Analysis
-
max time kernel
150s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 02:37
Behavioral task
behavioral1
Sample
b7465945db75ea959b66dc7340603f467bf453983faf154a6d0e7e0d8c783307.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
150 seconds
General
-
Target
b7465945db75ea959b66dc7340603f467bf453983faf154a6d0e7e0d8c783307.exe
-
Size
331KB
-
MD5
10303adc2ecec517d48b269f14db74e0
-
SHA1
9698a4c9e106847b3fc1af09b2392bed54030c7d
-
SHA256
b7465945db75ea959b66dc7340603f467bf453983faf154a6d0e7e0d8c783307
-
SHA512
31349210b0e5bf54111560b435c3a418b635737e3f791ea790631190af7d10db7e2f2235826af056c9e44dc8639e319adff4080cadc5331f7affc1e1000f10f0
-
SSDEEP
6144:vcm4FmowdHoStJdJIjaRleL42bL37BoTPkhu9gX5yGsTshQc8R0nxA5ij8+RC7t8:94wFHoStJdSjylh2b77BoTMA9gX59sT0
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/1948-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2184-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2308-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2604-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2680-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2860-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2644-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2476-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2988-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2488-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2408-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/448-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2488-121-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1704-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1704-122-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2032-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2288-140-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1764-150-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2188-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1900-188-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1696-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1628-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1804-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1524-236-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/264-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/888-245-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2268-292-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2628-313-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3008-325-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2452-338-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2688-360-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2016-373-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2568-384-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/624-395-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1748-412-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1092-425-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1680-431-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2312-557-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/832-580-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/832-581-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2548-621-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2584-627-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2740-633-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1920-12005-0x0000000077AC0000-0x0000000077BDF000-memory.dmp family_blackmoon behavioral1/memory/1920-16850-0x0000000077AC0000-0x0000000077BDF000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2308 thtttb.exe 2184 1rxfrfl.exe 2680 3tnnth.exe 2604 ffrfrfr.exe 2860 5htbht.exe 2644 bhnntb.exe 2492 hnbbnt.exe 2476 rfrfllf.exe 2988 dvpvp.exe 2488 3ffxllr.exe 448 hbhttt.exe 2408 djvdp.exe 1704 rxffrxl.exe 2032 7dvdj.exe 2288 nhthtb.exe 1764 fflrxfl.exe 2188 9hnhbb.exe 1900 xxxfxxl.exe 2428 tbbhbb.exe 1868 1pdjv.exe 3004 rxllxff.exe 1696 hthnhb.exe 1628 ppjvj.exe 1804 ttnbtn.exe 888 dvdjj.exe 1864 ffrxfrf.exe 1524 tthhhn.exe 264 xxflflx.exe 2992 ttttnt.exe 2244 vdpvp.exe 2336 xrrrrff.exe 2260 9jjjd.exe 2160 vvvvd.exe 2104 nnnnnb.exe 2368 hbhnth.exe 2268 djvvj.exe 1564 xxrflrx.exe 2200 ffxxfxf.exe 2628 tntthb.exe 2660 jjjpd.exe 3008 7rxffll.exe 2600 rlxrffr.exe 2452 nhnnth.exe 2688 ppppv.exe 2860 lllrllf.exe 2560 tbtbbn.exe 2456 3nnhhh.exe 2568 ppvdj.exe 2016 frfxxrr.exe 2956 5tbbhh.exe 1600 5thbhb.exe 2028 7pvdp.exe 1036 lrxxrxl.exe 624 rllllff.exe 1604 7htntt.exe 1748 jdpvd.exe 2804 1fffxrr.exe 1092 xxfxlrx.exe 1680 1bhbhh.exe 1764 ddddj.exe 1904 lffffff.exe 1896 xxrxllx.exe 1900 5hbbnt.exe 2384 jdjjd.exe -
resource yara_rule behavioral1/memory/1948-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000c000000012243-7.dat upx behavioral1/memory/1948-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000018b62-18.dat upx behavioral1/memory/2184-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2308-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000018b68-26.dat upx behavioral1/memory/2604-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000018bf3-37.dat upx behavioral1/memory/2680-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000019230-45.dat upx behavioral1/memory/2860-53-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000019240-52.dat upx behavioral1/files/0x000600000001939b-62.dat upx behavioral1/memory/2644-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001961c-69.dat upx behavioral1/memory/2476-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001961e-78.dat upx behavioral1/memory/2476-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2988-87-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019667-86.dat upx behavioral1/memory/2488-94-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000196a1-96.dat upx behavioral1/files/0x0005000000019926-104.dat upx behavioral1/memory/2408-107-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/448-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019c34-114.dat upx behavioral1/files/0x0005000000019c3c-123.dat upx behavioral1/memory/1704-124-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019c3e-133.dat upx behavioral1/memory/2032-131-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2288-140-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0037000000018710-141.dat upx behavioral1/memory/1764-150-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019c57-149.dat upx behavioral1/files/0x0005000000019cba-158.dat upx behavioral1/memory/2188-157-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019cca-166.dat upx behavioral1/files/0x0005000000019d8e-173.dat upx behavioral1/files/0x0005000000019dbf-181.dat upx behavioral1/files/0x0005000000019f8a-189.dat upx behavioral1/memory/1696-191-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019f94-197.dat upx behavioral1/files/0x000500000001a075-205.dat upx behavioral1/memory/1628-204-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a07e-214.dat upx behavioral1/memory/1804-212-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a09e-221.dat upx behavioral1/files/0x000500000001a307-228.dat upx behavioral1/memory/1524-229-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a359-237.dat upx behavioral1/memory/1524-236-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/264-239-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/888-245-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a41b-246.dat upx behavioral1/files/0x000500000001a41d-253.dat upx behavioral1/files/0x000500000001a41e-261.dat upx behavioral1/files/0x000500000001a427-268.dat upx behavioral1/memory/2268-292-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2628-313-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3008-325-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2600-331-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2452-338-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2660-337-0x00000000003C0000-0x00000000003E7000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrxllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxflrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrrxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxfrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tnhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1948 wrote to memory of 2308 1948 b7465945db75ea959b66dc7340603f467bf453983faf154a6d0e7e0d8c783307.exe 29 PID 1948 wrote to memory of 2308 1948 b7465945db75ea959b66dc7340603f467bf453983faf154a6d0e7e0d8c783307.exe 29 PID 1948 wrote to memory of 2308 1948 b7465945db75ea959b66dc7340603f467bf453983faf154a6d0e7e0d8c783307.exe 29 PID 1948 wrote to memory of 2308 1948 b7465945db75ea959b66dc7340603f467bf453983faf154a6d0e7e0d8c783307.exe 29 PID 2308 wrote to memory of 2184 2308 thtttb.exe 30 PID 2308 wrote to memory of 2184 2308 thtttb.exe 30 PID 2308 wrote to memory of 2184 2308 thtttb.exe 30 PID 2308 wrote to memory of 2184 2308 thtttb.exe 30 PID 2184 wrote to memory of 2680 2184 1rxfrfl.exe 31 PID 2184 wrote to memory of 2680 2184 1rxfrfl.exe 31 PID 2184 wrote to memory of 2680 2184 1rxfrfl.exe 31 PID 2184 wrote to memory of 2680 2184 1rxfrfl.exe 31 PID 2680 wrote to memory of 2604 2680 3tnnth.exe 32 PID 2680 wrote to memory of 2604 2680 3tnnth.exe 32 PID 2680 wrote to memory of 2604 2680 3tnnth.exe 32 PID 2680 wrote to memory of 2604 2680 3tnnth.exe 32 PID 2604 wrote to memory of 2860 2604 ffrfrfr.exe 33 PID 2604 wrote to memory of 2860 2604 ffrfrfr.exe 33 PID 2604 wrote to memory of 2860 2604 ffrfrfr.exe 33 PID 2604 wrote to memory of 2860 2604 ffrfrfr.exe 33 PID 2860 wrote to memory of 2644 2860 5htbht.exe 34 PID 2860 wrote to memory of 2644 2860 5htbht.exe 34 PID 2860 wrote to memory of 2644 2860 5htbht.exe 34 PID 2860 wrote to memory of 2644 2860 5htbht.exe 34 PID 2644 wrote to memory of 2492 2644 bhnntb.exe 35 PID 2644 wrote to memory of 2492 2644 bhnntb.exe 35 PID 2644 wrote to memory of 2492 2644 bhnntb.exe 35 PID 2644 wrote to memory of 2492 2644 bhnntb.exe 35 PID 2492 wrote to memory of 2476 2492 hnbbnt.exe 36 PID 2492 wrote to memory of 2476 2492 hnbbnt.exe 36 PID 2492 wrote to memory of 2476 2492 hnbbnt.exe 36 PID 2492 wrote to memory of 2476 2492 hnbbnt.exe 36 PID 2476 wrote to memory of 2988 2476 rfrfllf.exe 37 PID 2476 wrote to memory of 2988 2476 rfrfllf.exe 37 PID 2476 wrote to memory of 2988 2476 rfrfllf.exe 37 PID 2476 wrote to memory of 2988 2476 rfrfllf.exe 37 PID 2988 wrote to memory of 2488 2988 dvpvp.exe 38 PID 2988 wrote to memory of 2488 2988 dvpvp.exe 38 PID 2988 wrote to memory of 2488 2988 dvpvp.exe 38 PID 2988 wrote to memory of 2488 2988 dvpvp.exe 38 PID 2488 wrote to memory of 448 2488 3ffxllr.exe 39 PID 2488 wrote to memory of 448 2488 3ffxllr.exe 39 PID 2488 wrote to memory of 448 2488 3ffxllr.exe 39 PID 2488 wrote to memory of 448 2488 3ffxllr.exe 39 PID 448 wrote to memory of 2408 448 hbhttt.exe 40 PID 448 wrote to memory of 2408 448 hbhttt.exe 40 PID 448 wrote to memory of 2408 448 hbhttt.exe 40 PID 448 wrote to memory of 2408 448 hbhttt.exe 40 PID 2408 wrote to memory of 1704 2408 djvdp.exe 41 PID 2408 wrote to memory of 1704 2408 djvdp.exe 41 PID 2408 wrote to memory of 1704 2408 djvdp.exe 41 PID 2408 wrote to memory of 1704 2408 djvdp.exe 41 PID 1704 wrote to memory of 2032 1704 rxffrxl.exe 42 PID 1704 wrote to memory of 2032 1704 rxffrxl.exe 42 PID 1704 wrote to memory of 2032 1704 rxffrxl.exe 42 PID 1704 wrote to memory of 2032 1704 rxffrxl.exe 42 PID 2032 wrote to memory of 2288 2032 7dvdj.exe 43 PID 2032 wrote to memory of 2288 2032 7dvdj.exe 43 PID 2032 wrote to memory of 2288 2032 7dvdj.exe 43 PID 2032 wrote to memory of 2288 2032 7dvdj.exe 43 PID 2288 wrote to memory of 1764 2288 nhthtb.exe 44 PID 2288 wrote to memory of 1764 2288 nhthtb.exe 44 PID 2288 wrote to memory of 1764 2288 nhthtb.exe 44 PID 2288 wrote to memory of 1764 2288 nhthtb.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\b7465945db75ea959b66dc7340603f467bf453983faf154a6d0e7e0d8c783307.exe"C:\Users\Admin\AppData\Local\Temp\b7465945db75ea959b66dc7340603f467bf453983faf154a6d0e7e0d8c783307.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\thtttb.exec:\thtttb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\1rxfrfl.exec:\1rxfrfl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\3tnnth.exec:\3tnnth.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\ffrfrfr.exec:\ffrfrfr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\5htbht.exec:\5htbht.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\bhnntb.exec:\bhnntb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\hnbbnt.exec:\hnbbnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\rfrfllf.exec:\rfrfllf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\dvpvp.exec:\dvpvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\3ffxllr.exec:\3ffxllr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\hbhttt.exec:\hbhttt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\djvdp.exec:\djvdp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\rxffrxl.exec:\rxffrxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\7dvdj.exec:\7dvdj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\nhthtb.exec:\nhthtb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\fflrxfl.exec:\fflrxfl.exe17⤵
- Executes dropped EXE
PID:1764 -
\??\c:\9hnhbb.exec:\9hnhbb.exe18⤵
- Executes dropped EXE
PID:2188 -
\??\c:\xxxfxxl.exec:\xxxfxxl.exe19⤵
- Executes dropped EXE
PID:1900 -
\??\c:\tbbhbb.exec:\tbbhbb.exe20⤵
- Executes dropped EXE
PID:2428 -
\??\c:\1pdjv.exec:\1pdjv.exe21⤵
- Executes dropped EXE
PID:1868 -
\??\c:\rxllxff.exec:\rxllxff.exe22⤵
- Executes dropped EXE
PID:3004 -
\??\c:\hthnhb.exec:\hthnhb.exe23⤵
- Executes dropped EXE
PID:1696 -
\??\c:\ppjvj.exec:\ppjvj.exe24⤵
- Executes dropped EXE
PID:1628 -
\??\c:\ttnbtn.exec:\ttnbtn.exe25⤵
- Executes dropped EXE
PID:1804 -
\??\c:\dvdjj.exec:\dvdjj.exe26⤵
- Executes dropped EXE
PID:888 -
\??\c:\ffrxfrf.exec:\ffrxfrf.exe27⤵
- Executes dropped EXE
PID:1864 -
\??\c:\tthhhn.exec:\tthhhn.exe28⤵
- Executes dropped EXE
PID:1524 -
\??\c:\xxflflx.exec:\xxflflx.exe29⤵
- Executes dropped EXE
PID:264 -
\??\c:\ttttnt.exec:\ttttnt.exe30⤵
- Executes dropped EXE
PID:2992 -
\??\c:\vdpvp.exec:\vdpvp.exe31⤵
- Executes dropped EXE
PID:2244 -
\??\c:\xrrrrff.exec:\xrrrrff.exe32⤵
- Executes dropped EXE
PID:2336 -
\??\c:\9jjjd.exec:\9jjjd.exe33⤵
- Executes dropped EXE
PID:2260 -
\??\c:\vvvvd.exec:\vvvvd.exe34⤵
- Executes dropped EXE
PID:2160 -
\??\c:\nnnnnb.exec:\nnnnnb.exe35⤵
- Executes dropped EXE
PID:2104 -
\??\c:\hbhnth.exec:\hbhnth.exe36⤵
- Executes dropped EXE
PID:2368 -
\??\c:\djvvj.exec:\djvvj.exe37⤵
- Executes dropped EXE
PID:2268 -
\??\c:\xxrflrx.exec:\xxrflrx.exe38⤵
- Executes dropped EXE
PID:1564 -
\??\c:\ffxxfxf.exec:\ffxxfxf.exe39⤵
- Executes dropped EXE
PID:2200 -
\??\c:\tntthb.exec:\tntthb.exe40⤵
- Executes dropped EXE
PID:2628 -
\??\c:\jjjpd.exec:\jjjpd.exe41⤵
- Executes dropped EXE
PID:2660 -
\??\c:\7rxffll.exec:\7rxffll.exe42⤵
- Executes dropped EXE
PID:3008 -
\??\c:\rlxrffr.exec:\rlxrffr.exe43⤵
- Executes dropped EXE
PID:2600 -
\??\c:\nhnnth.exec:\nhnnth.exe44⤵
- Executes dropped EXE
PID:2452 -
\??\c:\ppppv.exec:\ppppv.exe45⤵
- Executes dropped EXE
PID:2688 -
\??\c:\lllrllf.exec:\lllrllf.exe46⤵
- Executes dropped EXE
PID:2860 -
\??\c:\tbtbbn.exec:\tbtbbn.exe47⤵
- Executes dropped EXE
PID:2560 -
\??\c:\3nnhhh.exec:\3nnhhh.exe48⤵
- Executes dropped EXE
PID:2456 -
\??\c:\ppvdj.exec:\ppvdj.exe49⤵
- Executes dropped EXE
PID:2568 -
\??\c:\frfxxrr.exec:\frfxxrr.exe50⤵
- Executes dropped EXE
PID:2016 -
\??\c:\5tbbhh.exec:\5tbbhh.exe51⤵
- Executes dropped EXE
PID:2956 -
\??\c:\5thbhb.exec:\5thbhb.exe52⤵
- Executes dropped EXE
PID:1600 -
\??\c:\7pvdp.exec:\7pvdp.exe53⤵
- Executes dropped EXE
PID:2028 -
\??\c:\lrxxrxl.exec:\lrxxrxl.exe54⤵
- Executes dropped EXE
PID:1036 -
\??\c:\rllllff.exec:\rllllff.exe55⤵
- Executes dropped EXE
PID:624 -
\??\c:\7htntt.exec:\7htntt.exe56⤵
- Executes dropped EXE
PID:1604 -
\??\c:\jdpvd.exec:\jdpvd.exe57⤵
- Executes dropped EXE
PID:1748 -
\??\c:\1fffxrr.exec:\1fffxrr.exe58⤵
- Executes dropped EXE
PID:2804 -
\??\c:\xxfxlrx.exec:\xxfxlrx.exe59⤵
- Executes dropped EXE
PID:1092 -
\??\c:\1bhbhh.exec:\1bhbhh.exe60⤵
- Executes dropped EXE
PID:1680 -
\??\c:\ddddj.exec:\ddddj.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1764 -
\??\c:\lffffff.exec:\lffffff.exe62⤵
- Executes dropped EXE
PID:1904 -
\??\c:\xxrxllx.exec:\xxrxllx.exe63⤵
- Executes dropped EXE
PID:1896 -
\??\c:\5hbbnt.exec:\5hbbnt.exe64⤵
- Executes dropped EXE
PID:1900 -
\??\c:\jdjjd.exec:\jdjjd.exe65⤵
- Executes dropped EXE
PID:2384 -
\??\c:\vvjpd.exec:\vvjpd.exe66⤵PID:1868
-
\??\c:\3flrxlr.exec:\3flrxlr.exe67⤵PID:1700
-
\??\c:\nnbbnn.exec:\nnbbnn.exe68⤵PID:2216
-
\??\c:\vdppj.exec:\vdppj.exe69⤵PID:2144
-
\??\c:\9lxrrxf.exec:\9lxrrxf.exe70⤵PID:1212
-
\??\c:\lrrlrxx.exec:\lrrlrxx.exe71⤵PID:2296
-
\??\c:\tbhhbt.exec:\tbhhbt.exe72⤵PID:564
-
\??\c:\pvdjv.exec:\pvdjv.exe73⤵PID:1660
-
\??\c:\xxlxxrx.exec:\xxlxxrx.exe74⤵PID:2704
-
\??\c:\rxlfrxr.exec:\rxlfrxr.exe75⤵PID:380
-
\??\c:\bbhbbt.exec:\bbhbbt.exe76⤵PID:2856
-
\??\c:\7jjpp.exec:\7jjpp.exe77⤵PID:1880
-
\??\c:\xxfllrr.exec:\xxfllrr.exe78⤵PID:2896
-
\??\c:\llffrfl.exec:\llffrfl.exe79⤵PID:2312
-
\??\c:\nntbhh.exec:\nntbhh.exe80⤵PID:1160
-
\??\c:\vpjjp.exec:\vpjjp.exe81⤵PID:1504
-
\??\c:\xxfrlrl.exec:\xxfrlrl.exe82⤵PID:2140
-
\??\c:\bbhhtb.exec:\bbhhtb.exe83⤵PID:2160
-
\??\c:\thbbbn.exec:\thbbbn.exe84⤵PID:1264
-
\??\c:\9pjjp.exec:\9pjjp.exe85⤵PID:2368
-
\??\c:\frflflr.exec:\frflflr.exe86⤵PID:832
-
\??\c:\1nbbtb.exec:\1nbbtb.exe87⤵PID:2308
-
\??\c:\1nbhhn.exec:\1nbhhn.exe88⤵PID:3060
-
\??\c:\5vdvv.exec:\5vdvv.exe89⤵PID:2596
-
\??\c:\llxrffl.exec:\llxrffl.exe90⤵PID:2652
-
\??\c:\tnnntt.exec:\tnnntt.exe91⤵PID:2572
-
\??\c:\hhhhnb.exec:\hhhhnb.exe92⤵PID:2640
-
\??\c:\ppdvp.exec:\ppdvp.exe93⤵PID:2548
-
\??\c:\rlxxfxl.exec:\rlxxfxl.exe94⤵PID:2584
-
\??\c:\lrfxrxf.exec:\lrfxrxf.exe95⤵PID:2740
-
\??\c:\3hntbh.exec:\3hntbh.exe96⤵PID:2512
-
\??\c:\jjppp.exec:\jjppp.exe97⤵PID:1932
-
\??\c:\pjdvv.exec:\pjdvv.exe98⤵PID:2112
-
\??\c:\3lxxffl.exec:\3lxxffl.exe99⤵PID:2988
-
\??\c:\bhttnn.exec:\bhttnn.exe100⤵PID:440
-
\??\c:\5ddvd.exec:\5ddvd.exe101⤵PID:2284
-
\??\c:\lrfrxxl.exec:\lrfrxxl.exe102⤵PID:1420
-
\??\c:\fffxffl.exec:\fffxffl.exe103⤵PID:836
-
\??\c:\nhbtbb.exec:\nhbtbb.exe104⤵PID:2932
-
\??\c:\jvpdp.exec:\jvpdp.exe105⤵PID:2796
-
\??\c:\pjddj.exec:\pjddj.exe106⤵PID:1888
-
\??\c:\xflrrxf.exec:\xflrrxf.exe107⤵PID:1168
-
\??\c:\hbbhhb.exec:\hbbhhb.exe108⤵PID:2228
-
\??\c:\tbnhnn.exec:\tbnhnn.exe109⤵PID:1908
-
\??\c:\9pvdd.exec:\9pvdd.exe110⤵PID:2188
-
\??\c:\jvddj.exec:\jvddj.exe111⤵PID:1992
-
\??\c:\7lrlrrr.exec:\7lrlrrr.exe112⤵PID:1944
-
\??\c:\9hthnt.exec:\9hthnt.exe113⤵PID:2196
-
\??\c:\nthtbh.exec:\nthtbh.exe114⤵PID:2180
-
\??\c:\ddjvj.exec:\ddjvj.exe115⤵PID:2012
-
\??\c:\xxxxfxf.exec:\xxxxfxf.exe116⤵PID:1672
-
\??\c:\1lffrff.exec:\1lffrff.exe117⤵PID:1596
-
\??\c:\btbbhh.exec:\btbbhh.exe118⤵PID:552
-
\??\c:\jdjjv.exec:\jdjjv.exe119⤵PID:1804
-
\??\c:\vvvjj.exec:\vvvjj.exe120⤵PID:1820
-
\??\c:\rlxxfxx.exec:\rlxxfxx.exe121⤵PID:1796
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-