268422.exe42⤵
- Executes dropped EXE
PID:2112 -
\??\c:\7rlrfrx.exec:\7rlrfrx.exe43⤵
- Executes dropped EXE
PID:2816 -
\??\c:\tthnth.exec:\tthnth.exe44⤵
- Executes dropped EXE
PID:2664 -
\??\c:\26628.exec:\26628.exe45⤵
- Executes dropped EXE
PID:2688 -
\??\c:\fxrrxfr.exec:\fxrrxfr.exe46⤵
- Executes dropped EXE
PID:2588 -
\??\c:\7rflrrx.exec:\7rflrrx.exe47⤵
- Executes dropped EXE
PID:2608 -
\??\c:\lfrxflr.exec:\lfrxflr.exe48⤵
- Executes dropped EXE
PID:2736 -
\??\c:\k68084.exec:\k68084.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2564 -
\??\c:\jdpdp.exec:\jdpdp.exe50⤵
- Executes dropped EXE
PID:1464 -
\??\c:\xrxflrx.exec:\xrxflrx.exe51⤵
- Executes dropped EXE
PID:3044 -
\??\c:\vdvdp.exec:\vdvdp.exe52⤵
- Executes dropped EXE
PID:1984 -
\??\c:\vvpdv.exec:\vvpdv.exe53⤵
- Executes dropped EXE
PID:1480 -
\??\c:\e04466.exec:\e04466.exe54⤵
- Executes dropped EXE
PID:1864 -
\??\c:\jvppd.exec:\jvppd.exe55⤵
- Executes dropped EXE
PID:536 -
\??\c:\hhhhnt.exec:\hhhhnt.exe56⤵
- Executes dropped EXE
PID:2896 -
\??\c:\tntntb.exec:\tntntb.exe57⤵
- Executes dropped EXE
PID:2860 -
\??\c:\hbbbbh.exec:\hbbbbh.exe58⤵
- Executes dropped EXE
PID:580 -
\??\c:\1xlrrrr.exec:\1xlrrrr.exe59⤵
- Executes dropped EXE
PID:1824 -
\??\c:\1nbtbb.exec:\1nbtbb.exe60⤵
- Executes dropped EXE
PID:2912 -
\??\c:\lfrrxxl.exec:\lfrrxxl.exe61⤵
- Executes dropped EXE
PID:2920 -
\??\c:\a6602.exec:\a6602.exe62⤵
- Executes dropped EXE
PID:2384 -
\??\c:\jjvdj.exec:\jjvdj.exe63⤵
- Executes dropped EXE
PID:2188 -
\??\c:\nhbhtt.exec:\nhbhtt.exe64⤵
- Executes dropped EXE
PID:960 -
\??\c:\llflxfr.exec:\llflxfr.exe65⤵
- Executes dropped EXE
PID:2452 -
\??\c:\60848.exec:\60848.exe66⤵PID:1624
-
\??\c:\lllxfrx.exec:\lllxfrx.exe67⤵PID:1716
-
\??\c:\26684.exec:\26684.exe68⤵PID:1924
-
\??\c:\6288648.exec:\6288648.exe69⤵PID:1792
-
\??\c:\nhttbb.exec:\nhttbb.exe70⤵PID:1696
-
\??\c:\btnbtb.exec:\btnbtb.exe71⤵PID:1756
-
\??\c:\u462846.exec:\u462846.exe72⤵PID:1600
-
\??\c:\6084020.exec:\6084020.exe73⤵PID:1532
-
\??\c:\7pvdj.exec:\7pvdj.exe74⤵PID:848
-
\??\c:\82802.exec:\82802.exe75⤵PID:1348
-
\??\c:\4802440.exec:\4802440.exe76⤵PID:1740
-
\??\c:\jjpvp.exec:\jjpvp.exe77⤵PID:2944
-
\??\c:\hbntbh.exec:\hbntbh.exe78⤵PID:2460
-
\??\c:\422400.exec:\422400.exe79⤵PID:892
-
\??\c:\i480262.exec:\i480262.exe80⤵PID:1640
-
\??\c:\nhbbnt.exec:\nhbbnt.exe81⤵PID:1112
-
\??\c:\48680.exec:\48680.exe82⤵PID:908
-
\??\c:\3httht.exec:\3httht.exe83⤵PID:584
-
\??\c:\448462.exec:\448462.exe84⤵PID:1692
-
\??\c:\04622.exec:\04622.exe85⤵PID:1684
-
\??\c:\rlfrxfr.exec:\rlfrxfr.exe86⤵PID:2472
-
\??\c:\824066.exec:\824066.exe87⤵PID:1584
-
\??\c:\864466.exec:\864466.exe88⤵PID:972
-
\??\c:\jjdjd.exec:\jjdjd.exe89⤵PID:2796
-
\??\c:\04628.exec:\04628.exe90⤵PID:2780
-
\??\c:\1rrxrxf.exec:\1rrxrxf.exe91⤵PID:1800
-
\??\c:\66408.exec:\66408.exe92⤵PID:2024
-
\??\c:\btnbnt.exec:\btnbnt.exe93⤵PID:2832
-
\??\c:\8848668.exec:\8848668.exe94⤵PID:2856
-
\??\c:\q42488.exec:\q42488.exe95⤵PID:2552
-
\??\c:\1dvvj.exec:\1dvvj.exe96⤵PID:2584
-
\??\c:\hbtthh.exec:\hbtthh.exe97⤵PID:1236
-
\??\c:\6680262.exec:\6680262.exe98⤵PID:3036
-
\??\c:\82024.exec:\82024.exe99⤵PID:1460
-
\??\c:\xrffffl.exec:\xrffffl.exe100⤵PID:400
-
\??\c:\tnbhnt.exec:\tnbhnt.exe101⤵PID:1324
-
\??\c:\nnhntb.exec:\nnhntb.exe102⤵PID:1744
-
\??\c:\hnhhnn.exec:\hnhhnn.exe103⤵PID:2020
-
\??\c:\082282.exec:\082282.exe104⤵PID:320
-
\??\c:\nthhnt.exec:\nthhnt.exe105⤵PID:2296
-
\??\c:\o644668.exec:\o644668.exe106⤵PID:2628
-
\??\c:\6040246.exec:\6040246.exe107⤵PID:2372
-
\??\c:\nbtbhn.exec:\nbtbhn.exe108⤵PID:2744
-
\??\c:\a8006.exec:\a8006.exe109⤵PID:2172
-
\??\c:\htnntb.exec:\htnntb.exe110⤵PID:2056
-
\??\c:\646688.exec:\646688.exe111⤵PID:2108
-
\??\c:\08628.exec:\08628.exe112⤵PID:2128
-
\??\c:\04684.exec:\04684.exe113⤵PID:1132
-
\??\c:\w20624.exec:\w20624.exe114⤵PID:1364
-
\??\c:\602466.exec:\602466.exe115⤵PID:1596
-
\??\c:\7hbhtn.exec:\7hbhtn.exe116⤵PID:1384
-
\??\c:\xrlxrxf.exec:\xrlxrxf.exe117⤵PID:2180
-
\??\c:\5tbbhb.exec:\5tbbhb.exe118⤵PID:916
-
\??\c:\u806880.exec:\u806880.exe119⤵PID:1524
-
\??\c:\bbbtbt.exec:\bbbtbt.exe120⤵PID:1724
-
\??\c:\820628.exec:\820628.exe121⤵PID:2204
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-