Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 03:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c1d95313e96cdb4aff831f8aa125591a3c674ee450f3f45bd7b874f3bec0640a.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
c1d95313e96cdb4aff831f8aa125591a3c674ee450f3f45bd7b874f3bec0640a.exe
-
Size
454KB
-
MD5
c802d90048e2fb3f6ac2509681184c80
-
SHA1
6366b4a95f845a9508331b4406ff684bf7cb0848
-
SHA256
c1d95313e96cdb4aff831f8aa125591a3c674ee450f3f45bd7b874f3bec0640a
-
SHA512
b76f1802f84a95720619c35aad85ebf6b4b7b36adb04db655269f9d443eec36adbf1dc65933043b23d5806313eb6f806bce42f0896de9a1ee4190505c383966e
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeD:q7Tc2NYHUrAwfMp3CDD
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/2524-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1864-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2316-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3056-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-67-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2808-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/672-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1560-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1560-137-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1928-157-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1476-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1476-169-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1944-175-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2448-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-208-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/860-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1944-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/900-233-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1336-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1900-147-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2216-252-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2216-257-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2304-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2100-277-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1500-286-0x0000000000340000-0x000000000036A000-memory.dmp family_blackmoon behavioral1/memory/2108-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2080-345-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2860-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-364-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2780-372-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2980-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1672-407-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2020-439-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1980-446-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1620-515-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2332-560-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2332-559-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3012-574-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2624-665-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1632-678-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1692-804-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2512 3dvdp.exe 2316 9rrxfxf.exe 1864 ddjjp.exe 2236 7frxxxf.exe 3056 dpdjj.exe 2808 7lxxlrx.exe 2832 bnhhtb.exe 2728 dpjjj.exe 3020 7rxxfxf.exe 2572 htbbbt.exe 2984 vdppv.exe 672 rfllrrx.exe 1560 ttbbhb.exe 1900 3jvvd.exe 1928 9fllxxl.exe 536 rfxfxxl.exe 1476 ddjjp.exe 1944 vpjjp.exe 2880 1tnhhb.exe 2424 btnntn.exe 2448 vjddd.exe 860 1lrrffl.exe 1032 jvvvd.exe 900 rrffrrf.exe 1336 hnhtnt.exe 2216 pvdvd.exe 2304 rrxfflr.exe 2100 dvvpp.exe 1500 rlrlllr.exe 3012 3htttt.exe 2492 vppjj.exe 2500 fxlrrrx.exe 2108 hthbhb.exe 2484 hntbtn.exe 2120 7vppp.exe 2276 llrrrrx.exe 2080 nhntbh.exe 2908 xrfflxf.exe 2860 lfllrfl.exe 2708 9thhnh.exe 2780 pdppv.exe 2828 3dvdj.exe 2568 fflxffl.exe 2976 3hhbbb.exe 2980 5pppv.exe 1672 3vjdd.exe 2992 fxllrff.exe 1180 hnbbbh.exe 1596 5djjp.exe 2460 rlxflrx.exe 2020 lxfxffl.exe 1980 1thnnh.exe 380 5jvvd.exe 1792 3dpvj.exe 1524 lfxlrxl.exe 2192 rrlrxff.exe 2504 nhtttt.exe 1480 vvjpp.exe 1588 lfrrllx.exe 448 xrfxrrx.exe 1472 bnbttn.exe 664 pdjdd.exe 1620 7dpjp.exe 560 3lrrrrx.exe -
resource yara_rule behavioral1/memory/2524-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1864-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/672-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/672-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1560-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1476-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1032-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/860-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1336-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1500-286-0x0000000000340000-0x000000000036A000-memory.dmp upx behavioral1/memory/2108-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-345-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2860-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-372-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2980-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-446-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-472-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-515-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-560-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1976-587-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2108-595-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-626-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-665-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-678-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1692-804-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-817-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-843-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lfflfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrrflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrxxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxfxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrflxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rrrfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrffffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bntnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xllrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxxrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxlllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrrfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxfrrx.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2524 wrote to memory of 2512 2524 c1d95313e96cdb4aff831f8aa125591a3c674ee450f3f45bd7b874f3bec0640a.exe 30 PID 2524 wrote to memory of 2512 2524 c1d95313e96cdb4aff831f8aa125591a3c674ee450f3f45bd7b874f3bec0640a.exe 30 PID 2524 wrote to memory of 2512 2524 c1d95313e96cdb4aff831f8aa125591a3c674ee450f3f45bd7b874f3bec0640a.exe 30 PID 2524 wrote to memory of 2512 2524 c1d95313e96cdb4aff831f8aa125591a3c674ee450f3f45bd7b874f3bec0640a.exe 30 PID 2512 wrote to memory of 2316 2512 3dvdp.exe 31 PID 2512 wrote to memory of 2316 2512 3dvdp.exe 31 PID 2512 wrote to memory of 2316 2512 3dvdp.exe 31 PID 2512 wrote to memory of 2316 2512 3dvdp.exe 31 PID 2316 wrote to memory of 1864 2316 9rrxfxf.exe 32 PID 2316 wrote to memory of 1864 2316 9rrxfxf.exe 32 PID 2316 wrote to memory of 1864 2316 9rrxfxf.exe 32 PID 2316 wrote to memory of 1864 2316 9rrxfxf.exe 32 PID 1864 wrote to memory of 2236 1864 ddjjp.exe 33 PID 1864 wrote to memory of 2236 1864 ddjjp.exe 33 PID 1864 wrote to memory of 2236 1864 ddjjp.exe 33 PID 1864 wrote to memory of 2236 1864 ddjjp.exe 33 PID 2236 wrote to memory of 3056 2236 7frxxxf.exe 34 PID 2236 wrote to memory of 3056 2236 7frxxxf.exe 34 PID 2236 wrote to memory of 3056 2236 7frxxxf.exe 34 PID 2236 wrote to memory of 3056 2236 7frxxxf.exe 34 PID 3056 wrote to memory of 2808 3056 dpdjj.exe 35 PID 3056 wrote to memory of 2808 3056 dpdjj.exe 35 PID 3056 wrote to memory of 2808 3056 dpdjj.exe 35 PID 3056 wrote to memory of 2808 3056 dpdjj.exe 35 PID 2808 wrote to memory of 2832 2808 7lxxlrx.exe 36 PID 2808 wrote to memory of 2832 2808 7lxxlrx.exe 36 PID 2808 wrote to memory of 2832 2808 7lxxlrx.exe 36 PID 2808 wrote to memory of 2832 2808 7lxxlrx.exe 36 PID 2832 wrote to memory of 2728 2832 bnhhtb.exe 37 PID 2832 wrote to memory of 2728 2832 bnhhtb.exe 37 PID 2832 wrote to memory of 2728 2832 bnhhtb.exe 37 PID 2832 wrote to memory of 2728 2832 bnhhtb.exe 37 PID 2728 wrote to memory of 3020 2728 dpjjj.exe 38 PID 2728 wrote to memory of 3020 2728 dpjjj.exe 38 PID 2728 wrote to memory of 3020 2728 dpjjj.exe 38 PID 2728 wrote to memory of 3020 2728 dpjjj.exe 38 PID 3020 wrote to memory of 2572 3020 7rxxfxf.exe 39 PID 3020 wrote to memory of 2572 3020 7rxxfxf.exe 39 PID 3020 wrote to memory of 2572 3020 7rxxfxf.exe 39 PID 3020 wrote to memory of 2572 3020 7rxxfxf.exe 39 PID 2572 wrote to memory of 2984 2572 htbbbt.exe 40 PID 2572 wrote to memory of 2984 2572 htbbbt.exe 40 PID 2572 wrote to memory of 2984 2572 htbbbt.exe 40 PID 2572 wrote to memory of 2984 2572 htbbbt.exe 40 PID 2984 wrote to memory of 672 2984 vdppv.exe 41 PID 2984 wrote to memory of 672 2984 vdppv.exe 41 PID 2984 wrote to memory of 672 2984 vdppv.exe 41 PID 2984 wrote to memory of 672 2984 vdppv.exe 41 PID 672 wrote to memory of 1560 672 rfllrrx.exe 42 PID 672 wrote to memory of 1560 672 rfllrrx.exe 42 PID 672 wrote to memory of 1560 672 rfllrrx.exe 42 PID 672 wrote to memory of 1560 672 rfllrrx.exe 42 PID 1560 wrote to memory of 1900 1560 ttbbhb.exe 43 PID 1560 wrote to memory of 1900 1560 ttbbhb.exe 43 PID 1560 wrote to memory of 1900 1560 ttbbhb.exe 43 PID 1560 wrote to memory of 1900 1560 ttbbhb.exe 43 PID 1900 wrote to memory of 1928 1900 3jvvd.exe 44 PID 1900 wrote to memory of 1928 1900 3jvvd.exe 44 PID 1900 wrote to memory of 1928 1900 3jvvd.exe 44 PID 1900 wrote to memory of 1928 1900 3jvvd.exe 44 PID 1928 wrote to memory of 536 1928 9fllxxl.exe 45 PID 1928 wrote to memory of 536 1928 9fllxxl.exe 45 PID 1928 wrote to memory of 536 1928 9fllxxl.exe 45 PID 1928 wrote to memory of 536 1928 9fllxxl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\c1d95313e96cdb4aff831f8aa125591a3c674ee450f3f45bd7b874f3bec0640a.exe"C:\Users\Admin\AppData\Local\Temp\c1d95313e96cdb4aff831f8aa125591a3c674ee450f3f45bd7b874f3bec0640a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\3dvdp.exec:\3dvdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\9rrxfxf.exec:\9rrxfxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\ddjjp.exec:\ddjjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\7frxxxf.exec:\7frxxxf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\dpdjj.exec:\dpdjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\7lxxlrx.exec:\7lxxlrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\bnhhtb.exec:\bnhhtb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\dpjjj.exec:\dpjjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\7rxxfxf.exec:\7rxxfxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\htbbbt.exec:\htbbbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\vdppv.exec:\vdppv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\rfllrrx.exec:\rfllrrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:672 -
\??\c:\ttbbhb.exec:\ttbbhb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\3jvvd.exec:\3jvvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\9fllxxl.exec:\9fllxxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\rfxfxxl.exec:\rfxfxxl.exe17⤵
- Executes dropped EXE
PID:536 -
\??\c:\ddjjp.exec:\ddjjp.exe18⤵
- Executes dropped EXE
PID:1476 -
\??\c:\vpjjp.exec:\vpjjp.exe19⤵
- Executes dropped EXE
PID:1944 -
\??\c:\1tnhhb.exec:\1tnhhb.exe20⤵
- Executes dropped EXE
PID:2880 -
\??\c:\btnntn.exec:\btnntn.exe21⤵
- Executes dropped EXE
PID:2424 -
\??\c:\vjddd.exec:\vjddd.exe22⤵
- Executes dropped EXE
PID:2448 -
\??\c:\1lrrffl.exec:\1lrrffl.exe23⤵
- Executes dropped EXE
PID:860 -
\??\c:\jvvvd.exec:\jvvvd.exe24⤵
- Executes dropped EXE
PID:1032 -
\??\c:\rrffrrf.exec:\rrffrrf.exe25⤵
- Executes dropped EXE
PID:900 -
\??\c:\hnhtnt.exec:\hnhtnt.exe26⤵
- Executes dropped EXE
PID:1336 -
\??\c:\pvdvd.exec:\pvdvd.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2216 -
\??\c:\rrxfflr.exec:\rrxfflr.exe28⤵
- Executes dropped EXE
PID:2304 -
\??\c:\dvvpp.exec:\dvvpp.exe29⤵
- Executes dropped EXE
PID:2100 -
\??\c:\rlrlllr.exec:\rlrlllr.exe30⤵
- Executes dropped EXE
PID:1500 -
\??\c:\3htttt.exec:\3htttt.exe31⤵
- Executes dropped EXE
PID:3012 -
\??\c:\vppjj.exec:\vppjj.exe32⤵
- Executes dropped EXE
PID:2492 -
\??\c:\fxlrrrx.exec:\fxlrrrx.exe33⤵
- Executes dropped EXE
PID:2500 -
\??\c:\hthbhb.exec:\hthbhb.exe34⤵
- Executes dropped EXE
PID:2108 -
\??\c:\hntbtn.exec:\hntbtn.exe35⤵
- Executes dropped EXE
PID:2484 -
\??\c:\7vppp.exec:\7vppp.exe36⤵
- Executes dropped EXE
PID:2120 -
\??\c:\llrrrrx.exec:\llrrrrx.exe37⤵
- Executes dropped EXE
PID:2276 -
\??\c:\nhntbh.exec:\nhntbh.exe38⤵
- Executes dropped EXE
PID:2080 -
\??\c:\xrfflxf.exec:\xrfflxf.exe39⤵
- Executes dropped EXE
PID:2908 -
\??\c:\lfllrfl.exec:\lfllrfl.exe40⤵
- Executes dropped EXE
PID:2860 -
\??\c:\9thhnh.exec:\9thhnh.exe41⤵
- Executes dropped EXE
PID:2708 -
\??\c:\pdppv.exec:\pdppv.exe42⤵
- Executes dropped EXE
PID:2780 -
\??\c:\3dvdj.exec:\3dvdj.exe43⤵
- Executes dropped EXE
PID:2828 -
\??\c:\fflxffl.exec:\fflxffl.exe44⤵
- Executes dropped EXE
PID:2568 -
\??\c:\3hhbbb.exec:\3hhbbb.exe45⤵
- Executes dropped EXE
PID:2976 -
\??\c:\5pppv.exec:\5pppv.exe46⤵
- Executes dropped EXE
PID:2980 -
\??\c:\3vjdd.exec:\3vjdd.exe47⤵
- Executes dropped EXE
PID:1672 -
\??\c:\fxllrff.exec:\fxllrff.exe48⤵
- Executes dropped EXE
PID:2992 -
\??\c:\hnbbbh.exec:\hnbbbh.exe49⤵
- Executes dropped EXE
PID:1180 -
\??\c:\5djjp.exec:\5djjp.exe50⤵
- Executes dropped EXE
PID:1596 -
\??\c:\rlxflrx.exec:\rlxflrx.exe51⤵
- Executes dropped EXE
PID:2460 -
\??\c:\lxfxffl.exec:\lxfxffl.exe52⤵
- Executes dropped EXE
PID:2020 -
\??\c:\1thnnh.exec:\1thnnh.exe53⤵
- Executes dropped EXE
PID:1980 -
\??\c:\5jvvd.exec:\5jvvd.exe54⤵
- Executes dropped EXE
PID:380 -
\??\c:\3dpvj.exec:\3dpvj.exe55⤵
- Executes dropped EXE
PID:1792 -
\??\c:\lfxlrxl.exec:\lfxlrxl.exe56⤵
- Executes dropped EXE
PID:1524 -
\??\c:\rrlrxff.exec:\rrlrxff.exe57⤵
- Executes dropped EXE
PID:2192 -
\??\c:\nhtttt.exec:\nhtttt.exe58⤵
- Executes dropped EXE
PID:2504 -
\??\c:\vvjpp.exec:\vvjpp.exe59⤵
- Executes dropped EXE
PID:1480 -
\??\c:\lfrrllx.exec:\lfrrllx.exe60⤵
- Executes dropped EXE
PID:1588 -
\??\c:\xrfxrrx.exec:\xrfxrrx.exe61⤵
- Executes dropped EXE
PID:448 -
\??\c:\bnbttn.exec:\bnbttn.exe62⤵
- Executes dropped EXE
PID:1472 -
\??\c:\pdjdd.exec:\pdjdd.exe63⤵
- Executes dropped EXE
PID:664 -
\??\c:\7dpjp.exec:\7dpjp.exe64⤵
- Executes dropped EXE
PID:1620 -
\??\c:\3lrrrrx.exec:\3lrrrrx.exe65⤵
- Executes dropped EXE
PID:560 -
\??\c:\xrxxxrx.exec:\xrxxxrx.exe66⤵PID:2360
-
\??\c:\3nttnn.exec:\3nttnn.exe67⤵PID:2820
-
\??\c:\5dppp.exec:\5dppp.exe68⤵PID:2952
-
\??\c:\pvddv.exec:\pvddv.exe69⤵PID:3048
-
\??\c:\xrxfxxx.exec:\xrxfxxx.exe70⤵PID:2956
-
\??\c:\nbnhbb.exec:\nbnhbb.exe71⤵PID:2332
-
\??\c:\dpjjp.exec:\dpjjp.exe72⤵PID:884
-
\??\c:\vvvvd.exec:\vvvvd.exe73⤵PID:3012
-
\??\c:\5xlrxxf.exec:\5xlrxxf.exe74⤵PID:2524
-
\??\c:\rrfrffl.exec:\rrfrffl.exe75⤵PID:1976
-
\??\c:\bthntt.exec:\bthntt.exe76⤵PID:1812
-
\??\c:\7djdv.exec:\7djdv.exe77⤵PID:2108
-
\??\c:\rlfffff.exec:\rlfffff.exe78⤵PID:2380
-
\??\c:\rrrlfxf.exec:\rrrlfxf.exe79⤵PID:2120
-
\??\c:\bbbhnb.exec:\bbbhnb.exe80⤵PID:2284
-
\??\c:\ddddp.exec:\ddddp.exe81⤵PID:2676
-
\??\c:\5fxllxl.exec:\5fxllxl.exe82⤵PID:2796
-
\??\c:\fxllrrx.exec:\fxllrrx.exe83⤵PID:2812
-
\??\c:\nbtbnh.exec:\nbtbnh.exe84⤵PID:2412
-
\??\c:\dvjpd.exec:\dvjpd.exe85⤵PID:1708
-
\??\c:\5rfxfll.exec:\5rfxfll.exe86⤵PID:2188
-
\??\c:\htbbbt.exec:\htbbbt.exe87⤵PID:2624
-
\??\c:\bnbbbt.exec:\bnbbbt.exe88⤵PID:2680
-
\??\c:\vpjpv.exec:\vpjpv.exe89⤵PID:1632
-
\??\c:\frffllr.exec:\frffllr.exe90⤵PID:1672
-
\??\c:\1xllrlr.exec:\1xllrlr.exe91⤵PID:2992
-
\??\c:\hthhtt.exec:\hthhtt.exe92⤵PID:1176
-
\??\c:\7jddj.exec:\7jddj.exe93⤵PID:1648
-
\??\c:\pdpjv.exec:\pdpjv.exe94⤵PID:1076
-
\??\c:\fxxxrrx.exec:\fxxxrrx.exe95⤵PID:356
-
\??\c:\7ntnbh.exec:\7ntnbh.exe96⤵PID:1388
-
\??\c:\3hnhbb.exec:\3hnhbb.exe97⤵PID:2012
-
\??\c:\jppdj.exec:\jppdj.exe98⤵PID:1644
-
\??\c:\lrfxrlr.exec:\lrfxrlr.exe99⤵PID:2636
-
\??\c:\hntthn.exec:\hntthn.exe100⤵PID:2788
-
\??\c:\tnbnbn.exec:\tnbnbn.exe101⤵PID:2136
-
\??\c:\3jppd.exec:\3jppd.exe102⤵
- System Location Discovery: System Language Discovery
PID:2864 -
\??\c:\flflllx.exec:\flflllx.exe103⤵PID:2432
-
\??\c:\3rflrll.exec:\3rflrll.exe104⤵PID:848
-
\??\c:\nbhnnh.exec:\nbhnnh.exe105⤵PID:1848
-
\??\c:\pvpjv.exec:\pvpjv.exe106⤵PID:1144
-
\??\c:\dpdpv.exec:\dpdpv.exe107⤵PID:1656
-
\??\c:\lfrrxrr.exec:\lfrrxrr.exe108⤵PID:1788
-
\??\c:\tthtnn.exec:\tthtnn.exe109⤵PID:1692
-
\??\c:\hbtbhh.exec:\hbtbhh.exe110⤵PID:2940
-
\??\c:\dvdvj.exec:\dvdvj.exe111⤵PID:1960
-
\??\c:\fxllrfr.exec:\fxllrfr.exe112⤵
- System Location Discovery: System Language Discovery
PID:2100 -
\??\c:\nbnntt.exec:\nbnntt.exe113⤵PID:2956
-
\??\c:\thhhhh.exec:\thhhhh.exe114⤵PID:2332
-
\??\c:\vpvvd.exec:\vpvvd.exe115⤵
- System Location Discovery: System Language Discovery
PID:2516 -
\??\c:\rlrrlll.exec:\rlrrlll.exe116⤵PID:1600
-
\??\c:\9lflrrr.exec:\9lflrrr.exe117⤵PID:2060
-
\??\c:\thnhnn.exec:\thnhnn.exe118⤵PID:2328
-
\??\c:\vjddj.exec:\vjddj.exe119⤵PID:1800
-
\??\c:\5jvvd.exec:\5jvvd.exe120⤵PID:2056
-
\??\c:\frrfxrr.exec:\frrfxrr.exe121⤵PID:2764
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-