Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 02:31
Behavioral task
behavioral1
Sample
b4bfc77dc8bc28c9e760625aee7b311284165e8ff6cbd9aa23c86b0b1a0a91fc.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
b4bfc77dc8bc28c9e760625aee7b311284165e8ff6cbd9aa23c86b0b1a0a91fc.exe
-
Size
97KB
-
MD5
a694fa185bf3a19436972af5873f957b
-
SHA1
dc474ce743b570abc3f7b98a1cc03442ac6f6c5a
-
SHA256
b4bfc77dc8bc28c9e760625aee7b311284165e8ff6cbd9aa23c86b0b1a0a91fc
-
SHA512
1992b9e40a23a32e0437d2f561f380098e08d9dab3427ad492165991a8352eec8cb0d8955857d9b39f1b271e51eab8985e33c22f01d97da4b5192d7a978e43d6
-
SSDEEP
3072:8hOmTsF93UYfwC6GIout0fmCiiiXA6mzgR4:8cm4FmowdHoSgWrXUgC
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 56 IoCs
resource yara_rule behavioral1/memory/2588-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1248-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1920-23-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2008-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2884-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2880-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1792-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2912-80-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2912-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2680-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2312-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1928-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3028-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2336-121-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1856-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2956-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2112-147-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/760-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2492-176-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/1772-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/756-210-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1952-236-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1952-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2144-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1748-255-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1952-237-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2512-269-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2320-281-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2320-282-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1428-288-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2196-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2196-300-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2888-306-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2800-318-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2872-342-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2384-440-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1824-507-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/784-627-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1648-708-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2236-729-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/888-742-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/888-741-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2452-766-0x0000000000260000-0x0000000000287000-memory.dmp family_blackmoon behavioral1/memory/2452-767-0x0000000000260000-0x0000000000287000-memory.dmp family_blackmoon behavioral1/memory/2388-777-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2916-821-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/3040-826-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2916-838-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2680-844-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2664-876-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1572-887-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2304-1107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1848-6987-0x00000000775C0000-0x00000000776DF000-memory.dmp family_blackmoon behavioral1/memory/1848-7230-0x00000000774C0000-0x00000000775BA000-memory.dmp family_blackmoon behavioral1/memory/1848-13814-0x00000000775C0000-0x00000000776DF000-memory.dmp family_blackmoon behavioral1/memory/1848-22306-0x00000000774C0000-0x00000000775BA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1248 jjvjj.exe 1920 084444.exe 2008 djppd.exe 2544 7htthh.exe 2884 htbbnh.exe 2880 06440.exe 1792 462600.exe 3040 c028444.exe 2912 pdddv.exe 2680 vpvvv.exe 2312 bttthb.exe 1928 20280.exe 3028 806004.exe 2336 hhnttt.exe 1856 llxrxlx.exe 2728 nbbbhb.exe 2956 k80886.exe 2112 tnhnbn.exe 760 6422888.exe 2448 3bnntt.exe 2492 64606.exe 1388 82446.exe 1984 860060.exe 1472 dpdjv.exe 1772 jpjvd.exe 756 4228822.exe 2456 nbhnnh.exe 2180 bhhtbt.exe 1952 hbhnbh.exe 2144 dpddd.exe 1748 htbbbb.exe 1036 dppjd.exe 2512 m8000.exe 2380 68884.exe 2320 bhbttn.exe 1428 02000.exe 2328 0248260.exe 2196 26888.exe 2888 vjjjd.exe 2780 lxfxfxr.exe 2800 jvpjv.exe 2868 3hbhnt.exe 3044 jpddd.exe 2704 0840628.exe 2872 5vdpj.exe 2848 8448266.exe 2528 bntbnh.exe 2748 xffxxrx.exe 2732 3vjjj.exe 2304 0244440.exe 3012 tbbbnt.exe 1656 28064.exe 3048 462842.exe 1572 e02286.exe 1064 6400628.exe 2924 q02280.exe 3008 206888.exe 1492 5rfxffl.exe 1760 e46660.exe 1056 8244022.exe 2280 s6228.exe 2232 20406.exe 2492 9ffxrrl.exe 2384 42440.exe -
resource yara_rule behavioral1/memory/2588-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2588-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000a00000001202c-5.dat upx behavioral1/memory/1248-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1248-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000001938e-16.dat upx behavioral1/memory/1920-23-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001939c-24.dat upx behavioral1/memory/2008-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000001941b-33.dat upx behavioral1/memory/2544-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2008-32-0x00000000002B0000-0x00000000002D7000-memory.dmp upx behavioral1/files/0x000600000001946b-41.dat upx behavioral1/memory/2884-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2880-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000019481-48.dat upx behavioral1/memory/2880-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000019490-58.dat upx behavioral1/memory/1792-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000194c6-65.dat upx behavioral1/files/0x000500000001a42d-73.dat upx behavioral1/memory/2912-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2680-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a467-83.dat upx behavioral1/files/0x000500000001a487-90.dat upx behavioral1/memory/2312-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a489-97.dat upx behavioral1/memory/1928-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a494-106.dat upx behavioral1/memory/3028-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a495-113.dat upx behavioral1/memory/2336-121-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4a5-122.dat upx behavioral1/memory/1856-130-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4ab-129.dat upx behavioral1/files/0x000500000001a4ad-137.dat upx behavioral1/memory/2956-145-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4af-144.dat upx behavioral1/memory/2112-147-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4b1-153.dat upx behavioral1/memory/760-160-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/760-162-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4b3-161.dat upx behavioral1/files/0x000500000001a4b5-169.dat upx behavioral1/files/0x000500000001a4b7-177.dat upx behavioral1/memory/2492-176-0x0000000000430000-0x0000000000457000-memory.dmp upx behavioral1/files/0x000800000001932a-184.dat upx behavioral1/memory/1984-191-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x000500000001a4b9-192.dat upx behavioral1/files/0x000500000001a4bb-199.dat upx behavioral1/memory/1772-206-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/756-210-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4bd-208.dat upx behavioral1/files/0x000500000001a4bf-216.dat upx behavioral1/files/0x000500000001a4c1-222.dat upx behavioral1/files/0x000500000001a4c3-229.dat upx behavioral1/memory/1952-239-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2144-242-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4c5-240.dat upx behavioral1/files/0x000500000001a4c7-247.dat upx behavioral1/files/0x000500000001a4c9-257.dat upx behavioral1/memory/1748-255-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2512-269-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2320-280-0x0000000000220000-0x0000000000247000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrfflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tttbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e46660.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrlrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 206022.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxfflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0400628.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42066.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6426600.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2588 wrote to memory of 1248 2588 b4bfc77dc8bc28c9e760625aee7b311284165e8ff6cbd9aa23c86b0b1a0a91fc.exe 30 PID 2588 wrote to memory of 1248 2588 b4bfc77dc8bc28c9e760625aee7b311284165e8ff6cbd9aa23c86b0b1a0a91fc.exe 30 PID 2588 wrote to memory of 1248 2588 b4bfc77dc8bc28c9e760625aee7b311284165e8ff6cbd9aa23c86b0b1a0a91fc.exe 30 PID 2588 wrote to memory of 1248 2588 b4bfc77dc8bc28c9e760625aee7b311284165e8ff6cbd9aa23c86b0b1a0a91fc.exe 30 PID 1248 wrote to memory of 1920 1248 jjvjj.exe 31 PID 1248 wrote to memory of 1920 1248 jjvjj.exe 31 PID 1248 wrote to memory of 1920 1248 jjvjj.exe 31 PID 1248 wrote to memory of 1920 1248 jjvjj.exe 31 PID 1920 wrote to memory of 2008 1920 084444.exe 33 PID 1920 wrote to memory of 2008 1920 084444.exe 33 PID 1920 wrote to memory of 2008 1920 084444.exe 33 PID 1920 wrote to memory of 2008 1920 084444.exe 33 PID 2008 wrote to memory of 2544 2008 djppd.exe 34 PID 2008 wrote to memory of 2544 2008 djppd.exe 34 PID 2008 wrote to memory of 2544 2008 djppd.exe 34 PID 2008 wrote to memory of 2544 2008 djppd.exe 34 PID 2544 wrote to memory of 2884 2544 7htthh.exe 35 PID 2544 wrote to memory of 2884 2544 7htthh.exe 35 PID 2544 wrote to memory of 2884 2544 7htthh.exe 35 PID 2544 wrote to memory of 2884 2544 7htthh.exe 35 PID 2884 wrote to memory of 2880 2884 htbbnh.exe 36 PID 2884 wrote to memory of 2880 2884 htbbnh.exe 36 PID 2884 wrote to memory of 2880 2884 htbbnh.exe 36 PID 2884 wrote to memory of 2880 2884 htbbnh.exe 36 PID 2880 wrote to memory of 1792 2880 06440.exe 37 PID 2880 wrote to memory of 1792 2880 06440.exe 37 PID 2880 wrote to memory of 1792 2880 06440.exe 37 PID 2880 wrote to memory of 1792 2880 06440.exe 37 PID 1792 wrote to memory of 3040 1792 462600.exe 38 PID 1792 wrote to memory of 3040 1792 462600.exe 38 PID 1792 wrote to memory of 3040 1792 462600.exe 38 PID 1792 wrote to memory of 3040 1792 462600.exe 38 PID 3040 wrote to memory of 2912 3040 c028444.exe 39 PID 3040 wrote to memory of 2912 3040 c028444.exe 39 PID 3040 wrote to memory of 2912 3040 c028444.exe 39 PID 3040 wrote to memory of 2912 3040 c028444.exe 39 PID 2912 wrote to memory of 2680 2912 pdddv.exe 40 PID 2912 wrote to memory of 2680 2912 pdddv.exe 40 PID 2912 wrote to memory of 2680 2912 pdddv.exe 40 PID 2912 wrote to memory of 2680 2912 pdddv.exe 40 PID 2680 wrote to memory of 2312 2680 vpvvv.exe 41 PID 2680 wrote to memory of 2312 2680 vpvvv.exe 41 PID 2680 wrote to memory of 2312 2680 vpvvv.exe 41 PID 2680 wrote to memory of 2312 2680 vpvvv.exe 41 PID 2312 wrote to memory of 1928 2312 bttthb.exe 42 PID 2312 wrote to memory of 1928 2312 bttthb.exe 42 PID 2312 wrote to memory of 1928 2312 bttthb.exe 42 PID 2312 wrote to memory of 1928 2312 bttthb.exe 42 PID 1928 wrote to memory of 3028 1928 20280.exe 43 PID 1928 wrote to memory of 3028 1928 20280.exe 43 PID 1928 wrote to memory of 3028 1928 20280.exe 43 PID 1928 wrote to memory of 3028 1928 20280.exe 43 PID 3028 wrote to memory of 2336 3028 806004.exe 44 PID 3028 wrote to memory of 2336 3028 806004.exe 44 PID 3028 wrote to memory of 2336 3028 806004.exe 44 PID 3028 wrote to memory of 2336 3028 806004.exe 44 PID 2336 wrote to memory of 1856 2336 hhnttt.exe 45 PID 2336 wrote to memory of 1856 2336 hhnttt.exe 45 PID 2336 wrote to memory of 1856 2336 hhnttt.exe 45 PID 2336 wrote to memory of 1856 2336 hhnttt.exe 45 PID 1856 wrote to memory of 2728 1856 llxrxlx.exe 46 PID 1856 wrote to memory of 2728 1856 llxrxlx.exe 46 PID 1856 wrote to memory of 2728 1856 llxrxlx.exe 46 PID 1856 wrote to memory of 2728 1856 llxrxlx.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\b4bfc77dc8bc28c9e760625aee7b311284165e8ff6cbd9aa23c86b0b1a0a91fc.exe"C:\Users\Admin\AppData\Local\Temp\b4bfc77dc8bc28c9e760625aee7b311284165e8ff6cbd9aa23c86b0b1a0a91fc.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\jjvjj.exec:\jjvjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
\??\c:\084444.exec:\084444.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\djppd.exec:\djppd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\7htthh.exec:\7htthh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\htbbnh.exec:\htbbnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\06440.exec:\06440.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\462600.exec:\462600.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\c028444.exec:\c028444.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\pdddv.exec:\pdddv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\vpvvv.exec:\vpvvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\bttthb.exec:\bttthb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\20280.exec:\20280.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\806004.exec:\806004.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\hhnttt.exec:\hhnttt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\llxrxlx.exec:\llxrxlx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
\??\c:\nbbbhb.exec:\nbbbhb.exe17⤵
- Executes dropped EXE
PID:2728 -
\??\c:\k80886.exec:\k80886.exe18⤵
- Executes dropped EXE
PID:2956 -
\??\c:\tnhnbn.exec:\tnhnbn.exe19⤵
- Executes dropped EXE
PID:2112 -
\??\c:\6422888.exec:\6422888.exe20⤵
- Executes dropped EXE
PID:760 -
\??\c:\3bnntt.exec:\3bnntt.exe21⤵
- Executes dropped EXE
PID:2448 -
\??\c:\64606.exec:\64606.exe22⤵
- Executes dropped EXE
PID:2492 -
\??\c:\82446.exec:\82446.exe23⤵
- Executes dropped EXE
PID:1388 -
\??\c:\860060.exec:\860060.exe24⤵
- Executes dropped EXE
PID:1984 -
\??\c:\dpdjv.exec:\dpdjv.exe25⤵
- Executes dropped EXE
PID:1472 -
\??\c:\jpjvd.exec:\jpjvd.exe26⤵
- Executes dropped EXE
PID:1772 -
\??\c:\4228822.exec:\4228822.exe27⤵
- Executes dropped EXE
PID:756 -
\??\c:\nbhnnh.exec:\nbhnnh.exe28⤵
- Executes dropped EXE
PID:2456 -
\??\c:\bhhtbt.exec:\bhhtbt.exe29⤵
- Executes dropped EXE
PID:2180 -
\??\c:\hbhnbh.exec:\hbhnbh.exe30⤵
- Executes dropped EXE
PID:1952 -
\??\c:\dpddd.exec:\dpddd.exe31⤵
- Executes dropped EXE
PID:2144 -
\??\c:\htbbbb.exec:\htbbbb.exe32⤵
- Executes dropped EXE
PID:1748 -
\??\c:\dppjd.exec:\dppjd.exe33⤵
- Executes dropped EXE
PID:1036 -
\??\c:\m8000.exec:\m8000.exe34⤵
- Executes dropped EXE
PID:2512 -
\??\c:\68884.exec:\68884.exe35⤵
- Executes dropped EXE
PID:2380 -
\??\c:\bhbttn.exec:\bhbttn.exe36⤵
- Executes dropped EXE
PID:2320 -
\??\c:\02000.exec:\02000.exe37⤵
- Executes dropped EXE
PID:1428 -
\??\c:\0248260.exec:\0248260.exe38⤵
- Executes dropped EXE
PID:2328 -
\??\c:\26888.exec:\26888.exe39⤵
- Executes dropped EXE
PID:2196 -
\??\c:\vjjjd.exec:\vjjjd.exe40⤵
- Executes dropped EXE
PID:2888 -
\??\c:\lxfxfxr.exec:\lxfxfxr.exe41⤵
- Executes dropped EXE
PID:2780 -
\??\c:\jvpjv.exec:\jvpjv.exe42⤵
- Executes dropped EXE
PID:2800 -
\??\c:\3hbhnt.exec:\3hbhnt.exe43⤵
- Executes dropped EXE
PID:2868 -
\??\c:\jpddd.exec:\jpddd.exe44⤵
- Executes dropped EXE
PID:3044 -
\??\c:\0840628.exec:\0840628.exe45⤵
- Executes dropped EXE
PID:2704 -
\??\c:\5vdpj.exec:\5vdpj.exe46⤵
- Executes dropped EXE
PID:2872 -
\??\c:\8448266.exec:\8448266.exe47⤵
- Executes dropped EXE
PID:2848 -
\??\c:\bntbnh.exec:\bntbnh.exe48⤵
- Executes dropped EXE
PID:2528 -
\??\c:\xffxxrx.exec:\xffxxrx.exe49⤵
- Executes dropped EXE
PID:2748 -
\??\c:\3vjjj.exec:\3vjjj.exe50⤵
- Executes dropped EXE
PID:2732 -
\??\c:\0244440.exec:\0244440.exe51⤵
- Executes dropped EXE
PID:2304 -
\??\c:\tbbbnt.exec:\tbbbnt.exe52⤵
- Executes dropped EXE
PID:3012 -
\??\c:\28064.exec:\28064.exe53⤵
- Executes dropped EXE
PID:1656 -
\??\c:\462842.exec:\462842.exe54⤵
- Executes dropped EXE
PID:3048 -
\??\c:\e02286.exec:\e02286.exe55⤵
- Executes dropped EXE
PID:1572 -
\??\c:\6400628.exec:\6400628.exe56⤵
- Executes dropped EXE
PID:1064 -
\??\c:\q02280.exec:\q02280.exe57⤵
- Executes dropped EXE
PID:2924 -
\??\c:\206888.exec:\206888.exe58⤵
- Executes dropped EXE
PID:3008 -
\??\c:\5rfxffl.exec:\5rfxffl.exe59⤵
- Executes dropped EXE
PID:1492 -
\??\c:\e46660.exec:\e46660.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1760 -
\??\c:\8244022.exec:\8244022.exe61⤵
- Executes dropped EXE
PID:1056 -
\??\c:\s6228.exec:\s6228.exe62⤵
- Executes dropped EXE
PID:2280 -
\??\c:\20406.exec:\20406.exe63⤵
- Executes dropped EXE
PID:2232 -
\??\c:\9ffxrrl.exec:\9ffxrrl.exe64⤵
- Executes dropped EXE
PID:2492 -
\??\c:\42440.exec:\42440.exe65⤵
- Executes dropped EXE
PID:2384 -
\??\c:\pdjjj.exec:\pdjjj.exe66⤵PID:2068
-
\??\c:\frxrrff.exec:\frxrrff.exe67⤵PID:908
-
\??\c:\20666.exec:\20666.exe68⤵PID:268
-
\??\c:\820022.exec:\820022.exe69⤵PID:2148
-
\??\c:\xllxfxf.exec:\xllxfxf.exe70⤵PID:1524
-
\??\c:\s8806.exec:\s8806.exe71⤵PID:2456
-
\??\c:\pdjjj.exec:\pdjjj.exe72⤵PID:2180
-
\??\c:\tbnhhb.exec:\tbnhhb.exe73⤵PID:2132
-
\??\c:\42884.exec:\42884.exe74⤵PID:1952
-
\??\c:\htbbhh.exec:\htbbhh.exe75⤵PID:1340
-
\??\c:\rlrlfxx.exec:\rlrlfxx.exe76⤵PID:2040
-
\??\c:\q66048.exec:\q66048.exe77⤵PID:536
-
\??\c:\bhbttn.exec:\bhbttn.exe78⤵PID:1824
-
\??\c:\jvpdv.exec:\jvpdv.exe79⤵PID:628
-
\??\c:\022204.exec:\022204.exe80⤵PID:840
-
\??\c:\5rllrrx.exec:\5rllrrx.exe81⤵PID:2308
-
\??\c:\dpvjj.exec:\dpvjj.exe82⤵PID:1216
-
\??\c:\0240288.exec:\0240288.exe83⤵PID:292
-
\??\c:\bnthnh.exec:\bnthnh.exe84⤵PID:2496
-
\??\c:\08840.exec:\08840.exe85⤵PID:2328
-
\??\c:\dpvvd.exec:\dpvvd.exe86⤵PID:2876
-
\??\c:\dvjjj.exec:\dvjjj.exe87⤵PID:2804
-
\??\c:\86660.exec:\86660.exe88⤵PID:2780
-
\??\c:\pjddp.exec:\pjddp.exe89⤵PID:2892
-
\??\c:\46820.exec:\46820.exe90⤵PID:2972
-
\??\c:\pdvjj.exec:\pdvjj.exe91⤵PID:2212
-
\??\c:\i000048.exec:\i000048.exe92⤵PID:2788
-
\??\c:\xrrlrxf.exec:\xrrlrxf.exe93⤵PID:2676
-
\??\c:\5hnnth.exec:\5hnnth.exe94⤵PID:2692
-
\??\c:\s4064.exec:\s4064.exe95⤵PID:2296
-
\??\c:\1djjj.exec:\1djjj.exe96⤵PID:2528
-
\??\c:\208840.exec:\208840.exe97⤵PID:2748
-
\??\c:\hbtbnh.exec:\hbtbnh.exe98⤵PID:2732
-
\??\c:\08626.exec:\08626.exe99⤵PID:1660
-
\??\c:\vjpjv.exec:\vjpjv.exe100⤵PID:1652
-
\??\c:\pdpjd.exec:\pdpjd.exe101⤵PID:784
-
\??\c:\xrlxlrl.exec:\xrlxlrl.exe102⤵PID:1856
-
\??\c:\k28682.exec:\k28682.exe103⤵PID:2948
-
\??\c:\9pvdd.exec:\9pvdd.exe104⤵PID:2960
-
\??\c:\428888.exec:\428888.exe105⤵PID:1740
-
\??\c:\c448422.exec:\c448422.exe106⤵PID:1144
-
\??\c:\jjpvd.exec:\jjpvd.exe107⤵PID:2284
-
\??\c:\462260.exec:\462260.exe108⤵PID:2244
-
\??\c:\8622462.exec:\8622462.exe109⤵PID:2480
-
\??\c:\0800044.exec:\0800044.exe110⤵PID:1080
-
\??\c:\k48800.exec:\k48800.exe111⤵PID:2344
-
\??\c:\htbtbt.exec:\htbtbt.exe112⤵PID:1964
-
\??\c:\thntbb.exec:\thntbb.exe113⤵PID:2772
-
\??\c:\nbnbtt.exec:\nbnbtt.exe114⤵PID:1132
-
\??\c:\1jjpv.exec:\1jjpv.exe115⤵PID:1752
-
\??\c:\o244222.exec:\o244222.exe116⤵PID:1672
-
\??\c:\thtnth.exec:\thtnth.exe117⤵PID:1648
-
\??\c:\0800606.exec:\0800606.exe118⤵PID:356
-
\??\c:\dvvdd.exec:\dvvdd.exe119⤵PID:2520
-
\??\c:\60666.exec:\60666.exe120⤵PID:2236
-
\??\c:\dpvvp.exec:\dpvvp.exe121⤵PID:1944
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-