Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 01:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a81c5564ee07436f831e8f6bda74784b807372c28bc3998be7b6368acaaa1255.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
a81c5564ee07436f831e8f6bda74784b807372c28bc3998be7b6368acaaa1255.exe
-
Size
454KB
-
MD5
8ce3a6cf2aa5afc0cd0997eab56af00e
-
SHA1
b10cb77e1f7a9dd80320d2a25e4222b39e01421d
-
SHA256
a81c5564ee07436f831e8f6bda74784b807372c28bc3998be7b6368acaaa1255
-
SHA512
f3890e805d647a3005ee27cbd67eb9e622d6dc85dd4ab183fa3ab3198a6503c1cdae8ee70239daf387a584af712aef582614601f42099f61fd33acda0caba982
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbea:q7Tc2NYHUrAwfMp3CDa
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/2352-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2516-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-93-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/1852-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/912-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2508-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1508-174-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1508-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/916-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/908-226-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/588-225-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1696-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2092-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1740-283-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1740-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1836-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1552-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/988-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1408-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1724-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-437-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1688-464-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2412-471-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/540-479-0x0000000000270000-0x000000000029A000-memory.dmp family_blackmoon behavioral1/memory/640-480-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/916-492-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/300-513-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2584-596-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2584-594-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2012-707-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2244-759-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2260-821-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2340-925-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1528-1134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1980-1147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2516 htnbht.exe 2556 llxlrlr.exe 2804 5pvpj.exe 2724 1htttb.exe 2900 5jvjp.exe 2628 xlfrfxf.exe 1584 vppvj.exe 2756 fxxfrxl.exe 2624 thbtnb.exe 2788 vvjvd.exe 1852 lxfflfl.exe 912 ddvjp.exe 2300 5xxlxrl.exe 2576 vdppv.exe 2016 vjvvd.exe 2948 xlxrrlx.exe 2508 jdvvj.exe 1508 3lfrflr.exe 2140 dpdvp.exe 588 3xllxrr.exe 916 nbthth.exe 3028 xrlrffx.exe 280 1pvvd.exe 908 rllrlll.exe 1696 1pjpd.exe 868 rlffllf.exe 2092 llllrlx.exe 1656 5nhthb.exe 2580 rlflxrl.exe 1740 nttntn.exe 1836 7rlrxlx.exe 3008 ntntbh.exe 1524 jpjvj.exe 2380 rlfflrx.exe 1552 jjjdv.exe 2236 pjdpd.exe 2804 lfrxxfr.exe 2848 3bhnhn.exe 2768 5vdjp.exe 2996 rrfrfrl.exe 2628 bttntn.exe 2884 5bnbbh.exe 2792 xxrffrf.exe 2664 tbhtnb.exe 2684 9dvjp.exe 988 pvjdj.exe 676 7xxxlrf.exe 1408 7nbhth.exe 1724 9dvdv.exe 2008 rllrxfr.exe 1708 1lfrfrr.exe 2576 ntbtth.exe 2860 3pjdv.exe 2976 3xxxlrf.exe 1404 1xxllxr.exe 1688 bttbhn.exe 2412 5jpvj.exe 540 ffxllrl.exe 640 tnhtnn.exe 916 9pjpj.exe 876 lfxxflx.exe 2136 5xxfxrl.exe 300 hbntbn.exe 2268 dpdvv.exe -
resource yara_rule behavioral1/memory/2352-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1852-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/912-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1508-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/916-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1836-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1552-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/988-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1408-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/640-480-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-594-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2672-658-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-707-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-732-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/332-746-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/936-808-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-821-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/796-964-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-1085-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-1134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-1147-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxrflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrlrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lrlxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlflrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffflffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hbnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bbnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxfrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2352 wrote to memory of 2516 2352 a81c5564ee07436f831e8f6bda74784b807372c28bc3998be7b6368acaaa1255.exe 30 PID 2352 wrote to memory of 2516 2352 a81c5564ee07436f831e8f6bda74784b807372c28bc3998be7b6368acaaa1255.exe 30 PID 2352 wrote to memory of 2516 2352 a81c5564ee07436f831e8f6bda74784b807372c28bc3998be7b6368acaaa1255.exe 30 PID 2352 wrote to memory of 2516 2352 a81c5564ee07436f831e8f6bda74784b807372c28bc3998be7b6368acaaa1255.exe 30 PID 2516 wrote to memory of 2556 2516 htnbht.exe 31 PID 2516 wrote to memory of 2556 2516 htnbht.exe 31 PID 2516 wrote to memory of 2556 2516 htnbht.exe 31 PID 2516 wrote to memory of 2556 2516 htnbht.exe 31 PID 2556 wrote to memory of 2804 2556 llxlrlr.exe 32 PID 2556 wrote to memory of 2804 2556 llxlrlr.exe 32 PID 2556 wrote to memory of 2804 2556 llxlrlr.exe 32 PID 2556 wrote to memory of 2804 2556 llxlrlr.exe 32 PID 2804 wrote to memory of 2724 2804 5pvpj.exe 33 PID 2804 wrote to memory of 2724 2804 5pvpj.exe 33 PID 2804 wrote to memory of 2724 2804 5pvpj.exe 33 PID 2804 wrote to memory of 2724 2804 5pvpj.exe 33 PID 2724 wrote to memory of 2900 2724 1htttb.exe 34 PID 2724 wrote to memory of 2900 2724 1htttb.exe 34 PID 2724 wrote to memory of 2900 2724 1htttb.exe 34 PID 2724 wrote to memory of 2900 2724 1htttb.exe 34 PID 2900 wrote to memory of 2628 2900 5jvjp.exe 35 PID 2900 wrote to memory of 2628 2900 5jvjp.exe 35 PID 2900 wrote to memory of 2628 2900 5jvjp.exe 35 PID 2900 wrote to memory of 2628 2900 5jvjp.exe 35 PID 2628 wrote to memory of 1584 2628 xlfrfxf.exe 36 PID 2628 wrote to memory of 1584 2628 xlfrfxf.exe 36 PID 2628 wrote to memory of 1584 2628 xlfrfxf.exe 36 PID 2628 wrote to memory of 1584 2628 xlfrfxf.exe 36 PID 1584 wrote to memory of 2756 1584 vppvj.exe 37 PID 1584 wrote to memory of 2756 1584 vppvj.exe 37 PID 1584 wrote to memory of 2756 1584 vppvj.exe 37 PID 1584 wrote to memory of 2756 1584 vppvj.exe 37 PID 2756 wrote to memory of 2624 2756 fxxfrxl.exe 38 PID 2756 wrote to memory of 2624 2756 fxxfrxl.exe 38 PID 2756 wrote to memory of 2624 2756 fxxfrxl.exe 38 PID 2756 wrote to memory of 2624 2756 fxxfrxl.exe 38 PID 2624 wrote to memory of 2788 2624 thbtnb.exe 39 PID 2624 wrote to memory of 2788 2624 thbtnb.exe 39 PID 2624 wrote to memory of 2788 2624 thbtnb.exe 39 PID 2624 wrote to memory of 2788 2624 thbtnb.exe 39 PID 2788 wrote to memory of 1852 2788 vvjvd.exe 40 PID 2788 wrote to memory of 1852 2788 vvjvd.exe 40 PID 2788 wrote to memory of 1852 2788 vvjvd.exe 40 PID 2788 wrote to memory of 1852 2788 vvjvd.exe 40 PID 1852 wrote to memory of 912 1852 lxfflfl.exe 41 PID 1852 wrote to memory of 912 1852 lxfflfl.exe 41 PID 1852 wrote to memory of 912 1852 lxfflfl.exe 41 PID 1852 wrote to memory of 912 1852 lxfflfl.exe 41 PID 912 wrote to memory of 2300 912 ddvjp.exe 42 PID 912 wrote to memory of 2300 912 ddvjp.exe 42 PID 912 wrote to memory of 2300 912 ddvjp.exe 42 PID 912 wrote to memory of 2300 912 ddvjp.exe 42 PID 2300 wrote to memory of 2576 2300 5xxlxrl.exe 43 PID 2300 wrote to memory of 2576 2300 5xxlxrl.exe 43 PID 2300 wrote to memory of 2576 2300 5xxlxrl.exe 43 PID 2300 wrote to memory of 2576 2300 5xxlxrl.exe 43 PID 2576 wrote to memory of 2016 2576 vdppv.exe 44 PID 2576 wrote to memory of 2016 2576 vdppv.exe 44 PID 2576 wrote to memory of 2016 2576 vdppv.exe 44 PID 2576 wrote to memory of 2016 2576 vdppv.exe 44 PID 2016 wrote to memory of 2948 2016 vjvvd.exe 45 PID 2016 wrote to memory of 2948 2016 vjvvd.exe 45 PID 2016 wrote to memory of 2948 2016 vjvvd.exe 45 PID 2016 wrote to memory of 2948 2016 vjvvd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\a81c5564ee07436f831e8f6bda74784b807372c28bc3998be7b6368acaaa1255.exe"C:\Users\Admin\AppData\Local\Temp\a81c5564ee07436f831e8f6bda74784b807372c28bc3998be7b6368acaaa1255.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\htnbht.exec:\htnbht.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\llxlrlr.exec:\llxlrlr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\5pvpj.exec:\5pvpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\1htttb.exec:\1htttb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\5jvjp.exec:\5jvjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\xlfrfxf.exec:\xlfrfxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\vppvj.exec:\vppvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\fxxfrxl.exec:\fxxfrxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\thbtnb.exec:\thbtnb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\vvjvd.exec:\vvjvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\lxfflfl.exec:\lxfflfl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\ddvjp.exec:\ddvjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
\??\c:\5xxlxrl.exec:\5xxlxrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\vdppv.exec:\vdppv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\vjvvd.exec:\vjvvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\xlxrrlx.exec:\xlxrrlx.exe17⤵
- Executes dropped EXE
PID:2948 -
\??\c:\jdvvj.exec:\jdvvj.exe18⤵
- Executes dropped EXE
PID:2508 -
\??\c:\3lfrflr.exec:\3lfrflr.exe19⤵
- Executes dropped EXE
PID:1508 -
\??\c:\dpdvp.exec:\dpdvp.exe20⤵
- Executes dropped EXE
PID:2140 -
\??\c:\3xllxrr.exec:\3xllxrr.exe21⤵
- Executes dropped EXE
PID:588 -
\??\c:\nbthth.exec:\nbthth.exe22⤵
- Executes dropped EXE
PID:916 -
\??\c:\xrlrffx.exec:\xrlrffx.exe23⤵
- Executes dropped EXE
PID:3028 -
\??\c:\1pvvd.exec:\1pvvd.exe24⤵
- Executes dropped EXE
PID:280 -
\??\c:\rllrlll.exec:\rllrlll.exe25⤵
- Executes dropped EXE
PID:908 -
\??\c:\1pjpd.exec:\1pjpd.exe26⤵
- Executes dropped EXE
PID:1696 -
\??\c:\rlffllf.exec:\rlffllf.exe27⤵
- Executes dropped EXE
PID:868 -
\??\c:\llllrlx.exec:\llllrlx.exe28⤵
- Executes dropped EXE
PID:2092 -
\??\c:\5nhthb.exec:\5nhthb.exe29⤵
- Executes dropped EXE
PID:1656 -
\??\c:\rlflxrl.exec:\rlflxrl.exe30⤵
- Executes dropped EXE
PID:2580 -
\??\c:\nttntn.exec:\nttntn.exe31⤵
- Executes dropped EXE
PID:1740 -
\??\c:\7rlrxlx.exec:\7rlrxlx.exe32⤵
- Executes dropped EXE
PID:1836 -
\??\c:\ntntbh.exec:\ntntbh.exe33⤵
- Executes dropped EXE
PID:3008 -
\??\c:\jpjvj.exec:\jpjvj.exe34⤵
- Executes dropped EXE
PID:1524 -
\??\c:\rlfflrx.exec:\rlfflrx.exe35⤵
- Executes dropped EXE
PID:2380 -
\??\c:\jjjdv.exec:\jjjdv.exe36⤵
- Executes dropped EXE
PID:1552 -
\??\c:\pjdpd.exec:\pjdpd.exe37⤵
- Executes dropped EXE
PID:2236 -
\??\c:\lfrxxfr.exec:\lfrxxfr.exe38⤵
- Executes dropped EXE
PID:2804 -
\??\c:\3bhnhn.exec:\3bhnhn.exe39⤵
- Executes dropped EXE
PID:2848 -
\??\c:\5vdjp.exec:\5vdjp.exe40⤵
- Executes dropped EXE
PID:2768 -
\??\c:\rrfrfrl.exec:\rrfrfrl.exe41⤵
- Executes dropped EXE
PID:2996 -
\??\c:\bttntn.exec:\bttntn.exe42⤵
- Executes dropped EXE
PID:2628 -
\??\c:\5bnbbh.exec:\5bnbbh.exe43⤵
- Executes dropped EXE
PID:2884 -
\??\c:\xxrffrf.exec:\xxrffrf.exe44⤵
- Executes dropped EXE
PID:2792 -
\??\c:\tbhtnb.exec:\tbhtnb.exe45⤵
- Executes dropped EXE
PID:2664 -
\??\c:\9dvjp.exec:\9dvjp.exe46⤵
- Executes dropped EXE
PID:2684 -
\??\c:\pvjdj.exec:\pvjdj.exe47⤵
- Executes dropped EXE
PID:988 -
\??\c:\7xxxlrf.exec:\7xxxlrf.exe48⤵
- Executes dropped EXE
PID:676 -
\??\c:\7nbhth.exec:\7nbhth.exe49⤵
- Executes dropped EXE
PID:1408 -
\??\c:\9dvdv.exec:\9dvdv.exe50⤵
- Executes dropped EXE
PID:1724 -
\??\c:\rllrxfr.exec:\rllrxfr.exe51⤵
- Executes dropped EXE
PID:2008 -
\??\c:\1lfrfrr.exec:\1lfrfrr.exe52⤵
- Executes dropped EXE
PID:1708 -
\??\c:\ntbtth.exec:\ntbtth.exe53⤵
- Executes dropped EXE
PID:2576 -
\??\c:\3pjdv.exec:\3pjdv.exe54⤵
- Executes dropped EXE
PID:2860 -
\??\c:\3xxxlrf.exec:\3xxxlrf.exe55⤵
- Executes dropped EXE
PID:2976 -
\??\c:\1xxllxr.exec:\1xxllxr.exe56⤵
- Executes dropped EXE
PID:1404 -
\??\c:\bttbhn.exec:\bttbhn.exe57⤵
- Executes dropped EXE
PID:1688 -
\??\c:\5jpvj.exec:\5jpvj.exe58⤵
- Executes dropped EXE
PID:2412 -
\??\c:\ffxllrl.exec:\ffxllrl.exe59⤵
- Executes dropped EXE
PID:540 -
\??\c:\tnhtnn.exec:\tnhtnn.exe60⤵
- Executes dropped EXE
PID:640 -
\??\c:\9pjpj.exec:\9pjpj.exe61⤵
- Executes dropped EXE
PID:916 -
\??\c:\lfxxflx.exec:\lfxxflx.exe62⤵
- Executes dropped EXE
PID:876 -
\??\c:\5xxfxrl.exec:\5xxfxrl.exe63⤵
- Executes dropped EXE
PID:2136 -
\??\c:\hbntbn.exec:\hbntbn.exe64⤵
- Executes dropped EXE
PID:300 -
\??\c:\dpdvv.exec:\dpdvv.exe65⤵
- Executes dropped EXE
PID:2268 -
\??\c:\llflxfr.exec:\llflxfr.exe66⤵PID:1480
-
\??\c:\5fxfrrx.exec:\5fxfrrx.exe67⤵PID:936
-
\??\c:\tbbbnb.exec:\tbbbnb.exe68⤵
- System Location Discovery: System Language Discovery
PID:868 -
\??\c:\9vjpv.exec:\9vjpv.exe69⤵PID:2444
-
\??\c:\lflrxxx.exec:\lflrxxx.exe70⤵PID:600
-
\??\c:\lfflxlf.exec:\lfflxlf.exe71⤵PID:984
-
\??\c:\tbbnbh.exec:\tbbnbh.exe72⤵PID:2580
-
\??\c:\vvpjv.exec:\vvpjv.exe73⤵PID:892
-
\??\c:\rxrxlxl.exec:\rxrxlxl.exe74⤵PID:1560
-
\??\c:\rxflxlf.exec:\rxflxlf.exe75⤵PID:2264
-
\??\c:\nnhbnt.exec:\nnhbnt.exe76⤵PID:1496
-
\??\c:\pvdpv.exec:\pvdpv.exe77⤵
- System Location Discovery: System Language Discovery
PID:2584 -
\??\c:\rlfrlll.exec:\rlfrlll.exe78⤵PID:2184
-
\??\c:\lxfxrrx.exec:\lxfxrrx.exe79⤵PID:2328
-
\??\c:\thbhnh.exec:\thbhnh.exe80⤵PID:2236
-
\??\c:\vvvjv.exec:\vvvjv.exe81⤵PID:2728
-
\??\c:\llflxff.exec:\llflxff.exe82⤵PID:2904
-
\??\c:\xflfffl.exec:\xflfffl.exe83⤵PID:2780
-
\??\c:\hbbnbh.exec:\hbbnbh.exe84⤵PID:2648
-
\??\c:\vvvjv.exec:\vvvjv.exe85⤵PID:2628
-
\??\c:\7frrxxl.exec:\7frrxxl.exe86⤵PID:2784
-
\??\c:\5flrfrx.exec:\5flrfrx.exe87⤵PID:2640
-
\??\c:\ttnnbn.exec:\ttnnbn.exe88⤵PID:2672
-
\??\c:\pppvj.exec:\pppvj.exe89⤵PID:2072
-
\??\c:\flrffxl.exec:\flrffxl.exe90⤵PID:2872
-
\??\c:\rlfxflf.exec:\rlfxflf.exe91⤵PID:1516
-
\??\c:\3ttbnb.exec:\3ttbnb.exe92⤵PID:2228
-
\??\c:\1pdpv.exec:\1pdpv.exe93⤵PID:1908
-
\??\c:\7rfflrf.exec:\7rfflrf.exe94⤵PID:2232
-
\??\c:\xfrxrll.exec:\xfrxrll.exe95⤵PID:2012
-
\??\c:\3hhnth.exec:\3hhnth.exe96⤵PID:1708
-
\??\c:\7vvjp.exec:\7vvjp.exe97⤵PID:1648
-
\??\c:\llflrfx.exec:\llflrfx.exe98⤵PID:2860
-
\??\c:\fxxlfrf.exec:\fxxlfrf.exe99⤵PID:1208
-
\??\c:\ttthnb.exec:\ttthnb.exe100⤵PID:2108
-
\??\c:\vjpdj.exec:\vjpdj.exe101⤵PID:2112
-
\??\c:\3ffrfrf.exec:\3ffrfrf.exe102⤵PID:332
-
\??\c:\7bbnth.exec:\7bbnth.exe103⤵
- System Location Discovery: System Language Discovery
PID:2244 -
\??\c:\pppdp.exec:\pppdp.exe104⤵PID:2256
-
\??\c:\vpdjv.exec:\vpdjv.exe105⤵PID:1956
-
\??\c:\xrxflrf.exec:\xrxflrf.exe106⤵PID:1096
-
\??\c:\tthttb.exec:\tthttb.exe107⤵PID:1788
-
\??\c:\rlrxflx.exec:\rlrxflx.exe108⤵PID:1684
-
\??\c:\1hntbh.exec:\1hntbh.exe109⤵PID:1476
-
\??\c:\vpjpd.exec:\vpjpd.exe110⤵PID:2268
-
\??\c:\3dvpp.exec:\3dvpp.exe111⤵PID:1480
-
\??\c:\fflfflf.exec:\fflfflf.exe112⤵PID:936
-
\??\c:\hhbnhn.exec:\hhbnhn.exe113⤵PID:2260
-
\??\c:\7pvpp.exec:\7pvpp.exe114⤵PID:1324
-
\??\c:\jdddp.exec:\jdddp.exe115⤵
- System Location Discovery: System Language Discovery
PID:1220 -
\??\c:\rfxlxrf.exec:\rfxlxrf.exe116⤵PID:1448
-
\??\c:\tthnbt.exec:\tthnbt.exe117⤵PID:872
-
\??\c:\ppjvv.exec:\ppjvv.exe118⤵PID:1924
-
\??\c:\jjvdv.exec:\jjvdv.exe119⤵PID:1560
-
\??\c:\xxllxxl.exec:\xxllxxl.exe120⤵PID:2272
-
\??\c:\5htthn.exec:\5htthn.exe121⤵PID:1980
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-