Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 02:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d4684fd2a758c019470a7ab0304d1c95fd7d46ad2835999ddfd73512005b080b.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
d4684fd2a758c019470a7ab0304d1c95fd7d46ad2835999ddfd73512005b080b.exe
-
Size
454KB
-
MD5
dceda32400d74a54b38b53f27a6f6c7d
-
SHA1
88036c9f9540e57d5122e5e5a061e30469fd9485
-
SHA256
d4684fd2a758c019470a7ab0304d1c95fd7d46ad2835999ddfd73512005b080b
-
SHA512
3f9d4c9d00d9a270bfbf968506dda101c4697a961cd40dd52a700799a6b859acadfcafe7a0e389c4ad2b1da6240498f6352fbd57550af5dcecd09607236cd78d
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbea:q7Tc2NYHUrAwfMp3CDa
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 51 IoCs
resource yara_rule behavioral1/memory/2512-2-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2304-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-74-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2780-72-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2704-83-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2568-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-92-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/1488-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1252-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1252-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1488-112-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2844-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-148-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2624-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-163-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2716-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2132-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1632-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-222-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/872-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2368-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2012-281-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/904-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2296-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2312-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-366-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2592-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2088-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-500-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1876-514-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-651-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1572-660-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/576-671-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2076-865-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2076-890-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2540-946-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1112-1000-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1620-1275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1940-1332-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1984-1369-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2304 flffrfl.exe 2616 9nnnbn.exe 2628 jdvdj.exe 2684 dvvpp.exe 2736 5lflxlx.exe 2888 3thhbh.exe 2780 nhhntb.exe 2704 jjvpp.exe 2568 thnthn.exe 2988 1lfllrr.exe 1488 9nhhth.exe 1252 thbtbh.exe 1880 ttnbnt.exe 1620 nhbhnb.exe 2844 dvpjv.exe 2624 9tthtb.exe 2872 jdvjp.exe 2960 5rrffrx.exe 2132 jppjj.exe 2716 flxrrxl.exe 2136 hbbtnb.exe 1632 bttbtb.exe 3016 1hbhtb.exe 1636 xfrfrfx.exe 1312 ttnhbh.exe 872 jpvpj.exe 2368 lllrlrl.exe 848 tnhhhn.exe 2476 pjddp.exe 2012 pjvvp.exe 1012 7rrxlxr.exe 904 vjdjd.exe 2296 3llrfrx.exe 2876 hhbbnt.exe 2112 9pdjp.exe 2836 dddjv.exe 2692 xrflrlr.exe 2312 hbthtb.exe 2372 dvjdp.exe 2848 lxrfxfx.exe 1772 flrflff.exe 2564 btnnbh.exe 2668 3dpjp.exe 2592 ffflfrr.exe 2992 thhbbh.exe 2088 djvjp.exe 2988 vddvp.exe 2288 xrfxflr.exe 1380 tnhbnb.exe 1780 bttbtb.exe 2604 jdvjv.exe 1880 lffrffl.exe 1928 ttntnh.exe 2844 bthntb.exe 1376 vpjpp.exe 2024 lllrfrf.exe 2968 frxfrxl.exe 2960 9tbnnt.exe 3004 3ddjp.exe 2132 xxllxfr.exe 856 lrxfxrx.exe 2156 bhtnbn.exe 2920 vvvdv.exe 792 rxxlflx.exe -
resource yara_rule behavioral1/memory/2512-2-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-92-0x00000000005C0000-0x00000000005EA000-memory.dmp upx behavioral1/memory/1488-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1252-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1252-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1488-112-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2844-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/872-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/904-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1880-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1928-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1876-507-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1876-514-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-575-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-637-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-802-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-851-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-927-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-946-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1368-959-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-997-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-1059-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-1120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/636-1242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1640-1249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-1275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-1313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-1376-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rfllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tnbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrfrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxlflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lfrlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tnhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2512 wrote to memory of 2304 2512 d4684fd2a758c019470a7ab0304d1c95fd7d46ad2835999ddfd73512005b080b.exe 31 PID 2512 wrote to memory of 2304 2512 d4684fd2a758c019470a7ab0304d1c95fd7d46ad2835999ddfd73512005b080b.exe 31 PID 2512 wrote to memory of 2304 2512 d4684fd2a758c019470a7ab0304d1c95fd7d46ad2835999ddfd73512005b080b.exe 31 PID 2512 wrote to memory of 2304 2512 d4684fd2a758c019470a7ab0304d1c95fd7d46ad2835999ddfd73512005b080b.exe 31 PID 2304 wrote to memory of 2616 2304 flffrfl.exe 32 PID 2304 wrote to memory of 2616 2304 flffrfl.exe 32 PID 2304 wrote to memory of 2616 2304 flffrfl.exe 32 PID 2304 wrote to memory of 2616 2304 flffrfl.exe 32 PID 2616 wrote to memory of 2628 2616 9nnnbn.exe 33 PID 2616 wrote to memory of 2628 2616 9nnnbn.exe 33 PID 2616 wrote to memory of 2628 2616 9nnnbn.exe 33 PID 2616 wrote to memory of 2628 2616 9nnnbn.exe 33 PID 2628 wrote to memory of 2684 2628 jdvdj.exe 34 PID 2628 wrote to memory of 2684 2628 jdvdj.exe 34 PID 2628 wrote to memory of 2684 2628 jdvdj.exe 34 PID 2628 wrote to memory of 2684 2628 jdvdj.exe 34 PID 2684 wrote to memory of 2736 2684 dvvpp.exe 35 PID 2684 wrote to memory of 2736 2684 dvvpp.exe 35 PID 2684 wrote to memory of 2736 2684 dvvpp.exe 35 PID 2684 wrote to memory of 2736 2684 dvvpp.exe 35 PID 2736 wrote to memory of 2888 2736 5lflxlx.exe 36 PID 2736 wrote to memory of 2888 2736 5lflxlx.exe 36 PID 2736 wrote to memory of 2888 2736 5lflxlx.exe 36 PID 2736 wrote to memory of 2888 2736 5lflxlx.exe 36 PID 2888 wrote to memory of 2780 2888 3thhbh.exe 37 PID 2888 wrote to memory of 2780 2888 3thhbh.exe 37 PID 2888 wrote to memory of 2780 2888 3thhbh.exe 37 PID 2888 wrote to memory of 2780 2888 3thhbh.exe 37 PID 2780 wrote to memory of 2704 2780 nhhntb.exe 38 PID 2780 wrote to memory of 2704 2780 nhhntb.exe 38 PID 2780 wrote to memory of 2704 2780 nhhntb.exe 38 PID 2780 wrote to memory of 2704 2780 nhhntb.exe 38 PID 2704 wrote to memory of 2568 2704 jjvpp.exe 39 PID 2704 wrote to memory of 2568 2704 jjvpp.exe 39 PID 2704 wrote to memory of 2568 2704 jjvpp.exe 39 PID 2704 wrote to memory of 2568 2704 jjvpp.exe 39 PID 2568 wrote to memory of 2988 2568 thnthn.exe 40 PID 2568 wrote to memory of 2988 2568 thnthn.exe 40 PID 2568 wrote to memory of 2988 2568 thnthn.exe 40 PID 2568 wrote to memory of 2988 2568 thnthn.exe 40 PID 2988 wrote to memory of 1488 2988 1lfllrr.exe 41 PID 2988 wrote to memory of 1488 2988 1lfllrr.exe 41 PID 2988 wrote to memory of 1488 2988 1lfllrr.exe 41 PID 2988 wrote to memory of 1488 2988 1lfllrr.exe 41 PID 1488 wrote to memory of 1252 1488 9nhhth.exe 42 PID 1488 wrote to memory of 1252 1488 9nhhth.exe 42 PID 1488 wrote to memory of 1252 1488 9nhhth.exe 42 PID 1488 wrote to memory of 1252 1488 9nhhth.exe 42 PID 1252 wrote to memory of 1880 1252 thbtbh.exe 43 PID 1252 wrote to memory of 1880 1252 thbtbh.exe 43 PID 1252 wrote to memory of 1880 1252 thbtbh.exe 43 PID 1252 wrote to memory of 1880 1252 thbtbh.exe 43 PID 1880 wrote to memory of 1620 1880 ttnbnt.exe 44 PID 1880 wrote to memory of 1620 1880 ttnbnt.exe 44 PID 1880 wrote to memory of 1620 1880 ttnbnt.exe 44 PID 1880 wrote to memory of 1620 1880 ttnbnt.exe 44 PID 1620 wrote to memory of 2844 1620 nhbhnb.exe 45 PID 1620 wrote to memory of 2844 1620 nhbhnb.exe 45 PID 1620 wrote to memory of 2844 1620 nhbhnb.exe 45 PID 1620 wrote to memory of 2844 1620 nhbhnb.exe 45 PID 2844 wrote to memory of 2624 2844 dvpjv.exe 46 PID 2844 wrote to memory of 2624 2844 dvpjv.exe 46 PID 2844 wrote to memory of 2624 2844 dvpjv.exe 46 PID 2844 wrote to memory of 2624 2844 dvpjv.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4684fd2a758c019470a7ab0304d1c95fd7d46ad2835999ddfd73512005b080b.exe"C:\Users\Admin\AppData\Local\Temp\d4684fd2a758c019470a7ab0304d1c95fd7d46ad2835999ddfd73512005b080b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\flffrfl.exec:\flffrfl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\9nnnbn.exec:\9nnnbn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\jdvdj.exec:\jdvdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\dvvpp.exec:\dvvpp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\5lflxlx.exec:\5lflxlx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\3thhbh.exec:\3thhbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\nhhntb.exec:\nhhntb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\jjvpp.exec:\jjvpp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\thnthn.exec:\thnthn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\1lfllrr.exec:\1lfllrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\9nhhth.exec:\9nhhth.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\thbtbh.exec:\thbtbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\ttnbnt.exec:\ttnbnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\nhbhnb.exec:\nhbhnb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\dvpjv.exec:\dvpjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\9tthtb.exec:\9tthtb.exe17⤵
- Executes dropped EXE
PID:2624 -
\??\c:\jdvjp.exec:\jdvjp.exe18⤵
- Executes dropped EXE
PID:2872 -
\??\c:\5rrffrx.exec:\5rrffrx.exe19⤵
- Executes dropped EXE
PID:2960 -
\??\c:\jppjj.exec:\jppjj.exe20⤵
- Executes dropped EXE
PID:2132 -
\??\c:\flxrrxl.exec:\flxrrxl.exe21⤵
- Executes dropped EXE
PID:2716 -
\??\c:\hbbtnb.exec:\hbbtnb.exe22⤵
- Executes dropped EXE
PID:2136 -
\??\c:\bttbtb.exec:\bttbtb.exe23⤵
- Executes dropped EXE
PID:1632 -
\??\c:\1hbhtb.exec:\1hbhtb.exe24⤵
- Executes dropped EXE
PID:3016 -
\??\c:\xfrfrfx.exec:\xfrfrfx.exe25⤵
- Executes dropped EXE
PID:1636 -
\??\c:\ttnhbh.exec:\ttnhbh.exe26⤵
- Executes dropped EXE
PID:1312 -
\??\c:\jpvpj.exec:\jpvpj.exe27⤵
- Executes dropped EXE
PID:872 -
\??\c:\lllrlrl.exec:\lllrlrl.exe28⤵
- Executes dropped EXE
PID:2368 -
\??\c:\tnhhhn.exec:\tnhhhn.exe29⤵
- Executes dropped EXE
PID:848 -
\??\c:\pjddp.exec:\pjddp.exe30⤵
- Executes dropped EXE
PID:2476 -
\??\c:\pjvvp.exec:\pjvvp.exe31⤵
- Executes dropped EXE
PID:2012 -
\??\c:\7rrxlxr.exec:\7rrxlxr.exe32⤵
- Executes dropped EXE
PID:1012 -
\??\c:\vjdjd.exec:\vjdjd.exe33⤵
- Executes dropped EXE
PID:904 -
\??\c:\3llrfrx.exec:\3llrfrx.exe34⤵
- Executes dropped EXE
PID:2296 -
\??\c:\hhbbnt.exec:\hhbbnt.exe35⤵
- Executes dropped EXE
PID:2876 -
\??\c:\9pdjp.exec:\9pdjp.exe36⤵
- Executes dropped EXE
PID:2112 -
\??\c:\dddjv.exec:\dddjv.exe37⤵
- Executes dropped EXE
PID:2836 -
\??\c:\xrflrlr.exec:\xrflrlr.exe38⤵
- Executes dropped EXE
PID:2692 -
\??\c:\hbthtb.exec:\hbthtb.exe39⤵
- Executes dropped EXE
PID:2312 -
\??\c:\dvjdp.exec:\dvjdp.exe40⤵
- Executes dropped EXE
PID:2372 -
\??\c:\lxrfxfx.exec:\lxrfxfx.exe41⤵
- Executes dropped EXE
PID:2848 -
\??\c:\flrflff.exec:\flrflff.exe42⤵
- Executes dropped EXE
PID:1772 -
\??\c:\btnnbh.exec:\btnnbh.exe43⤵
- Executes dropped EXE
PID:2564 -
\??\c:\3dpjp.exec:\3dpjp.exe44⤵
- Executes dropped EXE
PID:2668 -
\??\c:\ffflfrr.exec:\ffflfrr.exe45⤵
- Executes dropped EXE
PID:2592 -
\??\c:\thhbbh.exec:\thhbbh.exe46⤵
- Executes dropped EXE
PID:2992 -
\??\c:\djvjp.exec:\djvjp.exe47⤵
- Executes dropped EXE
PID:2088 -
\??\c:\vddvp.exec:\vddvp.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2988 -
\??\c:\xrfxflr.exec:\xrfxflr.exe49⤵
- Executes dropped EXE
PID:2288 -
\??\c:\tnhbnb.exec:\tnhbnb.exe50⤵
- Executes dropped EXE
PID:1380 -
\??\c:\bttbtb.exec:\bttbtb.exe51⤵
- Executes dropped EXE
PID:1780 -
\??\c:\jdvjv.exec:\jdvjv.exe52⤵
- Executes dropped EXE
PID:2604 -
\??\c:\lffrffl.exec:\lffrffl.exe53⤵
- Executes dropped EXE
PID:1880 -
\??\c:\ttntnh.exec:\ttntnh.exe54⤵
- Executes dropped EXE
PID:1928 -
\??\c:\bthntb.exec:\bthntb.exe55⤵
- Executes dropped EXE
PID:2844 -
\??\c:\vpjpp.exec:\vpjpp.exe56⤵
- Executes dropped EXE
PID:1376 -
\??\c:\lllrfrf.exec:\lllrfrf.exe57⤵
- Executes dropped EXE
PID:2024 -
\??\c:\frxfrxl.exec:\frxfrxl.exe58⤵
- Executes dropped EXE
PID:2968 -
\??\c:\9tbnnt.exec:\9tbnnt.exe59⤵
- Executes dropped EXE
PID:2960 -
\??\c:\3ddjp.exec:\3ddjp.exe60⤵
- Executes dropped EXE
PID:3004 -
\??\c:\xxllxfr.exec:\xxllxfr.exe61⤵
- Executes dropped EXE
PID:2132 -
\??\c:\lrxfxrx.exec:\lrxfxrx.exe62⤵
- Executes dropped EXE
PID:856 -
\??\c:\bhtnbn.exec:\bhtnbn.exe63⤵
- Executes dropped EXE
PID:2156 -
\??\c:\vvvdv.exec:\vvvdv.exe64⤵
- Executes dropped EXE
PID:2920 -
\??\c:\rxxlflx.exec:\rxxlflx.exe65⤵
- Executes dropped EXE
PID:792 -
\??\c:\rxfxxlf.exec:\rxfxxlf.exe66⤵PID:1876
-
\??\c:\9nntht.exec:\9nntht.exe67⤵PID:1636
-
\??\c:\pjddj.exec:\pjddj.exe68⤵PID:860
-
\??\c:\ddpjd.exec:\ddpjd.exe69⤵PID:2252
-
\??\c:\fllfxrl.exec:\fllfxrl.exe70⤵PID:1536
-
\??\c:\tnhtbt.exec:\tnhtbt.exe71⤵PID:1804
-
\??\c:\hhbnbh.exec:\hhbnbh.exe72⤵PID:1080
-
\??\c:\5jvvv.exec:\5jvvv.exe73⤵PID:1548
-
\??\c:\5rllxxf.exec:\5rllxxf.exe74⤵PID:2476
-
\??\c:\hnnhbn.exec:\hnnhbn.exe75⤵PID:2184
-
\??\c:\1htttt.exec:\1htttt.exe76⤵PID:2076
-
\??\c:\jjpdv.exec:\jjpdv.exe77⤵PID:2052
-
\??\c:\fxxfxfl.exec:\fxxfxfl.exe78⤵PID:2460
-
\??\c:\lfxxlxl.exec:\lfxxlxl.exe79⤵PID:1628
-
\??\c:\thhnnt.exec:\thhnnt.exe80⤵PID:2160
-
\??\c:\vpddj.exec:\vpddj.exe81⤵PID:1972
-
\??\c:\3jdvp.exec:\3jdvp.exe82⤵PID:2204
-
\??\c:\xrlxxrr.exec:\xrlxxrr.exe83⤵PID:2404
-
\??\c:\7bnbth.exec:\7bnbth.exe84⤵PID:2696
-
\??\c:\djddp.exec:\djddp.exe85⤵PID:2892
-
\??\c:\jdppv.exec:\jdppv.exe86⤵PID:1572
-
\??\c:\1rrxrrf.exec:\1rrxrrf.exe87⤵PID:2644
-
\??\c:\9hbhhh.exec:\9hbhhh.exe88⤵PID:2572
-
\??\c:\9dpvj.exec:\9dpvj.exe89⤵PID:2756
-
\??\c:\frflxfx.exec:\frflxfx.exe90⤵PID:2556
-
\??\c:\ffxfrlr.exec:\ffxfrlr.exe91⤵PID:576
-
\??\c:\ntbbth.exec:\ntbbth.exe92⤵PID:2588
-
\??\c:\ddvdp.exec:\ddvdp.exe93⤵PID:1668
-
\??\c:\rxxlflf.exec:\rxxlflf.exe94⤵
- System Location Discovery: System Language Discovery
PID:1112 -
\??\c:\lxrlfrr.exec:\lxrlfrr.exe95⤵PID:2760
-
\??\c:\9tnhnt.exec:\9tnhnt.exe96⤵PID:988
-
\??\c:\vddjv.exec:\vddjv.exe97⤵PID:1588
-
\??\c:\7lfflrf.exec:\7lfflrf.exe98⤵PID:1852
-
\??\c:\lrllllf.exec:\lrllllf.exe99⤵PID:2636
-
\??\c:\7hbbhh.exec:\7hbbhh.exe100⤵PID:1936
-
\??\c:\ppjjd.exec:\ppjjd.exe101⤵PID:1704
-
\??\c:\jdpvd.exec:\jdpvd.exe102⤵PID:3012
-
\??\c:\rrfllrf.exec:\rrfllrf.exe103⤵PID:468
-
\??\c:\thbtbb.exec:\thbtbb.exe104⤵PID:2968
-
\??\c:\ppvjj.exec:\ppvjj.exe105⤵PID:2960
-
\??\c:\jvjjp.exec:\jvjjp.exe106⤵PID:3004
-
\??\c:\fllxrfr.exec:\fllxrfr.exe107⤵PID:1672
-
\??\c:\5nhntt.exec:\5nhntt.exe108⤵PID:448
-
\??\c:\dvppd.exec:\dvppd.exe109⤵PID:1140
-
\??\c:\pjvvv.exec:\pjvvv.exe110⤵PID:1364
-
\??\c:\lfrrffl.exec:\lfrrffl.exe111⤵PID:2004
-
\??\c:\tnhnht.exec:\tnhnht.exe112⤵PID:1956
-
\??\c:\bhbhnn.exec:\bhbhnn.exe113⤵PID:1636
-
\??\c:\7jjvd.exec:\7jjvd.exe114⤵PID:1964
-
\??\c:\lfllxrf.exec:\lfllxrf.exe115⤵PID:1808
-
\??\c:\rrlxffx.exec:\rrlxffx.exe116⤵PID:1536
-
\??\c:\1hbhbh.exec:\1hbhbh.exe117⤵PID:2480
-
\??\c:\vvvdp.exec:\vvvdp.exe118⤵PID:1080
-
\??\c:\9pvpd.exec:\9pvpd.exe119⤵PID:1028
-
\??\c:\frlrxfr.exec:\frlrxfr.exe120⤵PID:2476
-
\??\c:\tnhhth.exec:\tnhhth.exe121⤵PID:1744
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-