Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 02:31
Behavioral task
behavioral1
Sample
b7465945db75ea959b66dc7340603f467bf453983faf154a6d0e7e0d8c783307.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
b7465945db75ea959b66dc7340603f467bf453983faf154a6d0e7e0d8c783307.exe
-
Size
331KB
-
MD5
10303adc2ecec517d48b269f14db74e0
-
SHA1
9698a4c9e106847b3fc1af09b2392bed54030c7d
-
SHA256
b7465945db75ea959b66dc7340603f467bf453983faf154a6d0e7e0d8c783307
-
SHA512
31349210b0e5bf54111560b435c3a418b635737e3f791ea790631190af7d10db7e2f2235826af056c9e44dc8639e319adff4080cadc5331f7affc1e1000f10f0
-
SSDEEP
6144:vcm4FmowdHoStJdJIjaRleL42bL37BoTPkhu9gX5yGsTshQc8R0nxA5ij8+RC7t8:94wFHoStJdSjylh2b77BoTMA9gX59sT0
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/2308-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1632-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2480-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2972-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2628-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2680-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3004-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2480-300-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2696-348-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2624-356-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2852-380-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1608-518-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2888-545-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/692-725-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2972-566-0x0000000001B80000-0x0000000001BA7000-memory.dmp family_blackmoon behavioral1/memory/1660-478-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2676-443-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/756-432-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/524-416-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1872-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2480-299-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1524-293-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2468-275-0x0000000076D20000-0x0000000076E3F000-memory.dmp family_blackmoon behavioral1/memory/1028-268-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/336-255-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1476-252-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3012-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/444-205-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1668-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2500-181-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2500-179-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1748-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/844-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2332-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2332-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1860-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2880-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2728-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1872-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2728-1062-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1496-1073-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2468-7013-0x0000000076D20000-0x0000000076E3F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1632 dvppj.exe 2480 xrlxrrl.exe 1872 hhthbb.exe 2728 vvdpd.exe 2972 flxrxrr.exe 2628 fffrflr.exe 2880 tnhhbt.exe 1860 xrlxrxr.exe 2992 nnbbhh.exe 2680 bhtttt.exe 2332 5pddj.exe 2692 rlrxllx.exe 3028 rlffxfl.exe 2832 7tntnh.exe 2864 9ddvd.exe 844 rfxrxxl.exe 3004 nbhbnn.exe 1512 nhnnbh.exe 1748 jvppv.exe 788 3rfrffr.exe 2500 nhhnhh.exe 2568 3jjpj.exe 1668 frfrrff.exe 444 5bbnnb.exe 1984 vvjpp.exe 904 pjddv.exe 3012 nhhbnb.exe 1316 1tnnbh.exe 2584 vvjvd.exe 1476 jdpvd.exe 336 rrlxlrl.exe 1028 tnhbnh.exe 1952 1ddvj.exe 2468 7rllfxf.exe 2396 7lffxfl.exe 1524 tbbbhn.exe 2480 vppdd.exe 1872 jdvjj.exe 2728 rrlrffl.exe 2976 3btbbn.exe 2804 btnthn.exe 2648 jdjvd.exe 2256 vpjjv.exe 2788 5fxfxfl.exe 2624 rrlxfxf.exe 2696 tnntth.exe 2912 bhbbbh.exe 1272 vvpvj.exe 2672 1rlffrl.exe 2936 3xrlflr.exe 3024 bbnbhn.exe 2852 thtbnt.exe 1472 3vpdp.exe 2608 dvjjp.exe 2340 xxflrfr.exe 3044 fflrrxr.exe 2636 7tnbbb.exe 1304 bnbbtb.exe 524 9jdjv.exe 2328 jjdpd.exe 1828 llxlflx.exe 756 rlllxxl.exe 3056 xrrffrf.exe 2676 tnhnbb.exe -
resource yara_rule behavioral1/memory/2308-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2308-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000d000000015ceb-8.dat upx behavioral1/memory/1632-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015f4c-27.dat upx behavioral1/memory/2480-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016033-44.dat upx behavioral1/memory/2972-53-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000a000000016136-52.dat upx behavioral1/memory/2628-62-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000186c8-63.dat upx behavioral1/files/0x000500000001878d-70.dat upx behavioral1/memory/2680-94-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000191f3-93.dat upx behavioral1/files/0x0005000000019220-118.dat upx behavioral1/files/0x0005000000019238-126.dat upx behavioral1/files/0x000500000001925d-142.dat upx behavioral1/files/0x0005000000019263-149.dat upx behavioral1/memory/3004-148-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019278-157.dat upx behavioral1/files/0x0005000000019280-165.dat upx behavioral1/files/0x000500000001938b-172.dat upx behavioral1/files/0x0005000000019399-182.dat upx behavioral1/files/0x00050000000193b7-190.dat upx behavioral1/files/0x00050000000193d4-214.dat upx behavioral1/files/0x0005000000019441-261.dat upx behavioral1/memory/1952-269-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2480-300-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2696-348-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2624-356-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2852-380-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1608-518-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2888-545-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2628-567-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2260-600-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2848-621-0x0000000000260000-0x0000000000287000-memory.dmp upx behavioral1/memory/1984-703-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/692-725-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2584-772-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2908-826-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2900-825-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2360-844-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2884-589-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1972-524-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/1660-478-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1768-470-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2676-443-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/756-432-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/524-416-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2788-332-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1872-301-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1524-293-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2468-275-0x0000000076D20000-0x0000000076E3F000-memory.dmp upx behavioral1/memory/1028-268-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/336-255-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019436-254.dat upx behavioral1/memory/1476-252-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001941a-246.dat upx behavioral1/memory/1476-245-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019417-238.dat upx behavioral1/files/0x00050000000193ec-231.dat upx behavioral1/memory/1316-230-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3012-229-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000015d68-222.dat upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxlrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lflrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlllxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b7465945db75ea959b66dc7340603f467bf453983faf154a6d0e7e0d8c783307.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2308 wrote to memory of 1632 2308 b7465945db75ea959b66dc7340603f467bf453983faf154a6d0e7e0d8c783307.exe 31 PID 2308 wrote to memory of 1632 2308 b7465945db75ea959b66dc7340603f467bf453983faf154a6d0e7e0d8c783307.exe 31 PID 2308 wrote to memory of 1632 2308 b7465945db75ea959b66dc7340603f467bf453983faf154a6d0e7e0d8c783307.exe 31 PID 2308 wrote to memory of 1632 2308 b7465945db75ea959b66dc7340603f467bf453983faf154a6d0e7e0d8c783307.exe 31 PID 1632 wrote to memory of 2480 1632 dvppj.exe 32 PID 1632 wrote to memory of 2480 1632 dvppj.exe 32 PID 1632 wrote to memory of 2480 1632 dvppj.exe 32 PID 1632 wrote to memory of 2480 1632 dvppj.exe 32 PID 2480 wrote to memory of 1872 2480 xrlxrrl.exe 33 PID 2480 wrote to memory of 1872 2480 xrlxrrl.exe 33 PID 2480 wrote to memory of 1872 2480 xrlxrrl.exe 33 PID 2480 wrote to memory of 1872 2480 xrlxrrl.exe 33 PID 1872 wrote to memory of 2728 1872 hhthbb.exe 34 PID 1872 wrote to memory of 2728 1872 hhthbb.exe 34 PID 1872 wrote to memory of 2728 1872 hhthbb.exe 34 PID 1872 wrote to memory of 2728 1872 hhthbb.exe 34 PID 2728 wrote to memory of 2972 2728 vvdpd.exe 35 PID 2728 wrote to memory of 2972 2728 vvdpd.exe 35 PID 2728 wrote to memory of 2972 2728 vvdpd.exe 35 PID 2728 wrote to memory of 2972 2728 vvdpd.exe 35 PID 2972 wrote to memory of 2628 2972 flxrxrr.exe 36 PID 2972 wrote to memory of 2628 2972 flxrxrr.exe 36 PID 2972 wrote to memory of 2628 2972 flxrxrr.exe 36 PID 2972 wrote to memory of 2628 2972 flxrxrr.exe 36 PID 2628 wrote to memory of 2880 2628 fffrflr.exe 37 PID 2628 wrote to memory of 2880 2628 fffrflr.exe 37 PID 2628 wrote to memory of 2880 2628 fffrflr.exe 37 PID 2628 wrote to memory of 2880 2628 fffrflr.exe 37 PID 2880 wrote to memory of 1860 2880 tnhhbt.exe 122 PID 2880 wrote to memory of 1860 2880 tnhhbt.exe 122 PID 2880 wrote to memory of 1860 2880 tnhhbt.exe 122 PID 2880 wrote to memory of 1860 2880 tnhhbt.exe 122 PID 1860 wrote to memory of 2992 1860 xrlxrxr.exe 39 PID 1860 wrote to memory of 2992 1860 xrlxrxr.exe 39 PID 1860 wrote to memory of 2992 1860 xrlxrxr.exe 39 PID 1860 wrote to memory of 2992 1860 xrlxrxr.exe 39 PID 2992 wrote to memory of 2680 2992 nnbbhh.exe 40 PID 2992 wrote to memory of 2680 2992 nnbbhh.exe 40 PID 2992 wrote to memory of 2680 2992 nnbbhh.exe 40 PID 2992 wrote to memory of 2680 2992 nnbbhh.exe 40 PID 2680 wrote to memory of 2332 2680 bhtttt.exe 41 PID 2680 wrote to memory of 2332 2680 bhtttt.exe 41 PID 2680 wrote to memory of 2332 2680 bhtttt.exe 41 PID 2680 wrote to memory of 2332 2680 bhtttt.exe 41 PID 2332 wrote to memory of 2692 2332 5pddj.exe 42 PID 2332 wrote to memory of 2692 2332 5pddj.exe 42 PID 2332 wrote to memory of 2692 2332 5pddj.exe 42 PID 2332 wrote to memory of 2692 2332 5pddj.exe 42 PID 2692 wrote to memory of 3028 2692 rlrxllx.exe 43 PID 2692 wrote to memory of 3028 2692 rlrxllx.exe 43 PID 2692 wrote to memory of 3028 2692 rlrxllx.exe 43 PID 2692 wrote to memory of 3028 2692 rlrxllx.exe 43 PID 3028 wrote to memory of 2832 3028 rlffxfl.exe 44 PID 3028 wrote to memory of 2832 3028 rlffxfl.exe 44 PID 3028 wrote to memory of 2832 3028 rlffxfl.exe 44 PID 3028 wrote to memory of 2832 3028 rlffxfl.exe 44 PID 2832 wrote to memory of 2864 2832 7tntnh.exe 45 PID 2832 wrote to memory of 2864 2832 7tntnh.exe 45 PID 2832 wrote to memory of 2864 2832 7tntnh.exe 45 PID 2832 wrote to memory of 2864 2832 7tntnh.exe 45 PID 2864 wrote to memory of 844 2864 9ddvd.exe 46 PID 2864 wrote to memory of 844 2864 9ddvd.exe 46 PID 2864 wrote to memory of 844 2864 9ddvd.exe 46 PID 2864 wrote to memory of 844 2864 9ddvd.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\b7465945db75ea959b66dc7340603f467bf453983faf154a6d0e7e0d8c783307.exe"C:\Users\Admin\AppData\Local\Temp\b7465945db75ea959b66dc7340603f467bf453983faf154a6d0e7e0d8c783307.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\dvppj.exec:\dvppj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\xrlxrrl.exec:\xrlxrrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\hhthbb.exec:\hhthbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\vvdpd.exec:\vvdpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\flxrxrr.exec:\flxrxrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\fffrflr.exec:\fffrflr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\tnhhbt.exec:\tnhhbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\xrlxrxr.exec:\xrlxrxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\nnbbhh.exec:\nnbbhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\bhtttt.exec:\bhtttt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\5pddj.exec:\5pddj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\rlrxllx.exec:\rlrxllx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\rlffxfl.exec:\rlffxfl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\7tntnh.exec:\7tntnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\9ddvd.exec:\9ddvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\rfxrxxl.exec:\rfxrxxl.exe17⤵
- Executes dropped EXE
PID:844 -
\??\c:\nbhbnn.exec:\nbhbnn.exe18⤵
- Executes dropped EXE
PID:3004 -
\??\c:\nhnnbh.exec:\nhnnbh.exe19⤵
- Executes dropped EXE
PID:1512 -
\??\c:\jvppv.exec:\jvppv.exe20⤵
- Executes dropped EXE
PID:1748 -
\??\c:\3rfrffr.exec:\3rfrffr.exe21⤵
- Executes dropped EXE
PID:788 -
\??\c:\nhhnhh.exec:\nhhnhh.exe22⤵
- Executes dropped EXE
PID:2500 -
\??\c:\3jjpj.exec:\3jjpj.exe23⤵
- Executes dropped EXE
PID:2568 -
\??\c:\frfrrff.exec:\frfrrff.exe24⤵
- Executes dropped EXE
PID:1668 -
\??\c:\5bbnnb.exec:\5bbnnb.exe25⤵
- Executes dropped EXE
PID:444 -
\??\c:\vvjpp.exec:\vvjpp.exe26⤵
- Executes dropped EXE
PID:1984 -
\??\c:\pjddv.exec:\pjddv.exe27⤵
- Executes dropped EXE
PID:904 -
\??\c:\nhhbnb.exec:\nhhbnb.exe28⤵
- Executes dropped EXE
PID:3012 -
\??\c:\1tnnbh.exec:\1tnnbh.exe29⤵
- Executes dropped EXE
PID:1316 -
\??\c:\vvjvd.exec:\vvjvd.exe30⤵
- Executes dropped EXE
PID:2584 -
\??\c:\jdpvd.exec:\jdpvd.exe31⤵
- Executes dropped EXE
PID:1476 -
\??\c:\rrlxlrl.exec:\rrlxlrl.exe32⤵
- Executes dropped EXE
PID:336 -
\??\c:\tnhbnh.exec:\tnhbnh.exe33⤵
- Executes dropped EXE
PID:1028 -
\??\c:\1ddvj.exec:\1ddvj.exe34⤵
- Executes dropped EXE
PID:1952 -
\??\c:\7rllfxf.exec:\7rllfxf.exe35⤵
- Executes dropped EXE
PID:2468 -
\??\c:\3lfxflf.exec:\3lfxflf.exe36⤵PID:1972
-
\??\c:\7lffxfl.exec:\7lffxfl.exe37⤵
- Executes dropped EXE
PID:2396 -
\??\c:\tbbbhn.exec:\tbbbhn.exe38⤵
- Executes dropped EXE
PID:1524 -
\??\c:\vppdd.exec:\vppdd.exe39⤵
- Executes dropped EXE
PID:2480 -
\??\c:\jdvjj.exec:\jdvjj.exe40⤵
- Executes dropped EXE
PID:1872 -
\??\c:\rrlrffl.exec:\rrlrffl.exe41⤵
- Executes dropped EXE
PID:2728 -
\??\c:\3btbbn.exec:\3btbbn.exe42⤵
- Executes dropped EXE
PID:2976 -
\??\c:\btnthn.exec:\btnthn.exe43⤵
- Executes dropped EXE
PID:2804 -
\??\c:\jdjvd.exec:\jdjvd.exe44⤵
- Executes dropped EXE
PID:2648 -
\??\c:\vpjjv.exec:\vpjjv.exe45⤵
- Executes dropped EXE
PID:2256 -
\??\c:\5fxfxfl.exec:\5fxfxfl.exe46⤵
- Executes dropped EXE
PID:2788 -
\??\c:\rrlxfxf.exec:\rrlxfxf.exe47⤵
- Executes dropped EXE
PID:2624 -
\??\c:\tnntth.exec:\tnntth.exe48⤵
- Executes dropped EXE
PID:2696 -
\??\c:\bhbbbh.exec:\bhbbbh.exe49⤵
- Executes dropped EXE
PID:2912 -
\??\c:\vvpvj.exec:\vvpvj.exe50⤵
- Executes dropped EXE
PID:1272 -
\??\c:\1rlffrl.exec:\1rlffrl.exe51⤵
- Executes dropped EXE
PID:2672 -
\??\c:\3xrlflr.exec:\3xrlflr.exe52⤵
- Executes dropped EXE
PID:2936 -
\??\c:\bbnbhn.exec:\bbnbhn.exe53⤵
- Executes dropped EXE
PID:3024 -
\??\c:\thtbnt.exec:\thtbnt.exe54⤵
- Executes dropped EXE
PID:2852 -
\??\c:\3vpdp.exec:\3vpdp.exe55⤵
- Executes dropped EXE
PID:1472 -
\??\c:\dvjjp.exec:\dvjjp.exe56⤵
- Executes dropped EXE
PID:2608 -
\??\c:\xxflrfr.exec:\xxflrfr.exe57⤵
- Executes dropped EXE
PID:2340 -
\??\c:\fflrrxr.exec:\fflrrxr.exe58⤵
- Executes dropped EXE
PID:3044 -
\??\c:\7tnbbb.exec:\7tnbbb.exe59⤵
- Executes dropped EXE
PID:2636 -
\??\c:\bnbbtb.exec:\bnbbtb.exe60⤵
- Executes dropped EXE
PID:1304 -
\??\c:\9jdjv.exec:\9jdjv.exe61⤵
- Executes dropped EXE
PID:524 -
\??\c:\jjdpd.exec:\jjdpd.exe62⤵
- Executes dropped EXE
PID:2328 -
\??\c:\llxlflx.exec:\llxlflx.exe63⤵
- Executes dropped EXE
PID:1828 -
\??\c:\rlllxxl.exec:\rlllxxl.exe64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:756 -
\??\c:\xrrffrf.exec:\xrrffrf.exe65⤵
- Executes dropped EXE
PID:3056 -
\??\c:\tnhnbb.exec:\tnhnbb.exe66⤵
- Executes dropped EXE
PID:2676 -
\??\c:\hbntnh.exec:\hbntnh.exe67⤵PID:1668
-
\??\c:\dvpdp.exec:\dvpdp.exe68⤵PID:328
-
\??\c:\jjjpd.exec:\jjjpd.exe69⤵PID:860
-
\??\c:\ffxxxll.exec:\ffxxxll.exe70⤵PID:1660
-
\??\c:\3htthh.exec:\3htthh.exe71⤵PID:692
-
\??\c:\5hhhnt.exec:\5hhhnt.exe72⤵PID:1768
-
\??\c:\tnnthn.exec:\tnnthn.exe73⤵PID:272
-
\??\c:\ddpvj.exec:\ddpvj.exe74⤵PID:2540
-
\??\c:\vpdjp.exec:\vpdjp.exe75⤵PID:1144
-
\??\c:\rlflxfx.exec:\rlflxfx.exe76⤵PID:2148
-
\??\c:\1lllrxl.exec:\1lllrxl.exe77⤵PID:292
-
\??\c:\nhbhtt.exec:\nhbhtt.exe78⤵PID:1976
-
\??\c:\tttnnt.exec:\tttnnt.exe79⤵PID:1356
-
\??\c:\jjpvd.exec:\jjpvd.exe80⤵PID:1608
-
\??\c:\vppvd.exec:\vppvd.exe81⤵PID:1972
-
\??\c:\xrxrxfl.exec:\xrxrxfl.exe82⤵PID:1392
-
\??\c:\5frrxrx.exec:\5frrxrx.exe83⤵PID:2284
-
\??\c:\btbhhh.exec:\btbhhh.exe84⤵PID:1524
-
\??\c:\ttbbhn.exec:\ttbbhn.exe85⤵PID:2888
-
\??\c:\htnttb.exec:\htnttb.exe86⤵PID:492
-
\??\c:\vvpvv.exec:\vvpvv.exe87⤵PID:2056
-
\??\c:\1rrxffl.exec:\1rrxffl.exe88⤵PID:2052
-
\??\c:\xrlrxfl.exec:\xrlrxfl.exe89⤵PID:2972
-
\??\c:\1rlrxfl.exec:\1rlrxfl.exe90⤵PID:2628
-
\??\c:\bbttnt.exec:\bbttnt.exe91⤵PID:2724
-
\??\c:\5bnbtt.exec:\5bnbtt.exe92⤵PID:2740
-
\??\c:\1vjjj.exec:\1vjjj.exe93⤵PID:1860
-
\??\c:\7vpjj.exec:\7vpjj.exe94⤵PID:2884
-
\??\c:\lxfxfll.exec:\lxfxfll.exe95⤵PID:2916
-
\??\c:\rlxlrff.exec:\rlxlrff.exe96⤵PID:2260
-
\??\c:\nhnntt.exec:\nhnntt.exe97⤵PID:2952
-
\??\c:\1hbntt.exec:\1hbntt.exe98⤵PID:2964
-
\??\c:\dvdjj.exec:\dvdjj.exe99⤵PID:2848
-
\??\c:\pdpjp.exec:\pdpjp.exe100⤵PID:1936
-
\??\c:\fflrlxf.exec:\fflrlxf.exe101⤵PID:2668
-
\??\c:\7xfllrf.exec:\7xfllrf.exe102⤵PID:1560
-
\??\c:\5rxflfr.exec:\5rxflfr.exe103⤵PID:1472
-
\??\c:\nhnbhh.exec:\nhnbhh.exe104⤵PID:2608
-
\??\c:\hbntnh.exec:\hbntnh.exe105⤵PID:2340
-
\??\c:\jdvdp.exec:\jdvdp.exe106⤵PID:1924
-
\??\c:\7jdjd.exec:\7jdjd.exe107⤵PID:3032
-
\??\c:\pjpjd.exec:\pjpjd.exe108⤵PID:1752
-
\??\c:\lffrxlf.exec:\lffrxlf.exe109⤵PID:2016
-
\??\c:\thbntb.exec:\thbntb.exe110⤵PID:680
-
\??\c:\hbthnt.exec:\hbthnt.exe111⤵PID:2116
-
\??\c:\7hbttn.exec:\7hbttn.exe112⤵PID:2420
-
\??\c:\jdvvj.exec:\jdvvj.exe113⤵PID:404
-
\??\c:\pjdjv.exec:\pjdjv.exe114⤵PID:2072
-
\??\c:\rlfxfxf.exec:\rlfxfxf.exe115⤵PID:1724
-
\??\c:\xrffrrx.exec:\xrffrrx.exe116⤵PID:1984
-
\??\c:\1ntbhh.exec:\1ntbhh.exe117⤵PID:2600
-
\??\c:\5nnnhn.exec:\5nnnhn.exe118⤵PID:1660
-
\??\c:\7vvjp.exec:\7vvjp.exe119⤵PID:692
-
\??\c:\1vppj.exec:\1vppj.exe120⤵PID:2384
-
\??\c:\xxlxrxx.exec:\xxlxrxx.exe121⤵PID:272
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-