Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 04:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d209fbe4bb040e7677634a5daaf4c32c8294811ccfae1ae6ed73ee88c9937f06.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
d209fbe4bb040e7677634a5daaf4c32c8294811ccfae1ae6ed73ee88c9937f06.exe
-
Size
454KB
-
MD5
0162ba193f4475d9b9a1a039efc11ef7
-
SHA1
33f480b203f23096feb996097c1033589ebbf8b7
-
SHA256
d209fbe4bb040e7677634a5daaf4c32c8294811ccfae1ae6ed73ee88c9937f06
-
SHA512
0a9885636a38f43c5f93935fd18ac6e8a4be1c2f9b100086a269dfbb678effe4b8fa0df4183e0585e52f7325ec293316cf53e5c3551aab749033ab52541ab4c8
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbez:q7Tc2NYHUrAwfMp3CDz
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 57 IoCs
resource yara_rule behavioral1/memory/1152-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2160-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1768-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1812-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2468-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1836-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/832-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1052-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1872-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-182-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2416-209-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1840-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2428-252-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2428-254-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/868-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1348-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2160-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1768-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1580-311-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2384-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2384-325-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2760-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-349-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2712-363-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/3068-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-460-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2060-488-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1136-495-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1540-508-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1480-587-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2492-589-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-626-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-703-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-735-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1808-771-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/988-804-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/988-830-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1264-843-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-850-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2396-851-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2740-855-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2720-910-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2180-983-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/3008-1018-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/1120-1059-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1348-1072-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2740-1119-0x0000000001C60000-0x0000000001C8A000-memory.dmp family_blackmoon behavioral1/memory/2956-1267-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1808-1293-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/776-1306-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2160 lfxfffl.exe 1768 xrflrxl.exe 1812 1pdpd.exe 2784 1llrlxr.exe 2704 btbhnh.exe 2864 vpjpv.exe 2468 hbnthn.exe 2872 btbbnn.exe 2764 jjjvv.exe 2608 5thhbb.exe 1836 vpdvj.exe 2308 jdppv.exe 1472 htbbnn.exe 1052 xxllfrr.exe 832 5tbhtt.exe 2668 ppppj.exe 1872 fxfrlrx.exe 1988 rffrrfx.exe 2908 lxxlffr.exe 2952 hhhttb.exe 2236 pvpvd.exe 2416 rffxffl.exe 1856 jdvdj.exe 1904 htnnhh.exe 636 jjdpj.exe 1840 xrfxxxl.exe 2428 pppdd.exe 2464 rrfrlxr.exe 868 bthhth.exe 1348 dvddp.exe 1620 nhtbnn.exe 2160 7fflrrf.exe 1768 5nnthn.exe 1580 ffffxfx.exe 2380 3llfxrx.exe 2384 5htntb.exe 2804 vvpvp.exe 2824 rlllrrx.exe 2724 hnnbbn.exe 2760 bnbbhh.exe 2476 jjdpj.exe 2712 xlfflll.exe 2596 ttnnbn.exe 2628 tbthth.exe 3068 ppdjv.exe 2640 xrfrxxl.exe 704 xlflxfr.exe 664 bbthtb.exe 2892 pjvvp.exe 2156 9dddj.exe 2868 1fxffll.exe 2100 ttthtb.exe 2792 dddjj.exe 1896 dvpvd.exe 2000 rfxxfxl.exe 2912 hbthhh.exe 2924 9pjvd.exe 2940 jjdjd.exe 2140 llflllx.exe 2188 ntnbnt.exe 2060 7btbtn.exe 1136 pppdp.exe 2916 rllxfll.exe 1540 btnhnn.exe -
resource yara_rule behavioral1/memory/1152-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1768-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1812-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1836-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1052-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/832-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1052-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1872-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1840-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1840-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/868-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1348-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1768-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1136-495-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1540-508-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2680-551-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1480-587-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2492-589-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-626-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-639-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-646-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-665-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2108-703-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-728-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-791-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1264-843-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-850-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2740-852-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-878-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-910-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-1002-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2272-1003-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1120-1059-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-1094-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-1119-0x0000000001C60000-0x0000000001C8A000-memory.dmp upx behavioral1/memory/1792-1198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-1247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-1266-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2956-1267-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/776-1306-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2856-1362-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ppvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xxrrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbthnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xxxffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfffllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttthtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbthhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flflxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfflrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1152 wrote to memory of 2160 1152 d209fbe4bb040e7677634a5daaf4c32c8294811ccfae1ae6ed73ee88c9937f06.exe 30 PID 1152 wrote to memory of 2160 1152 d209fbe4bb040e7677634a5daaf4c32c8294811ccfae1ae6ed73ee88c9937f06.exe 30 PID 1152 wrote to memory of 2160 1152 d209fbe4bb040e7677634a5daaf4c32c8294811ccfae1ae6ed73ee88c9937f06.exe 30 PID 1152 wrote to memory of 2160 1152 d209fbe4bb040e7677634a5daaf4c32c8294811ccfae1ae6ed73ee88c9937f06.exe 30 PID 2160 wrote to memory of 1768 2160 lfxfffl.exe 31 PID 2160 wrote to memory of 1768 2160 lfxfffl.exe 31 PID 2160 wrote to memory of 1768 2160 lfxfffl.exe 31 PID 2160 wrote to memory of 1768 2160 lfxfffl.exe 31 PID 1768 wrote to memory of 1812 1768 xrflrxl.exe 32 PID 1768 wrote to memory of 1812 1768 xrflrxl.exe 32 PID 1768 wrote to memory of 1812 1768 xrflrxl.exe 32 PID 1768 wrote to memory of 1812 1768 xrflrxl.exe 32 PID 1812 wrote to memory of 2784 1812 1pdpd.exe 33 PID 1812 wrote to memory of 2784 1812 1pdpd.exe 33 PID 1812 wrote to memory of 2784 1812 1pdpd.exe 33 PID 1812 wrote to memory of 2784 1812 1pdpd.exe 33 PID 2784 wrote to memory of 2704 2784 1llrlxr.exe 34 PID 2784 wrote to memory of 2704 2784 1llrlxr.exe 34 PID 2784 wrote to memory of 2704 2784 1llrlxr.exe 34 PID 2784 wrote to memory of 2704 2784 1llrlxr.exe 34 PID 2704 wrote to memory of 2864 2704 btbhnh.exe 35 PID 2704 wrote to memory of 2864 2704 btbhnh.exe 35 PID 2704 wrote to memory of 2864 2704 btbhnh.exe 35 PID 2704 wrote to memory of 2864 2704 btbhnh.exe 35 PID 2864 wrote to memory of 2468 2864 vpjpv.exe 36 PID 2864 wrote to memory of 2468 2864 vpjpv.exe 36 PID 2864 wrote to memory of 2468 2864 vpjpv.exe 36 PID 2864 wrote to memory of 2468 2864 vpjpv.exe 36 PID 2468 wrote to memory of 2872 2468 hbnthn.exe 37 PID 2468 wrote to memory of 2872 2468 hbnthn.exe 37 PID 2468 wrote to memory of 2872 2468 hbnthn.exe 37 PID 2468 wrote to memory of 2872 2468 hbnthn.exe 37 PID 2872 wrote to memory of 2764 2872 btbbnn.exe 38 PID 2872 wrote to memory of 2764 2872 btbbnn.exe 38 PID 2872 wrote to memory of 2764 2872 btbbnn.exe 38 PID 2872 wrote to memory of 2764 2872 btbbnn.exe 38 PID 2764 wrote to memory of 2608 2764 jjjvv.exe 39 PID 2764 wrote to memory of 2608 2764 jjjvv.exe 39 PID 2764 wrote to memory of 2608 2764 jjjvv.exe 39 PID 2764 wrote to memory of 2608 2764 jjjvv.exe 39 PID 2608 wrote to memory of 1836 2608 5thhbb.exe 40 PID 2608 wrote to memory of 1836 2608 5thhbb.exe 40 PID 2608 wrote to memory of 1836 2608 5thhbb.exe 40 PID 2608 wrote to memory of 1836 2608 5thhbb.exe 40 PID 1836 wrote to memory of 2308 1836 vpdvj.exe 41 PID 1836 wrote to memory of 2308 1836 vpdvj.exe 41 PID 1836 wrote to memory of 2308 1836 vpdvj.exe 41 PID 1836 wrote to memory of 2308 1836 vpdvj.exe 41 PID 2308 wrote to memory of 1472 2308 jdppv.exe 42 PID 2308 wrote to memory of 1472 2308 jdppv.exe 42 PID 2308 wrote to memory of 1472 2308 jdppv.exe 42 PID 2308 wrote to memory of 1472 2308 jdppv.exe 42 PID 1472 wrote to memory of 1052 1472 htbbnn.exe 43 PID 1472 wrote to memory of 1052 1472 htbbnn.exe 43 PID 1472 wrote to memory of 1052 1472 htbbnn.exe 43 PID 1472 wrote to memory of 1052 1472 htbbnn.exe 43 PID 1052 wrote to memory of 832 1052 xxllfrr.exe 44 PID 1052 wrote to memory of 832 1052 xxllfrr.exe 44 PID 1052 wrote to memory of 832 1052 xxllfrr.exe 44 PID 1052 wrote to memory of 832 1052 xxllfrr.exe 44 PID 832 wrote to memory of 2668 832 5tbhtt.exe 45 PID 832 wrote to memory of 2668 832 5tbhtt.exe 45 PID 832 wrote to memory of 2668 832 5tbhtt.exe 45 PID 832 wrote to memory of 2668 832 5tbhtt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\d209fbe4bb040e7677634a5daaf4c32c8294811ccfae1ae6ed73ee88c9937f06.exe"C:\Users\Admin\AppData\Local\Temp\d209fbe4bb040e7677634a5daaf4c32c8294811ccfae1ae6ed73ee88c9937f06.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\lfxfffl.exec:\lfxfffl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\xrflrxl.exec:\xrflrxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
\??\c:\1pdpd.exec:\1pdpd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\1llrlxr.exec:\1llrlxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\btbhnh.exec:\btbhnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\vpjpv.exec:\vpjpv.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\hbnthn.exec:\hbnthn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\btbbnn.exec:\btbbnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\jjjvv.exec:\jjjvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\5thhbb.exec:\5thhbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\vpdvj.exec:\vpdvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
\??\c:\jdppv.exec:\jdppv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\htbbnn.exec:\htbbnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
\??\c:\xxllfrr.exec:\xxllfrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
\??\c:\5tbhtt.exec:\5tbhtt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
\??\c:\ppppj.exec:\ppppj.exe17⤵
- Executes dropped EXE
PID:2668 -
\??\c:\fxfrlrx.exec:\fxfrlrx.exe18⤵
- Executes dropped EXE
PID:1872 -
\??\c:\rffrrfx.exec:\rffrrfx.exe19⤵
- Executes dropped EXE
PID:1988 -
\??\c:\lxxlffr.exec:\lxxlffr.exe20⤵
- Executes dropped EXE
PID:2908 -
\??\c:\hhhttb.exec:\hhhttb.exe21⤵
- Executes dropped EXE
PID:2952 -
\??\c:\pvpvd.exec:\pvpvd.exe22⤵
- Executes dropped EXE
PID:2236 -
\??\c:\rffxffl.exec:\rffxffl.exe23⤵
- Executes dropped EXE
PID:2416 -
\??\c:\jdvdj.exec:\jdvdj.exe24⤵
- Executes dropped EXE
PID:1856 -
\??\c:\htnnhh.exec:\htnnhh.exe25⤵
- Executes dropped EXE
PID:1904 -
\??\c:\jjdpj.exec:\jjdpj.exe26⤵
- Executes dropped EXE
PID:636 -
\??\c:\xrfxxxl.exec:\xrfxxxl.exe27⤵
- Executes dropped EXE
PID:1840 -
\??\c:\pppdd.exec:\pppdd.exe28⤵
- Executes dropped EXE
PID:2428 -
\??\c:\rrfrlxr.exec:\rrfrlxr.exe29⤵
- Executes dropped EXE
PID:2464 -
\??\c:\bthhth.exec:\bthhth.exe30⤵
- Executes dropped EXE
PID:868 -
\??\c:\dvddp.exec:\dvddp.exe31⤵
- Executes dropped EXE
PID:1348 -
\??\c:\nhtbnn.exec:\nhtbnn.exe32⤵
- Executes dropped EXE
PID:1620 -
\??\c:\7fflrrf.exec:\7fflrrf.exe33⤵
- Executes dropped EXE
PID:2160 -
\??\c:\5nnthn.exec:\5nnthn.exe34⤵
- Executes dropped EXE
PID:1768 -
\??\c:\ffffxfx.exec:\ffffxfx.exe35⤵
- Executes dropped EXE
PID:1580 -
\??\c:\3llfxrx.exec:\3llfxrx.exe36⤵
- Executes dropped EXE
PID:2380 -
\??\c:\5htntb.exec:\5htntb.exe37⤵
- Executes dropped EXE
PID:2384 -
\??\c:\vvpvp.exec:\vvpvp.exe38⤵
- Executes dropped EXE
PID:2804 -
\??\c:\rlllrrx.exec:\rlllrrx.exe39⤵
- Executes dropped EXE
PID:2824 -
\??\c:\hnnbbn.exec:\hnnbbn.exe40⤵
- Executes dropped EXE
PID:2724 -
\??\c:\bnbbhh.exec:\bnbbhh.exe41⤵
- Executes dropped EXE
PID:2760 -
\??\c:\jjdpj.exec:\jjdpj.exe42⤵
- Executes dropped EXE
PID:2476 -
\??\c:\xlfflll.exec:\xlfflll.exe43⤵
- Executes dropped EXE
PID:2712 -
\??\c:\ttnnbn.exec:\ttnnbn.exe44⤵
- Executes dropped EXE
PID:2596 -
\??\c:\tbthth.exec:\tbthth.exe45⤵
- Executes dropped EXE
PID:2628 -
\??\c:\ppdjv.exec:\ppdjv.exe46⤵
- Executes dropped EXE
PID:3068 -
\??\c:\xrfrxxl.exec:\xrfrxxl.exe47⤵
- Executes dropped EXE
PID:2640 -
\??\c:\xlflxfr.exec:\xlflxfr.exe48⤵
- Executes dropped EXE
PID:704 -
\??\c:\bbthtb.exec:\bbthtb.exe49⤵
- Executes dropped EXE
PID:664 -
\??\c:\pjvvp.exec:\pjvvp.exe50⤵
- Executes dropped EXE
PID:2892 -
\??\c:\9dddj.exec:\9dddj.exe51⤵
- Executes dropped EXE
PID:2156 -
\??\c:\1fxffll.exec:\1fxffll.exe52⤵
- Executes dropped EXE
PID:2868 -
\??\c:\ttthtb.exec:\ttthtb.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2100 -
\??\c:\dddjj.exec:\dddjj.exe54⤵
- Executes dropped EXE
PID:2792 -
\??\c:\dvpvd.exec:\dvpvd.exe55⤵
- Executes dropped EXE
PID:1896 -
\??\c:\rfxxfxl.exec:\rfxxfxl.exe56⤵
- Executes dropped EXE
PID:2000 -
\??\c:\hbthhh.exec:\hbthhh.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2912 -
\??\c:\9pjvd.exec:\9pjvd.exe58⤵
- Executes dropped EXE
PID:2924 -
\??\c:\jjdjd.exec:\jjdjd.exe59⤵
- Executes dropped EXE
PID:2940 -
\??\c:\llflllx.exec:\llflllx.exe60⤵
- Executes dropped EXE
PID:2140 -
\??\c:\ntnbnt.exec:\ntnbnt.exe61⤵
- Executes dropped EXE
PID:2188 -
\??\c:\7btbtn.exec:\7btbtn.exe62⤵
- Executes dropped EXE
PID:2060 -
\??\c:\pppdp.exec:\pppdp.exe63⤵
- Executes dropped EXE
PID:1136 -
\??\c:\rllxfll.exec:\rllxfll.exe64⤵
- Executes dropped EXE
PID:2916 -
\??\c:\btnhnn.exec:\btnhnn.exe65⤵
- Executes dropped EXE
PID:1540 -
\??\c:\1nnhtt.exec:\1nnhtt.exe66⤵PID:1040
-
\??\c:\3jjpv.exec:\3jjpv.exe67⤵
- System Location Discovery: System Language Discovery
PID:484 -
\??\c:\5lrlrrr.exec:\5lrlrrr.exe68⤵PID:320
-
\??\c:\xxrxllr.exec:\xxrxllr.exe69⤵PID:988
-
\??\c:\5nbhht.exec:\5nbhht.exe70⤵PID:1672
-
\??\c:\pvvjp.exec:\pvvjp.exe71⤵PID:1232
-
\??\c:\djdvd.exec:\djdvd.exe72⤵PID:1448
-
\??\c:\9ffxlrf.exec:\9ffxlrf.exe73⤵PID:2680
-
\??\c:\thtthh.exec:\thtthh.exe74⤵PID:2396
-
\??\c:\ttnhnb.exec:\ttnhnb.exe75⤵PID:1584
-
\??\c:\jjdvd.exec:\jjdvd.exe76⤵PID:2536
-
\??\c:\rxrrflx.exec:\rxrrflx.exe77⤵PID:1812
-
\??\c:\rrlrxlf.exec:\rrlrxlf.exe78⤵PID:1480
-
\??\c:\7bhhnt.exec:\7bhhnt.exe79⤵PID:2492
-
\??\c:\dvdjv.exec:\dvdjv.exe80⤵PID:1688
-
\??\c:\jdddp.exec:\jdddp.exe81⤵PID:2728
-
\??\c:\7flxxxf.exec:\7flxxxf.exe82⤵PID:2976
-
\??\c:\9tnnnn.exec:\9tnnnn.exe83⤵PID:2560
-
\??\c:\jdvpd.exec:\jdvpd.exe84⤵PID:2624
-
\??\c:\ddddj.exec:\ddddj.exe85⤵PID:2772
-
\??\c:\lfxfrrl.exec:\lfxfrrl.exe86⤵PID:2644
-
\??\c:\xrfxlfl.exec:\xrfxlfl.exe87⤵PID:2612
-
\??\c:\bnhthn.exec:\bnhthn.exe88⤵PID:2768
-
\??\c:\jjddj.exec:\jjddj.exe89⤵PID:844
-
\??\c:\xlflrrf.exec:\xlflrrf.exe90⤵PID:2564
-
\??\c:\rfxrrrx.exec:\rfxrrrx.exe91⤵PID:1892
-
\??\c:\1thbhn.exec:\1thbhn.exe92⤵PID:1052
-
\??\c:\hbnnhb.exec:\hbnnhb.exe93⤵PID:2064
-
\??\c:\pdjjv.exec:\pdjjv.exe94⤵PID:2156
-
\??\c:\xrffllx.exec:\xrffllx.exe95⤵PID:2840
-
\??\c:\5hbbnn.exec:\5hbbnn.exe96⤵PID:2108
-
\??\c:\nnnnbt.exec:\nnnnbt.exe97⤵PID:1824
-
\??\c:\dvjvv.exec:\dvjvv.exe98⤵PID:2012
-
\??\c:\lxllrfr.exec:\lxllrfr.exe99⤵PID:2008
-
\??\c:\rfrrfxx.exec:\rfrrfxx.exe100⤵PID:2956
-
\??\c:\tnnbnt.exec:\tnnbnt.exe101⤵PID:2252
-
\??\c:\tnhtbt.exec:\tnhtbt.exe102⤵PID:2280
-
\??\c:\pjddp.exec:\pjddp.exe103⤵PID:2936
-
\??\c:\llllrxx.exec:\llllrxx.exe104⤵PID:448
-
\??\c:\rlxfrxl.exec:\rlxfrxl.exe105⤵PID:3004
-
\??\c:\nnhttb.exec:\nnhttb.exe106⤵PID:2036
-
\??\c:\pppvd.exec:\pppvd.exe107⤵PID:1808
-
\??\c:\xrlrxxf.exec:\xrlrxxf.exe108⤵PID:1744
-
\??\c:\ffxlrff.exec:\ffxlrff.exe109⤵PID:2992
-
\??\c:\nhtbht.exec:\nhtbht.exe110⤵PID:484
-
\??\c:\7jvdj.exec:\7jvdj.exe111⤵PID:1680
-
\??\c:\pjdjv.exec:\pjdjv.exe112⤵PID:988
-
\??\c:\3rrrxxf.exec:\3rrrxxf.exe113⤵PID:868
-
\??\c:\5nhtbh.exec:\5nhtbh.exe114⤵PID:2368
-
\??\c:\ntbnth.exec:\ntbnth.exe115⤵PID:2364
-
\??\c:\vdppv.exec:\vdppv.exe116⤵PID:2396
-
\??\c:\9frlrxl.exec:\9frlrxl.exe117⤵PID:2320
-
\??\c:\9hnbhn.exec:\9hnbhn.exe118⤵PID:1264
-
\??\c:\bbnntn.exec:\bbnntn.exe119⤵PID:2380
-
\??\c:\pvjvp.exec:\pvjvp.exe120⤵PID:2740
-
\??\c:\lffrxfx.exec:\lffrxfx.exe121⤵PID:2704
-
\??\c:\7btbtb.exec:\7btbtb.exe122⤵PID:2348
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-