Analysis
-
max time kernel
150s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 05:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e5355bb2a93403d04b4505a06b58da40cbb1784cf82213295eecea82ff8359dd.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
e5355bb2a93403d04b4505a06b58da40cbb1784cf82213295eecea82ff8359dd.exe
-
Size
347KB
-
MD5
38e98d30b76a63660ce41fa09158f92e
-
SHA1
fc920207517535b1d2acda98f910bb31865bd970
-
SHA256
e5355bb2a93403d04b4505a06b58da40cbb1784cf82213295eecea82ff8359dd
-
SHA512
90ffd9fcd1656e8c52788dcd8a0c5f01c92fb8692cf4d77321acb12ac6a991f9130cfbfb20e6c20c383111b0c15e2b337a4641134b06aa1db18936b0ab497fea
-
SSDEEP
6144:Xcm7ImGddXgYW5fNZWB5hFfci3Add4kGYAp:l7TcbWXZshJX2VGdp
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/2644-1-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2644-7-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2692-20-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2688-17-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2756-29-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2676-39-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2728-48-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2728-50-0x00000000003A0000-0x00000000003C8000-memory.dmp family_blackmoon behavioral1/memory/2616-57-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2316-67-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2120-84-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2928-99-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2116-117-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/3068-129-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2900-127-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2816-145-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1236-154-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/3012-190-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1416-197-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1800-201-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1800-208-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2008-234-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/336-253-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2280-268-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1724-277-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2744-294-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2548-301-0x00000000001B0000-0x00000000001D8000-memory.dmp family_blackmoon behavioral1/memory/1580-321-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2704-329-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2528-411-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2504-451-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1748-501-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2312-514-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1616-541-0x00000000003A0000-0x00000000003C8000-memory.dmp family_blackmoon behavioral1/memory/2620-548-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2756-580-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2212-621-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2204-653-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2344-656-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2944-663-0x0000000000430000-0x0000000000458000-memory.dmp family_blackmoon behavioral1/memory/2904-668-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/3064-687-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1672-767-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1916-810-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2736-865-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/408-902-0x0000000001B80000-0x0000000001BA8000-memory.dmp family_blackmoon behavioral1/memory/672-917-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2136-930-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2012-1011-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2688 ffxlrxl.exe 2692 bthtbh.exe 2756 jdpdd.exe 2676 llfrxlx.exe 2728 tbtbnt.exe 2616 jjvjv.exe 2316 5rlxrxl.exe 1144 rrrlffx.exe 2120 7bbbhh.exe 2928 vvvjd.exe 2104 jddpj.exe 2116 ttbhbn.exe 2900 pvvpd.exe 3068 ppdjv.exe 2816 5ddjj.exe 1236 3nnbtb.exe 636 9dpdp.exe 536 9hhnbn.exe 1984 vjpjd.exe 3012 ffxlfrf.exe 1416 3vdvj.exe 1800 1nnbnb.exe 3024 7ppdj.exe 1748 xxxlfrf.exe 2008 btnthn.exe 1296 xfxrfrf.exe 1952 tbthhn.exe 336 ddvdp.exe 2280 7flflrf.exe 1724 jjvdv.exe 1668 djjvp.exe 2744 hhbhht.exe 2548 3jdvj.exe 2576 7ffrlfl.exe 2656 3hhnbh.exe 1580 nnhbtb.exe 2704 1jdvj.exe 2556 fllrxrl.exe 3052 nnbhht.exe 2612 dvpjv.exe 2072 rrrxrfx.exe 3056 ttnntb.exe 1772 nbhbtb.exe 2524 jdvdp.exe 2928 5llxrfl.exe 2992 ttnhtn.exe 2104 7tntbh.exe 2856 vddvp.exe 2940 lrrlflf.exe 2528 xrlrfrr.exe 2868 bhhbbt.exe 2376 ppjpj.exe 2864 ffxrxfl.exe 376 5htnnb.exe 636 bhnhnn.exe 2504 vddjp.exe 2164 lfrrxrf.exe 3008 ttntnb.exe 828 vppdp.exe 1164 vpjpv.exe 1624 3lflrxl.exe 1352 bbnthb.exe 1760 dpdvv.exe 1748 xfxlfrl.exe -
resource yara_rule behavioral1/memory/2644-7-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2692-20-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2688-17-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2756-29-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2676-39-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2728-48-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2616-57-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2316-67-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2120-84-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2928-99-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2116-109-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2116-117-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/3068-129-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2900-127-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1236-146-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2816-145-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1236-154-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/536-164-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/3012-181-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/3012-190-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1800-201-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1800-208-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/3024-210-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2008-234-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/336-253-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2280-268-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1724-277-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2744-294-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1580-314-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1580-321-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2556-330-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2704-329-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2072-349-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2528-411-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2376-418-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2864-432-0x0000000000430000-0x0000000000458000-memory.dmp upx behavioral1/memory/2504-451-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1352-482-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1748-501-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2312-514-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2620-548-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2664-561-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/888-587-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2988-640-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2204-653-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2904-668-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/3064-687-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/984-708-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2012-728-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1524-753-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2736-865-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/672-917-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/984-983-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2140-997-0x0000000000400000-0x0000000000428000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxlrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xllrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhttbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhntbh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2644 wrote to memory of 2688 2644 e5355bb2a93403d04b4505a06b58da40cbb1784cf82213295eecea82ff8359dd.exe 30 PID 2644 wrote to memory of 2688 2644 e5355bb2a93403d04b4505a06b58da40cbb1784cf82213295eecea82ff8359dd.exe 30 PID 2644 wrote to memory of 2688 2644 e5355bb2a93403d04b4505a06b58da40cbb1784cf82213295eecea82ff8359dd.exe 30 PID 2644 wrote to memory of 2688 2644 e5355bb2a93403d04b4505a06b58da40cbb1784cf82213295eecea82ff8359dd.exe 30 PID 2688 wrote to memory of 2692 2688 ffxlrxl.exe 31 PID 2688 wrote to memory of 2692 2688 ffxlrxl.exe 31 PID 2688 wrote to memory of 2692 2688 ffxlrxl.exe 31 PID 2688 wrote to memory of 2692 2688 ffxlrxl.exe 31 PID 2692 wrote to memory of 2756 2692 bthtbh.exe 32 PID 2692 wrote to memory of 2756 2692 bthtbh.exe 32 PID 2692 wrote to memory of 2756 2692 bthtbh.exe 32 PID 2692 wrote to memory of 2756 2692 bthtbh.exe 32 PID 2756 wrote to memory of 2676 2756 jdpdd.exe 33 PID 2756 wrote to memory of 2676 2756 jdpdd.exe 33 PID 2756 wrote to memory of 2676 2756 jdpdd.exe 33 PID 2756 wrote to memory of 2676 2756 jdpdd.exe 33 PID 2676 wrote to memory of 2728 2676 llfrxlx.exe 34 PID 2676 wrote to memory of 2728 2676 llfrxlx.exe 34 PID 2676 wrote to memory of 2728 2676 llfrxlx.exe 34 PID 2676 wrote to memory of 2728 2676 llfrxlx.exe 34 PID 2728 wrote to memory of 2616 2728 tbtbnt.exe 35 PID 2728 wrote to memory of 2616 2728 tbtbnt.exe 35 PID 2728 wrote to memory of 2616 2728 tbtbnt.exe 35 PID 2728 wrote to memory of 2616 2728 tbtbnt.exe 35 PID 2616 wrote to memory of 2316 2616 jjvjv.exe 36 PID 2616 wrote to memory of 2316 2616 jjvjv.exe 36 PID 2616 wrote to memory of 2316 2616 jjvjv.exe 36 PID 2616 wrote to memory of 2316 2616 jjvjv.exe 36 PID 2316 wrote to memory of 1144 2316 5rlxrxl.exe 37 PID 2316 wrote to memory of 1144 2316 5rlxrxl.exe 37 PID 2316 wrote to memory of 1144 2316 5rlxrxl.exe 37 PID 2316 wrote to memory of 1144 2316 5rlxrxl.exe 37 PID 1144 wrote to memory of 2120 1144 rrrlffx.exe 38 PID 1144 wrote to memory of 2120 1144 rrrlffx.exe 38 PID 1144 wrote to memory of 2120 1144 rrrlffx.exe 38 PID 1144 wrote to memory of 2120 1144 rrrlffx.exe 38 PID 2120 wrote to memory of 2928 2120 7bbbhh.exe 39 PID 2120 wrote to memory of 2928 2120 7bbbhh.exe 39 PID 2120 wrote to memory of 2928 2120 7bbbhh.exe 39 PID 2120 wrote to memory of 2928 2120 7bbbhh.exe 39 PID 2928 wrote to memory of 2104 2928 vvvjd.exe 40 PID 2928 wrote to memory of 2104 2928 vvvjd.exe 40 PID 2928 wrote to memory of 2104 2928 vvvjd.exe 40 PID 2928 wrote to memory of 2104 2928 vvvjd.exe 40 PID 2104 wrote to memory of 2116 2104 jddpj.exe 41 PID 2104 wrote to memory of 2116 2104 jddpj.exe 41 PID 2104 wrote to memory of 2116 2104 jddpj.exe 41 PID 2104 wrote to memory of 2116 2104 jddpj.exe 41 PID 2116 wrote to memory of 2900 2116 ttbhbn.exe 42 PID 2116 wrote to memory of 2900 2116 ttbhbn.exe 42 PID 2116 wrote to memory of 2900 2116 ttbhbn.exe 42 PID 2116 wrote to memory of 2900 2116 ttbhbn.exe 42 PID 2900 wrote to memory of 3068 2900 pvvpd.exe 43 PID 2900 wrote to memory of 3068 2900 pvvpd.exe 43 PID 2900 wrote to memory of 3068 2900 pvvpd.exe 43 PID 2900 wrote to memory of 3068 2900 pvvpd.exe 43 PID 3068 wrote to memory of 2816 3068 ppdjv.exe 44 PID 3068 wrote to memory of 2816 3068 ppdjv.exe 44 PID 3068 wrote to memory of 2816 3068 ppdjv.exe 44 PID 3068 wrote to memory of 2816 3068 ppdjv.exe 44 PID 2816 wrote to memory of 1236 2816 5ddjj.exe 45 PID 2816 wrote to memory of 1236 2816 5ddjj.exe 45 PID 2816 wrote to memory of 1236 2816 5ddjj.exe 45 PID 2816 wrote to memory of 1236 2816 5ddjj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\e5355bb2a93403d04b4505a06b58da40cbb1784cf82213295eecea82ff8359dd.exe"C:\Users\Admin\AppData\Local\Temp\e5355bb2a93403d04b4505a06b58da40cbb1784cf82213295eecea82ff8359dd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\ffxlrxl.exec:\ffxlrxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\bthtbh.exec:\bthtbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\jdpdd.exec:\jdpdd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\llfrxlx.exec:\llfrxlx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\tbtbnt.exec:\tbtbnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\jjvjv.exec:\jjvjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\5rlxrxl.exec:\5rlxrxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\rrrlffx.exec:\rrrlffx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
\??\c:\7bbbhh.exec:\7bbbhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\vvvjd.exec:\vvvjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\jddpj.exec:\jddpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\ttbhbn.exec:\ttbhbn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\pvvpd.exec:\pvvpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\ppdjv.exec:\ppdjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\5ddjj.exec:\5ddjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\3nnbtb.exec:\3nnbtb.exe17⤵
- Executes dropped EXE
PID:1236 -
\??\c:\9dpdp.exec:\9dpdp.exe18⤵
- Executes dropped EXE
PID:636 -
\??\c:\9hhnbn.exec:\9hhnbn.exe19⤵
- Executes dropped EXE
PID:536 -
\??\c:\vjpjd.exec:\vjpjd.exe20⤵
- Executes dropped EXE
PID:1984 -
\??\c:\ffxlfrf.exec:\ffxlfrf.exe21⤵
- Executes dropped EXE
PID:3012 -
\??\c:\3vdvj.exec:\3vdvj.exe22⤵
- Executes dropped EXE
PID:1416 -
\??\c:\1nnbnb.exec:\1nnbnb.exe23⤵
- Executes dropped EXE
PID:1800 -
\??\c:\7ppdj.exec:\7ppdj.exe24⤵
- Executes dropped EXE
PID:3024 -
\??\c:\xxxlfrf.exec:\xxxlfrf.exe25⤵
- Executes dropped EXE
PID:1748 -
\??\c:\btnthn.exec:\btnthn.exe26⤵
- Executes dropped EXE
PID:2008 -
\??\c:\xfxrfrf.exec:\xfxrfrf.exe27⤵
- Executes dropped EXE
PID:1296 -
\??\c:\tbthhn.exec:\tbthhn.exe28⤵
- Executes dropped EXE
PID:1952 -
\??\c:\ddvdp.exec:\ddvdp.exe29⤵
- Executes dropped EXE
PID:336 -
\??\c:\7flflrf.exec:\7flflrf.exe30⤵
- Executes dropped EXE
PID:2280 -
\??\c:\jjvdv.exec:\jjvdv.exe31⤵
- Executes dropped EXE
PID:1724 -
\??\c:\djjvp.exec:\djjvp.exe32⤵
- Executes dropped EXE
PID:1668 -
\??\c:\hhbhht.exec:\hhbhht.exe33⤵
- Executes dropped EXE
PID:2744 -
\??\c:\3jdvj.exec:\3jdvj.exe34⤵
- Executes dropped EXE
PID:2548 -
\??\c:\7ffrlfl.exec:\7ffrlfl.exe35⤵
- Executes dropped EXE
PID:2576 -
\??\c:\3hhnbh.exec:\3hhnbh.exe36⤵
- Executes dropped EXE
PID:2656 -
\??\c:\nnhbtb.exec:\nnhbtb.exe37⤵
- Executes dropped EXE
PID:1580 -
\??\c:\1jdvj.exec:\1jdvj.exe38⤵
- Executes dropped EXE
PID:2704 -
\??\c:\fllrxrl.exec:\fllrxrl.exe39⤵
- Executes dropped EXE
PID:2556 -
\??\c:\nnbhht.exec:\nnbhht.exe40⤵
- Executes dropped EXE
PID:3052 -
\??\c:\dvpjv.exec:\dvpjv.exe41⤵
- Executes dropped EXE
PID:2612 -
\??\c:\rrrxrfx.exec:\rrrxrfx.exe42⤵
- Executes dropped EXE
PID:2072 -
\??\c:\ttnntb.exec:\ttnntb.exe43⤵
- Executes dropped EXE
PID:3056 -
\??\c:\nbhbtb.exec:\nbhbtb.exe44⤵
- Executes dropped EXE
PID:1772 -
\??\c:\jdvdp.exec:\jdvdp.exe45⤵
- Executes dropped EXE
PID:2524 -
\??\c:\5llxrfl.exec:\5llxrfl.exe46⤵
- Executes dropped EXE
PID:2928 -
\??\c:\ttnhtn.exec:\ttnhtn.exe47⤵
- Executes dropped EXE
PID:2992 -
\??\c:\7tntbh.exec:\7tntbh.exe48⤵
- Executes dropped EXE
PID:2104 -
\??\c:\vddvp.exec:\vddvp.exe49⤵
- Executes dropped EXE
PID:2856 -
\??\c:\lrrlflf.exec:\lrrlflf.exe50⤵
- Executes dropped EXE
PID:2940 -
\??\c:\xrlrfrr.exec:\xrlrfrr.exe51⤵
- Executes dropped EXE
PID:2528 -
\??\c:\bhhbbt.exec:\bhhbbt.exe52⤵
- Executes dropped EXE
PID:2868 -
\??\c:\ppjpj.exec:\ppjpj.exe53⤵
- Executes dropped EXE
PID:2376 -
\??\c:\ffxrxfl.exec:\ffxrxfl.exe54⤵
- Executes dropped EXE
PID:2864 -
\??\c:\5htnnb.exec:\5htnnb.exe55⤵
- Executes dropped EXE
PID:376 -
\??\c:\bhnhnn.exec:\bhnhnn.exe56⤵
- Executes dropped EXE
PID:636 -
\??\c:\vddjp.exec:\vddjp.exe57⤵
- Executes dropped EXE
PID:2504 -
\??\c:\lfrrxrf.exec:\lfrrxrf.exe58⤵
- Executes dropped EXE
PID:2164 -
\??\c:\ttntnb.exec:\ttntnb.exe59⤵
- Executes dropped EXE
PID:3008 -
\??\c:\vppdp.exec:\vppdp.exe60⤵
- Executes dropped EXE
PID:828 -
\??\c:\vpjpv.exec:\vpjpv.exe61⤵
- Executes dropped EXE
PID:1164 -
\??\c:\3lflrxl.exec:\3lflrxl.exe62⤵
- Executes dropped EXE
PID:1624 -
\??\c:\bbnthb.exec:\bbnthb.exe63⤵
- Executes dropped EXE
PID:1352 -
\??\c:\dpdvv.exec:\dpdvv.exe64⤵
- Executes dropped EXE
PID:1760 -
\??\c:\xfxlfrl.exec:\xfxlfrl.exe65⤵
- Executes dropped EXE
PID:1748 -
\??\c:\nnnhbn.exec:\nnnhbn.exe66⤵PID:1944
-
\??\c:\hnhhbn.exec:\hnhhbn.exe67⤵PID:2312
-
\??\c:\ppdjv.exec:\ppdjv.exe68⤵PID:764
-
\??\c:\ffxlxfr.exec:\ffxlxfr.exe69⤵PID:1736
-
\??\c:\tnhtnt.exec:\tnhtnt.exe70⤵PID:336
-
\??\c:\pjpjv.exec:\pjpjv.exe71⤵PID:1616
-
\??\c:\3dvdv.exec:\3dvdv.exe72⤵PID:1784
-
\??\c:\fxlrlrf.exec:\fxlrlrf.exe73⤵PID:2620
-
\??\c:\hnntbh.exec:\hnntbh.exe74⤵PID:1668
-
\??\c:\vvvjp.exec:\vvvjp.exe75⤵PID:2664
-
\??\c:\pjvpp.exec:\pjvpp.exe76⤵PID:2912
-
\??\c:\lllxlrf.exec:\lllxlrf.exe77⤵PID:2756
-
\??\c:\hbbhtt.exec:\hbbhtt.exe78⤵PID:3044
-
\??\c:\3ddpv.exec:\3ddpv.exe79⤵PID:888
-
\??\c:\5lrflfx.exec:\5lrflfx.exe80⤵PID:2552
-
\??\c:\9xlxfrf.exec:\9xlxfrf.exe81⤵PID:1708
-
\??\c:\1nhnhn.exec:\1nhnhn.exe82⤵PID:2328
-
\??\c:\jjpjv.exec:\jjpjv.exe83⤵PID:2212
-
\??\c:\ffflfrx.exec:\ffflfrx.exe84⤵PID:792
-
\??\c:\1tthnt.exec:\1tthnt.exe85⤵PID:2592
-
\??\c:\hbthbn.exec:\hbthbn.exe86⤵PID:804
-
\??\c:\vdjvj.exec:\vdjvj.exe87⤵PID:2988
-
\??\c:\llrfrll.exec:\llrfrll.exe88⤵PID:2204
-
\??\c:\frfrlrl.exec:\frfrlrl.exe89⤵PID:2344
-
\??\c:\bhttbt.exec:\bhttbt.exe90⤵
- System Location Discovery: System Language Discovery
PID:2944 -
\??\c:\3vvjd.exec:\3vvjd.exe91⤵PID:2904
-
\??\c:\rlrlrlr.exec:\rlrlrlr.exe92⤵PID:2888
-
\??\c:\rrfxfff.exec:\rrfxfff.exe93⤵PID:3064
-
\??\c:\3nntnb.exec:\3nntnb.exe94⤵PID:2868
-
\??\c:\djpvp.exec:\djpvp.exe95⤵PID:324
-
\??\c:\1lfrfxf.exec:\1lfrfxf.exe96⤵PID:2408
-
\??\c:\bbbnhn.exec:\bbbnhn.exe97⤵PID:984
-
\??\c:\btntnb.exec:\btntnb.exe98⤵PID:1768
-
\??\c:\jppvp.exec:\jppvp.exe99⤵PID:2140
-
\??\c:\xrrlllf.exec:\xrrlllf.exe100⤵PID:2012
-
\??\c:\bhttnb.exec:\bhttnb.exe101⤵PID:832
-
\??\c:\bbhhhn.exec:\bbhhhn.exe102⤵PID:2432
-
\??\c:\jvjvv.exec:\jvjvv.exe103⤵PID:2472
-
\??\c:\ffxlfrr.exec:\ffxlfrr.exe104⤵PID:1524
-
\??\c:\ttnthn.exec:\ttnthn.exe105⤵PID:1672
-
\??\c:\3hbtnb.exec:\3hbtnb.exe106⤵PID:1956
-
\??\c:\3pvvj.exec:\3pvvj.exe107⤵PID:2008
-
\??\c:\llrxxlf.exec:\llrxxlf.exe108⤵PID:608
-
\??\c:\htnntn.exec:\htnntn.exe109⤵PID:300
-
\??\c:\ddvpp.exec:\ddvpp.exe110⤵PID:2040
-
\??\c:\dvvdp.exec:\dvvdp.exe111⤵PID:768
-
\??\c:\fxffrll.exec:\fxffrll.exe112⤵PID:1916
-
\??\c:\hhhtnh.exec:\hhhtnh.exe113⤵PID:1432
-
\??\c:\jppdv.exec:\jppdv.exe114⤵PID:2684
-
\??\c:\vdpdj.exec:\vdpdj.exe115⤵PID:2752
-
\??\c:\llxrxrr.exec:\llxrxrr.exe116⤵PID:2772
-
\??\c:\bbnnbh.exec:\bbnnbh.exe117⤵PID:2832
-
\??\c:\hntttn.exec:\hntttn.exe118⤵PID:1692
-
\??\c:\jjvpd.exec:\jjvpd.exe119⤵PID:2588
-
\??\c:\lrlxrxr.exec:\lrlxrxr.exe120⤵PID:2736
-
\??\c:\dpvvj.exec:\dpvvj.exe121⤵PID:2840
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-