Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 06:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e6942677472ab45c309246300aab160729f8a767961c65553c9baedcafedccec.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
150 seconds
General
-
Target
e6942677472ab45c309246300aab160729f8a767961c65553c9baedcafedccec.exe
-
Size
453KB
-
MD5
c8121d1beda68ab3b5178387102c7e14
-
SHA1
aacbe37f4debd150bd9a1090f5bfb26249b8cf8c
-
SHA256
e6942677472ab45c309246300aab160729f8a767961c65553c9baedcafedccec
-
SHA512
cf7a38fac52e840492e65b716d2bdc7066d050e9d03bcbad26fcfe63bd2bce8dd460ed2cac14bf905253245d014958fec989d427771e6dc8e50dc877509f960b
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeU:q7Tc2NYHUrAwfMp3CDU
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/2412-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1012-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1012-12-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2840-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1372-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-73-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2648-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2144-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2144-113-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2648-112-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1428-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2144-152-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2244-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1140-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2244-187-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2252-201-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1900-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/896-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1152-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2268-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2100-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1740-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1632-404-0x00000000001C0000-0x00000000001EA000-memory.dmp family_blackmoon behavioral1/memory/2432-434-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2472-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/380-447-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1760-448-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2440-460-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2428-496-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2444-538-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-591-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-624-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-681-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/1804-724-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/996-784-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/292-804-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1012 xrxfrrr.exe 2840 1bhhnt.exe 2860 pvvdd.exe 2888 jpdjv.exe 2596 rlfxllx.exe 1372 jdvvd.exe 2648 rrxfffr.exe 324 1pjvj.exe 2500 frrrxxl.exe 3036 fllrxfr.exe 2144 vjddj.exe 1428 xxrfxxr.exe 2644 vpddp.exe 2912 fllfxff.exe 2076 xlxlflr.exe 1192 bbnntt.exe 536 5dppp.exe 1140 ffrrffl.exe 2244 jpddj.exe 2356 fxllxxf.exe 2252 3vppv.exe 1156 ddjpv.exe 1900 7pjjv.exe 896 xrxfffl.exe 1284 ttthhb.exe 1844 3xrrflf.exe 2340 jdpvp.exe 1952 1nhnnb.exe 1152 jpvdd.exe 872 tttbhn.exe 2268 ttbtbh.exe 2864 jvpdp.exe 2884 bnhhtt.exe 2216 3jjjv.exe 1536 lrfxrxf.exe 2820 tthnhn.exe 2752 pdvjv.exe 2692 flrxfll.exe 2628 hntntn.exe 1488 pvjpd.exe 2100 dddpj.exe 1736 3frxflr.exe 2552 tbntbn.exe 2384 bnbhbt.exe 1740 dpdpp.exe 1576 frflxfl.exe 1632 9hnnth.exe 1856 vdvjd.exe 2644 flxffrr.exe 1144 tbbbhn.exe 2432 vjpvd.exe 2472 vvddd.exe 380 rrllxxl.exe 1760 bbnnht.exe 2440 vjvjp.exe 2004 rrfrfrf.exe 2360 5xxffrf.exe 2364 hhbthn.exe 3004 djppd.exe 2260 5ddpd.exe 2428 rllfllf.exe 996 tbntbb.exe 896 1btbhn.exe 1688 ppvjd.exe -
resource yara_rule behavioral1/memory/2412-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1012-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1372-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1428-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1140-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/896-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1900-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/896-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1284-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/872-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1152-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-366-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/1576-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1856-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1856-415-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2432-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/380-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-538-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-546-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-566-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-591-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-617-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-624-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/976-710-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-737-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/956-765-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/996-784-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrxfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxfrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxflfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9btthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrflrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ddjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrxrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dvdj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2412 wrote to memory of 1012 2412 e6942677472ab45c309246300aab160729f8a767961c65553c9baedcafedccec.exe 30 PID 2412 wrote to memory of 1012 2412 e6942677472ab45c309246300aab160729f8a767961c65553c9baedcafedccec.exe 30 PID 2412 wrote to memory of 1012 2412 e6942677472ab45c309246300aab160729f8a767961c65553c9baedcafedccec.exe 30 PID 2412 wrote to memory of 1012 2412 e6942677472ab45c309246300aab160729f8a767961c65553c9baedcafedccec.exe 30 PID 1012 wrote to memory of 2840 1012 xrxfrrr.exe 31 PID 1012 wrote to memory of 2840 1012 xrxfrrr.exe 31 PID 1012 wrote to memory of 2840 1012 xrxfrrr.exe 31 PID 1012 wrote to memory of 2840 1012 xrxfrrr.exe 31 PID 2840 wrote to memory of 2860 2840 1bhhnt.exe 32 PID 2840 wrote to memory of 2860 2840 1bhhnt.exe 32 PID 2840 wrote to memory of 2860 2840 1bhhnt.exe 32 PID 2840 wrote to memory of 2860 2840 1bhhnt.exe 32 PID 2860 wrote to memory of 2888 2860 pvvdd.exe 33 PID 2860 wrote to memory of 2888 2860 pvvdd.exe 33 PID 2860 wrote to memory of 2888 2860 pvvdd.exe 33 PID 2860 wrote to memory of 2888 2860 pvvdd.exe 33 PID 2888 wrote to memory of 2596 2888 jpdjv.exe 34 PID 2888 wrote to memory of 2596 2888 jpdjv.exe 34 PID 2888 wrote to memory of 2596 2888 jpdjv.exe 34 PID 2888 wrote to memory of 2596 2888 jpdjv.exe 34 PID 2596 wrote to memory of 1372 2596 rlfxllx.exe 35 PID 2596 wrote to memory of 1372 2596 rlfxllx.exe 35 PID 2596 wrote to memory of 1372 2596 rlfxllx.exe 35 PID 2596 wrote to memory of 1372 2596 rlfxllx.exe 35 PID 1372 wrote to memory of 2648 1372 jdvvd.exe 36 PID 1372 wrote to memory of 2648 1372 jdvvd.exe 36 PID 1372 wrote to memory of 2648 1372 jdvvd.exe 36 PID 1372 wrote to memory of 2648 1372 jdvvd.exe 36 PID 2648 wrote to memory of 324 2648 rrxfffr.exe 37 PID 2648 wrote to memory of 324 2648 rrxfffr.exe 37 PID 2648 wrote to memory of 324 2648 rrxfffr.exe 37 PID 2648 wrote to memory of 324 2648 rrxfffr.exe 37 PID 324 wrote to memory of 2500 324 1pjvj.exe 38 PID 324 wrote to memory of 2500 324 1pjvj.exe 38 PID 324 wrote to memory of 2500 324 1pjvj.exe 38 PID 324 wrote to memory of 2500 324 1pjvj.exe 38 PID 2500 wrote to memory of 3036 2500 frrrxxl.exe 39 PID 2500 wrote to memory of 3036 2500 frrrxxl.exe 39 PID 2500 wrote to memory of 3036 2500 frrrxxl.exe 39 PID 2500 wrote to memory of 3036 2500 frrrxxl.exe 39 PID 3036 wrote to memory of 2144 3036 fllrxfr.exe 40 PID 3036 wrote to memory of 2144 3036 fllrxfr.exe 40 PID 3036 wrote to memory of 2144 3036 fllrxfr.exe 40 PID 3036 wrote to memory of 2144 3036 fllrxfr.exe 40 PID 2144 wrote to memory of 1428 2144 vjddj.exe 41 PID 2144 wrote to memory of 1428 2144 vjddj.exe 41 PID 2144 wrote to memory of 1428 2144 vjddj.exe 41 PID 2144 wrote to memory of 1428 2144 vjddj.exe 41 PID 1428 wrote to memory of 2644 1428 xxrfxxr.exe 42 PID 1428 wrote to memory of 2644 1428 xxrfxxr.exe 42 PID 1428 wrote to memory of 2644 1428 xxrfxxr.exe 42 PID 1428 wrote to memory of 2644 1428 xxrfxxr.exe 42 PID 2644 wrote to memory of 2912 2644 vpddp.exe 43 PID 2644 wrote to memory of 2912 2644 vpddp.exe 43 PID 2644 wrote to memory of 2912 2644 vpddp.exe 43 PID 2644 wrote to memory of 2912 2644 vpddp.exe 43 PID 2912 wrote to memory of 2076 2912 fllfxff.exe 44 PID 2912 wrote to memory of 2076 2912 fllfxff.exe 44 PID 2912 wrote to memory of 2076 2912 fllfxff.exe 44 PID 2912 wrote to memory of 2076 2912 fllfxff.exe 44 PID 2076 wrote to memory of 1192 2076 xlxlflr.exe 45 PID 2076 wrote to memory of 1192 2076 xlxlflr.exe 45 PID 2076 wrote to memory of 1192 2076 xlxlflr.exe 45 PID 2076 wrote to memory of 1192 2076 xlxlflr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\e6942677472ab45c309246300aab160729f8a767961c65553c9baedcafedccec.exe"C:\Users\Admin\AppData\Local\Temp\e6942677472ab45c309246300aab160729f8a767961c65553c9baedcafedccec.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\xrxfrrr.exec:\xrxfrrr.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1012 -
\??\c:\1bhhnt.exec:\1bhhnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\pvvdd.exec:\pvvdd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\jpdjv.exec:\jpdjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\rlfxllx.exec:\rlfxllx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\jdvvd.exec:\jdvvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
\??\c:\rrxfffr.exec:\rrxfffr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\1pjvj.exec:\1pjvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:324 -
\??\c:\frrrxxl.exec:\frrrxxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\fllrxfr.exec:\fllrxfr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\vjddj.exec:\vjddj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\xxrfxxr.exec:\xxrfxxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
\??\c:\vpddp.exec:\vpddp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\fllfxff.exec:\fllfxff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\xlxlflr.exec:\xlxlflr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\bbnntt.exec:\bbnntt.exe17⤵
- Executes dropped EXE
PID:1192 -
\??\c:\5dppp.exec:\5dppp.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:536 -
\??\c:\ffrrffl.exec:\ffrrffl.exe19⤵
- Executes dropped EXE
PID:1140 -
\??\c:\jpddj.exec:\jpddj.exe20⤵
- Executes dropped EXE
PID:2244 -
\??\c:\fxllxxf.exec:\fxllxxf.exe21⤵
- Executes dropped EXE
PID:2356 -
\??\c:\3vppv.exec:\3vppv.exe22⤵
- Executes dropped EXE
PID:2252 -
\??\c:\ddjpv.exec:\ddjpv.exe23⤵
- Executes dropped EXE
PID:1156 -
\??\c:\7pjjv.exec:\7pjjv.exe24⤵
- Executes dropped EXE
PID:1900 -
\??\c:\xrxfffl.exec:\xrxfffl.exe25⤵
- Executes dropped EXE
PID:896 -
\??\c:\ttthhb.exec:\ttthhb.exe26⤵
- Executes dropped EXE
PID:1284 -
\??\c:\3xrrflf.exec:\3xrrflf.exe27⤵
- Executes dropped EXE
PID:1844 -
\??\c:\jdpvp.exec:\jdpvp.exe28⤵
- Executes dropped EXE
PID:2340 -
\??\c:\1nhnnb.exec:\1nhnnb.exe29⤵
- Executes dropped EXE
PID:1952 -
\??\c:\jpvdd.exec:\jpvdd.exe30⤵
- Executes dropped EXE
PID:1152 -
\??\c:\tttbhn.exec:\tttbhn.exe31⤵
- Executes dropped EXE
PID:872 -
\??\c:\ttbtbh.exec:\ttbtbh.exe32⤵
- Executes dropped EXE
PID:2268 -
\??\c:\jvpdp.exec:\jvpdp.exe33⤵
- Executes dropped EXE
PID:2864 -
\??\c:\bnhhtt.exec:\bnhhtt.exe34⤵
- Executes dropped EXE
PID:2884 -
\??\c:\3jjjv.exec:\3jjjv.exe35⤵
- Executes dropped EXE
PID:2216 -
\??\c:\lrfxrxf.exec:\lrfxrxf.exe36⤵
- Executes dropped EXE
PID:1536 -
\??\c:\tthnhn.exec:\tthnhn.exe37⤵
- Executes dropped EXE
PID:2820 -
\??\c:\pdvjv.exec:\pdvjv.exe38⤵
- Executes dropped EXE
PID:2752 -
\??\c:\flrxfll.exec:\flrxfll.exe39⤵
- Executes dropped EXE
PID:2692 -
\??\c:\hntntn.exec:\hntntn.exe40⤵
- Executes dropped EXE
PID:2628 -
\??\c:\pvjpd.exec:\pvjpd.exe41⤵
- Executes dropped EXE
PID:1488 -
\??\c:\dddpj.exec:\dddpj.exe42⤵
- Executes dropped EXE
PID:2100 -
\??\c:\3frxflr.exec:\3frxflr.exe43⤵
- Executes dropped EXE
PID:1736 -
\??\c:\tbntbn.exec:\tbntbn.exe44⤵
- Executes dropped EXE
PID:2552 -
\??\c:\bnbhbt.exec:\bnbhbt.exe45⤵
- Executes dropped EXE
PID:2384 -
\??\c:\dpdpp.exec:\dpdpp.exe46⤵
- Executes dropped EXE
PID:1740 -
\??\c:\frflxfl.exec:\frflxfl.exe47⤵
- Executes dropped EXE
PID:1576 -
\??\c:\9hnnth.exec:\9hnnth.exe48⤵
- Executes dropped EXE
PID:1632 -
\??\c:\vdvjd.exec:\vdvjd.exe49⤵
- Executes dropped EXE
PID:1856 -
\??\c:\flxffrr.exec:\flxffrr.exe50⤵
- Executes dropped EXE
PID:2644 -
\??\c:\tbbbhn.exec:\tbbbhn.exe51⤵
- Executes dropped EXE
PID:1144 -
\??\c:\vjpvd.exec:\vjpvd.exe52⤵
- Executes dropped EXE
PID:2432 -
\??\c:\vvddd.exec:\vvddd.exe53⤵
- Executes dropped EXE
PID:2472 -
\??\c:\rrllxxl.exec:\rrllxxl.exe54⤵
- Executes dropped EXE
PID:380 -
\??\c:\bbnnht.exec:\bbnnht.exe55⤵
- Executes dropped EXE
PID:1760 -
\??\c:\vjvjp.exec:\vjvjp.exe56⤵
- Executes dropped EXE
PID:2440 -
\??\c:\rrfrfrf.exec:\rrfrfrf.exe57⤵
- Executes dropped EXE
PID:2004 -
\??\c:\5xxffrf.exec:\5xxffrf.exe58⤵
- Executes dropped EXE
PID:2360 -
\??\c:\hhbthn.exec:\hhbthn.exe59⤵
- Executes dropped EXE
PID:2364 -
\??\c:\djppd.exec:\djppd.exe60⤵
- Executes dropped EXE
PID:3004 -
\??\c:\5ddpd.exec:\5ddpd.exe61⤵
- Executes dropped EXE
PID:2260 -
\??\c:\rllfllf.exec:\rllfllf.exe62⤵
- Executes dropped EXE
PID:2428 -
\??\c:\tbntbb.exec:\tbntbb.exe63⤵
- Executes dropped EXE
PID:996 -
\??\c:\1btbhn.exec:\1btbhn.exe64⤵
- Executes dropped EXE
PID:896 -
\??\c:\ppvjd.exec:\ppvjd.exe65⤵
- Executes dropped EXE
PID:1688 -
\??\c:\llrxffl.exec:\llrxffl.exe66⤵PID:3000
-
\??\c:\tbbhth.exec:\tbbhth.exe67⤵PID:1844
-
\??\c:\hnbbnb.exec:\hnbbnb.exe68⤵PID:2444
-
\??\c:\3vpvv.exec:\3vpvv.exe69⤵PID:1448
-
\??\c:\rfrxflr.exec:\rfrxflr.exe70⤵PID:2060
-
\??\c:\tbntbh.exec:\tbntbh.exe71⤵PID:1684
-
\??\c:\pvjjp.exec:\pvjjp.exe72⤵PID:992
-
\??\c:\ffllrrr.exec:\ffllrrr.exe73⤵PID:2904
-
\??\c:\5xlrxxx.exec:\5xlrxxx.exe74⤵PID:2868
-
\??\c:\tnbbhh.exec:\tnbbhh.exe75⤵PID:2876
-
\??\c:\ppjpp.exec:\ppjpp.exe76⤵PID:2688
-
\??\c:\xflfrlr.exec:\xflfrlr.exe77⤵PID:2216
-
\??\c:\hthhtb.exec:\hthhtb.exe78⤵PID:2772
-
\??\c:\httthb.exec:\httthb.exe79⤵PID:2608
-
\??\c:\vvdpv.exec:\vvdpv.exe80⤵PID:2888
-
\??\c:\llxfrll.exec:\llxfrll.exe81⤵PID:2620
-
\??\c:\htntht.exec:\htntht.exe82⤵PID:2592
-
\??\c:\5jjjv.exec:\5jjjv.exe83⤵PID:612
-
\??\c:\vjjvj.exec:\vjjvj.exe84⤵PID:2700
-
\??\c:\lxxxfrx.exec:\lxxxfrx.exe85⤵PID:2556
-
\??\c:\thtbhn.exec:\thtbhn.exe86⤵PID:1552
-
\??\c:\tbnbnt.exec:\tbnbnt.exe87⤵PID:1984
-
\??\c:\jpjpv.exec:\jpjpv.exe88⤵PID:2112
-
\??\c:\lfffllr.exec:\lfffllr.exe89⤵PID:2924
-
\??\c:\xfllxxf.exec:\xfllxxf.exe90⤵PID:2804
-
\??\c:\tnthnb.exec:\tnthnb.exe91⤵PID:2928
-
\??\c:\pvjjp.exec:\pvjjp.exe92⤵PID:1120
-
\??\c:\9xrxflx.exec:\9xrxflx.exe93⤵PID:2644
-
\??\c:\lxlxlrf.exec:\lxlxlrf.exe94⤵PID:1356
-
\??\c:\5tbnhb.exec:\5tbnhb.exe95⤵PID:976
-
\??\c:\pvpvp.exec:\pvpvp.exe96⤵PID:1804
-
\??\c:\3lffffr.exec:\3lffffr.exe97⤵PID:1704
-
\??\c:\rxlrxfr.exec:\rxlrxfr.exe98⤵PID:2228
-
\??\c:\nbbnht.exec:\nbbnht.exe99⤵PID:2388
-
\??\c:\djppv.exec:\djppv.exe100⤵PID:1996
-
\??\c:\fffrllf.exec:\fffrllf.exe101⤵PID:3044
-
\??\c:\hhthtb.exec:\hhthtb.exe102⤵PID:2272
-
\??\c:\bhbbhh.exec:\bhbbhh.exe103⤵PID:956
-
\??\c:\jjdjd.exec:\jjdjd.exe104⤵PID:1212
-
\??\c:\ffrlrfr.exec:\ffrlrfr.exe105⤵PID:996
-
\??\c:\hnbhnb.exec:\hnbhnb.exe106⤵PID:1652
-
\??\c:\9pjjp.exec:\9pjjp.exe107⤵PID:1688
-
\??\c:\9ppjd.exec:\9ppjd.exe108⤵PID:292
-
\??\c:\ffllrxf.exec:\ffllrxf.exe109⤵PID:2492
-
\??\c:\bhbtht.exec:\bhbtht.exe110⤵PID:2444
-
\??\c:\ppddp.exec:\ppddp.exe111⤵PID:1864
-
\??\c:\ppjpv.exec:\ppjpv.exe112⤵PID:1876
-
\??\c:\lrfrxff.exec:\lrfrxff.exe113⤵PID:1684
-
\??\c:\vdjvj.exec:\vdjvj.exe114⤵PID:992
-
\??\c:\xxrxflx.exec:\xxrxflx.exe115⤵PID:2116
-
\??\c:\thnhht.exec:\thnhht.exe116⤵PID:3012
-
\??\c:\bhtbbt.exec:\bhtbbt.exe117⤵PID:2884
-
\??\c:\jppjj.exec:\jppjj.exe118⤵PID:1540
-
\??\c:\fflrxfl.exec:\fflrxfl.exe119⤵PID:1536
-
\??\c:\htbbhn.exec:\htbbhn.exe120⤵PID:2772
-
\??\c:\hhtnth.exec:\hhtnth.exe121⤵PID:2584
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-