Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 11:16
Behavioral task
behavioral1
Sample
a45d264c0fd34bcab8bedd7cd9d40696c933277aab140a69b70cf1cf8c4df165.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
a45d264c0fd34bcab8bedd7cd9d40696c933277aab140a69b70cf1cf8c4df165.exe
-
Size
79KB
-
MD5
db4d557f0966cb63b3f5e13b5c5b80bd
-
SHA1
4147b743c1503eafa8bfc539323d82980d568078
-
SHA256
a45d264c0fd34bcab8bedd7cd9d40696c933277aab140a69b70cf1cf8c4df165
-
SHA512
1606ac94b7a0ba40a53efb35b258f6ba0fcee09fa1f0f4c8435758567283e740e73787c447c6cfeb35f217db3dadef3e45eefce99f4edcb0e7e8cbd736efe735
-
SSDEEP
1536:xvQBeOGtrYS3srx93UBWfwC6Ggnouy82F13w1rCJtzx8/p7ke2t:xhOmTsF93UYfwC6GIout03LzGFO
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/328-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2552-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2520-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2664-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2672-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2684-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2684-64-0x00000000005C0000-0x00000000005E7000-memory.dmp family_blackmoon behavioral1/memory/2864-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2264-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2748-105-0x00000000003D0000-0x00000000003F7000-memory.dmp family_blackmoon behavioral1/memory/2824-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2192-299-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2012-349-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/1708-388-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1768-462-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2124-413-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2636-375-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2952-356-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2216-306-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2324-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/704-249-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/1216-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1048-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/532-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2756-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1604-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/828-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/828-169-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/1824-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1824-159-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1432-142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1544-133-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3016-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2644-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1444-501-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3068-516-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1528-528-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2512-577-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2660-584-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2748-640-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1896-787-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2664-845-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2728-858-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2092-1023-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2616-1192-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1208-1248-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/952-1284-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/1168-1343-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2548-1389-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2552 5vvpv.exe 2520 ddddj.exe 1728 lfxllfr.exe 2664 7nhhnn.exe 2672 3jdjv.exe 2684 rrrxlrl.exe 2864 rlfrlrf.exe 2264 thtntt.exe 2824 vvppv.exe 2748 dvdjp.exe 2644 7vvpv.exe 3016 7fxxffl.exe 1544 lfrflfl.exe 1432 hhtttb.exe 2124 tnbhtb.exe 1824 ththtb.exe 828 vpvvv.exe 1940 ppjpv.exe 1604 9xxxlxf.exe 2756 1xxflxl.exe 532 fxlfrxf.exe 1048 tnhntt.exe 1956 tntthh.exe 1216 dvpjd.exe 1968 dppvj.exe 704 lxrlxff.exe 1556 7lxlrrr.exe 2324 9hhhth.exe 2360 7hbthh.exe 2436 dpdjp.exe 2196 llfrxlr.exe 2192 5rflxfl.exe 2216 3xrrrxf.exe 2492 bhnnbb.exe 2924 9tnttt.exe 1512 vpjvj.exe 2016 jjjvd.exe 2724 rlxfllx.exe 2684 1lfrxxr.exe 2012 rlrrxxr.exe 2952 9thntt.exe 2264 hhtnnt.exe 2780 vpddv.exe 2636 jddjv.exe 3020 jddjp.exe 1708 xrxxffl.exe 1620 7llxlrr.exe 2616 bbnntb.exe 1464 tnthhn.exe 2124 nnbbhb.exe 1824 pjjvd.exe 2592 1xlrrlr.exe 1964 xrfrffx.exe 2640 tthnbb.exe 1604 7nbtnn.exe 1696 hbtnbh.exe 2176 jvddj.exe 1768 vpdpp.exe 444 jvjpp.exe 1948 xlxfllr.exe 1444 frffrxl.exe 1216 rxllrlx.exe 1204 ttbtht.exe 2288 btnbbn.exe -
resource yara_rule behavioral1/memory/328-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/328-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000b000000012029-8.dat upx behavioral1/files/0x0008000000015d64-18.dat upx behavioral1/memory/2552-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2520-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015d6d-27.dat upx behavioral1/memory/1728-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2664-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015d75-37.dat upx behavioral1/files/0x0008000000015d7f-45.dat upx behavioral1/memory/2672-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015e25-54.dat upx behavioral1/files/0x0007000000015e47-66.dat upx behavioral1/memory/2864-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2684-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2864-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015f1b-75.dat upx behavioral1/memory/2264-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001903d-95.dat upx behavioral1/memory/2748-97-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001920f-106.dat upx behavioral1/memory/2824-96-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019234-125.dat upx behavioral1/files/0x0005000000019273-152.dat upx behavioral1/files/0x0005000000019384-198.dat upx behavioral1/files/0x00050000000193c9-224.dat upx behavioral1/files/0x00050000000193f8-234.dat upx behavioral1/files/0x0005000000019494-258.dat upx behavioral1/files/0x00050000000194d4-283.dat upx behavioral1/memory/2192-299-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1708-388-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1768-462-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2124-413-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2636-375-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2952-356-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2216-306-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194da-292.dat upx behavioral1/files/0x00050000000194b4-276.dat upx behavioral1/files/0x00050000000194a7-268.dat upx behavioral1/memory/2324-266-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019408-251.dat upx behavioral1/files/0x00050000000193fa-242.dat upx behavioral1/memory/1216-233-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193af-216.dat upx behavioral1/memory/1048-215-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193a2-207.dat upx behavioral1/memory/532-206-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2756-197-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019346-189.dat upx behavioral1/memory/1604-188-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001933e-180.dat upx behavioral1/files/0x000500000001932a-172.dat upx behavioral1/memory/828-171-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000192f0-162.dat upx behavioral1/memory/1824-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1824-159-0x00000000001B0000-0x00000000001D7000-memory.dmp upx behavioral1/files/0x000500000001925c-144.dat upx behavioral1/memory/1432-142-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019241-134.dat upx behavioral1/memory/1544-133-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3016-124-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019228-116.dat upx behavioral1/memory/2644-115-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxxfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlllrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfrxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbthtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 328 wrote to memory of 2552 328 a45d264c0fd34bcab8bedd7cd9d40696c933277aab140a69b70cf1cf8c4df165.exe 30 PID 328 wrote to memory of 2552 328 a45d264c0fd34bcab8bedd7cd9d40696c933277aab140a69b70cf1cf8c4df165.exe 30 PID 328 wrote to memory of 2552 328 a45d264c0fd34bcab8bedd7cd9d40696c933277aab140a69b70cf1cf8c4df165.exe 30 PID 328 wrote to memory of 2552 328 a45d264c0fd34bcab8bedd7cd9d40696c933277aab140a69b70cf1cf8c4df165.exe 30 PID 2552 wrote to memory of 2520 2552 5vvpv.exe 31 PID 2552 wrote to memory of 2520 2552 5vvpv.exe 31 PID 2552 wrote to memory of 2520 2552 5vvpv.exe 31 PID 2552 wrote to memory of 2520 2552 5vvpv.exe 31 PID 2520 wrote to memory of 1728 2520 ddddj.exe 32 PID 2520 wrote to memory of 1728 2520 ddddj.exe 32 PID 2520 wrote to memory of 1728 2520 ddddj.exe 32 PID 2520 wrote to memory of 1728 2520 ddddj.exe 32 PID 1728 wrote to memory of 2664 1728 lfxllfr.exe 33 PID 1728 wrote to memory of 2664 1728 lfxllfr.exe 33 PID 1728 wrote to memory of 2664 1728 lfxllfr.exe 33 PID 1728 wrote to memory of 2664 1728 lfxllfr.exe 33 PID 2664 wrote to memory of 2672 2664 7nhhnn.exe 34 PID 2664 wrote to memory of 2672 2664 7nhhnn.exe 34 PID 2664 wrote to memory of 2672 2664 7nhhnn.exe 34 PID 2664 wrote to memory of 2672 2664 7nhhnn.exe 34 PID 2672 wrote to memory of 2684 2672 3jdjv.exe 68 PID 2672 wrote to memory of 2684 2672 3jdjv.exe 68 PID 2672 wrote to memory of 2684 2672 3jdjv.exe 68 PID 2672 wrote to memory of 2684 2672 3jdjv.exe 68 PID 2684 wrote to memory of 2864 2684 rrrxlrl.exe 36 PID 2684 wrote to memory of 2864 2684 rrrxlrl.exe 36 PID 2684 wrote to memory of 2864 2684 rrrxlrl.exe 36 PID 2684 wrote to memory of 2864 2684 rrrxlrl.exe 36 PID 2864 wrote to memory of 2264 2864 rlfrlrf.exe 71 PID 2864 wrote to memory of 2264 2864 rlfrlrf.exe 71 PID 2864 wrote to memory of 2264 2864 rlfrlrf.exe 71 PID 2864 wrote to memory of 2264 2864 rlfrlrf.exe 71 PID 2264 wrote to memory of 2824 2264 thtntt.exe 38 PID 2264 wrote to memory of 2824 2264 thtntt.exe 38 PID 2264 wrote to memory of 2824 2264 thtntt.exe 38 PID 2264 wrote to memory of 2824 2264 thtntt.exe 38 PID 2824 wrote to memory of 2748 2824 vvppv.exe 39 PID 2824 wrote to memory of 2748 2824 vvppv.exe 39 PID 2824 wrote to memory of 2748 2824 vvppv.exe 39 PID 2824 wrote to memory of 2748 2824 vvppv.exe 39 PID 2748 wrote to memory of 2644 2748 dvdjp.exe 40 PID 2748 wrote to memory of 2644 2748 dvdjp.exe 40 PID 2748 wrote to memory of 2644 2748 dvdjp.exe 40 PID 2748 wrote to memory of 2644 2748 dvdjp.exe 40 PID 2644 wrote to memory of 3016 2644 7vvpv.exe 41 PID 2644 wrote to memory of 3016 2644 7vvpv.exe 41 PID 2644 wrote to memory of 3016 2644 7vvpv.exe 41 PID 2644 wrote to memory of 3016 2644 7vvpv.exe 41 PID 3016 wrote to memory of 1544 3016 7fxxffl.exe 42 PID 3016 wrote to memory of 1544 3016 7fxxffl.exe 42 PID 3016 wrote to memory of 1544 3016 7fxxffl.exe 42 PID 3016 wrote to memory of 1544 3016 7fxxffl.exe 42 PID 1544 wrote to memory of 1432 1544 lfrflfl.exe 43 PID 1544 wrote to memory of 1432 1544 lfrflfl.exe 43 PID 1544 wrote to memory of 1432 1544 lfrflfl.exe 43 PID 1544 wrote to memory of 1432 1544 lfrflfl.exe 43 PID 1432 wrote to memory of 2124 1432 hhtttb.exe 44 PID 1432 wrote to memory of 2124 1432 hhtttb.exe 44 PID 1432 wrote to memory of 2124 1432 hhtttb.exe 44 PID 1432 wrote to memory of 2124 1432 hhtttb.exe 44 PID 2124 wrote to memory of 1824 2124 tnbhtb.exe 45 PID 2124 wrote to memory of 1824 2124 tnbhtb.exe 45 PID 2124 wrote to memory of 1824 2124 tnbhtb.exe 45 PID 2124 wrote to memory of 1824 2124 tnbhtb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\a45d264c0fd34bcab8bedd7cd9d40696c933277aab140a69b70cf1cf8c4df165.exe"C:\Users\Admin\AppData\Local\Temp\a45d264c0fd34bcab8bedd7cd9d40696c933277aab140a69b70cf1cf8c4df165.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:328 -
\??\c:\5vvpv.exec:\5vvpv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\ddddj.exec:\ddddj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\lfxllfr.exec:\lfxllfr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\7nhhnn.exec:\7nhhnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\3jdjv.exec:\3jdjv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\rrrxlrl.exec:\rrrxlrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\rlfrlrf.exec:\rlfrlrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\thtntt.exec:\thtntt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\vvppv.exec:\vvppv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\dvdjp.exec:\dvdjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\7vvpv.exec:\7vvpv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\7fxxffl.exec:\7fxxffl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\lfrflfl.exec:\lfrflfl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
\??\c:\hhtttb.exec:\hhtttb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\tnbhtb.exec:\tnbhtb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\ththtb.exec:\ththtb.exe17⤵
- Executes dropped EXE
PID:1824 -
\??\c:\vpvvv.exec:\vpvvv.exe18⤵
- Executes dropped EXE
PID:828 -
\??\c:\ppjpv.exec:\ppjpv.exe19⤵
- Executes dropped EXE
PID:1940 -
\??\c:\9xxxlxf.exec:\9xxxlxf.exe20⤵
- Executes dropped EXE
PID:1604 -
\??\c:\1xxflxl.exec:\1xxflxl.exe21⤵
- Executes dropped EXE
PID:2756 -
\??\c:\fxlfrxf.exec:\fxlfrxf.exe22⤵
- Executes dropped EXE
PID:532 -
\??\c:\tnhntt.exec:\tnhntt.exe23⤵
- Executes dropped EXE
PID:1048 -
\??\c:\tntthh.exec:\tntthh.exe24⤵
- Executes dropped EXE
PID:1956 -
\??\c:\dvpjd.exec:\dvpjd.exe25⤵
- Executes dropped EXE
PID:1216 -
\??\c:\dppvj.exec:\dppvj.exe26⤵
- Executes dropped EXE
PID:1968 -
\??\c:\lxrlxff.exec:\lxrlxff.exe27⤵
- Executes dropped EXE
PID:704 -
\??\c:\7lxlrrr.exec:\7lxlrrr.exe28⤵
- Executes dropped EXE
PID:1556 -
\??\c:\9hhhth.exec:\9hhhth.exe29⤵
- Executes dropped EXE
PID:2324 -
\??\c:\7hbthh.exec:\7hbthh.exe30⤵
- Executes dropped EXE
PID:2360 -
\??\c:\dpdjp.exec:\dpdjp.exe31⤵
- Executes dropped EXE
PID:2436 -
\??\c:\llfrxlr.exec:\llfrxlr.exe32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2196 -
\??\c:\5rflxfl.exec:\5rflxfl.exe33⤵
- Executes dropped EXE
PID:2192 -
\??\c:\3xrrrxf.exec:\3xrrrxf.exe34⤵
- Executes dropped EXE
PID:2216 -
\??\c:\bhnnbb.exec:\bhnnbb.exe35⤵
- Executes dropped EXE
PID:2492 -
\??\c:\9tnttt.exec:\9tnttt.exe36⤵
- Executes dropped EXE
PID:2924 -
\??\c:\vpjvj.exec:\vpjvj.exe37⤵
- Executes dropped EXE
PID:1512 -
\??\c:\jjjvd.exec:\jjjvd.exe38⤵
- Executes dropped EXE
PID:2016 -
\??\c:\rlxfllx.exec:\rlxfllx.exe39⤵
- Executes dropped EXE
PID:2724 -
\??\c:\1lfrxxr.exec:\1lfrxxr.exe40⤵
- Executes dropped EXE
PID:2684 -
\??\c:\rlrrxxr.exec:\rlrrxxr.exe41⤵
- Executes dropped EXE
PID:2012 -
\??\c:\9thntt.exec:\9thntt.exe42⤵
- Executes dropped EXE
PID:2952 -
\??\c:\hhtnnt.exec:\hhtnnt.exe43⤵
- Executes dropped EXE
PID:2264 -
\??\c:\vpddv.exec:\vpddv.exe44⤵
- Executes dropped EXE
PID:2780 -
\??\c:\jddjv.exec:\jddjv.exe45⤵
- Executes dropped EXE
PID:2636 -
\??\c:\jddjp.exec:\jddjp.exe46⤵
- Executes dropped EXE
PID:3020 -
\??\c:\xrxxffl.exec:\xrxxffl.exe47⤵
- Executes dropped EXE
PID:1708 -
\??\c:\7llxlrr.exec:\7llxlrr.exe48⤵
- Executes dropped EXE
PID:1620 -
\??\c:\bbnntb.exec:\bbnntb.exe49⤵
- Executes dropped EXE
PID:2616 -
\??\c:\tnthhn.exec:\tnthhn.exe50⤵
- Executes dropped EXE
PID:1464 -
\??\c:\nnbbhb.exec:\nnbbhb.exe51⤵
- Executes dropped EXE
PID:2124 -
\??\c:\pjjvd.exec:\pjjvd.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1824 -
\??\c:\1xlrrlr.exec:\1xlrrlr.exe53⤵
- Executes dropped EXE
PID:2592 -
\??\c:\xrfrffx.exec:\xrfrffx.exe54⤵
- Executes dropped EXE
PID:1964 -
\??\c:\tthnbb.exec:\tthnbb.exe55⤵
- Executes dropped EXE
PID:2640 -
\??\c:\7nbtnn.exec:\7nbtnn.exe56⤵
- Executes dropped EXE
PID:1604 -
\??\c:\hbtnbh.exec:\hbtnbh.exe57⤵
- Executes dropped EXE
PID:1696 -
\??\c:\jvddj.exec:\jvddj.exe58⤵
- Executes dropped EXE
PID:2176 -
\??\c:\vpdpp.exec:\vpdpp.exe59⤵
- Executes dropped EXE
PID:1768 -
\??\c:\jvjpp.exec:\jvjpp.exe60⤵
- Executes dropped EXE
PID:444 -
\??\c:\xlxfllr.exec:\xlxfllr.exe61⤵
- Executes dropped EXE
PID:1948 -
\??\c:\frffrxl.exec:\frffrxl.exe62⤵
- Executes dropped EXE
PID:1444 -
\??\c:\rxllrlx.exec:\rxllrlx.exe63⤵
- Executes dropped EXE
PID:1216 -
\??\c:\ttbtht.exec:\ttbtht.exe64⤵
- Executes dropped EXE
PID:1204 -
\??\c:\btnbbn.exec:\btnbbn.exe65⤵
- Executes dropped EXE
PID:2288 -
\??\c:\pjdvd.exec:\pjdvd.exe66⤵PID:1840
-
\??\c:\xrffxfl.exec:\xrffxfl.exe67⤵PID:3068
-
\??\c:\fxlxxfl.exec:\fxlxxfl.exe68⤵PID:1864
-
\??\c:\hhtnnh.exec:\hhtnnh.exe69⤵PID:1528
-
\??\c:\dvpdp.exec:\dvpdp.exe70⤵PID:328
-
\??\c:\xlrxlrl.exec:\xlrxlrl.exe71⤵PID:2068
-
\??\c:\xxrxffr.exec:\xxrxffr.exe72⤵PID:2232
-
\??\c:\7hhhth.exec:\7hhhth.exe73⤵PID:1792
-
\??\c:\vpvvd.exec:\vpvvd.exe74⤵PID:2216
-
\??\c:\llxxrxl.exec:\llxxrxl.exe75⤵PID:2120
-
\??\c:\fxxflrf.exec:\fxxflrf.exe76⤵PID:2512
-
\??\c:\9nhntb.exec:\9nhntb.exe77⤵PID:2660
-
\??\c:\tnnbhh.exec:\tnnbhh.exe78⤵PID:1512
-
\??\c:\7djvd.exec:\7djvd.exe79⤵PID:2768
-
\??\c:\9dvvj.exec:\9dvvj.exe80⤵PID:2724
-
\??\c:\xrrrxfr.exec:\xrrrxfr.exe81⤵PID:2848
-
\??\c:\tbnnbt.exec:\tbnnbt.exe82⤵PID:2136
-
\??\c:\hhbttt.exec:\hhbttt.exe83⤵PID:2668
-
\??\c:\ppvdv.exec:\ppvdv.exe84⤵PID:2888
-
\??\c:\lfffrrf.exec:\lfffrrf.exe85⤵PID:2940
-
\??\c:\nnntbh.exec:\nnntbh.exe86⤵PID:2748
-
\??\c:\dvvvv.exec:\dvvvv.exe87⤵PID:3024
-
\??\c:\9jvvj.exec:\9jvvj.exe88⤵PID:1300
-
\??\c:\xrlxfrf.exec:\xrlxfrf.exe89⤵PID:1544
-
\??\c:\nhbbhn.exec:\nhbbhn.exe90⤵PID:1432
-
\??\c:\pvjdd.exec:\pvjdd.exe91⤵PID:1716
-
\??\c:\fxxxfxl.exec:\fxxxfxl.exe92⤵
- System Location Discovery: System Language Discovery
PID:1880 -
\??\c:\nnbhtn.exec:\nnbhtn.exe93⤵PID:2124
-
\??\c:\ppjpp.exec:\ppjpp.exe94⤵PID:1824
-
\??\c:\7rfrxfl.exec:\7rfrxfl.exe95⤵PID:1532
-
\??\c:\7fffffr.exec:\7fffffr.exe96⤵PID:1964
-
\??\c:\hbbbtb.exec:\hbbbtb.exe97⤵PID:2640
-
\??\c:\btnttb.exec:\btnttb.exe98⤵PID:1604
-
\??\c:\vjvdp.exec:\vjvdp.exe99⤵PID:1696
-
\??\c:\jpjjp.exec:\jpjjp.exe100⤵PID:2176
-
\??\c:\ffflrrx.exec:\ffflrrx.exe101⤵PID:1768
-
\??\c:\fxrlrrx.exec:\fxrlrrx.exe102⤵PID:444
-
\??\c:\5tbtnb.exec:\5tbtnb.exe103⤵PID:2680
-
\??\c:\nnbbtb.exec:\nnbbtb.exe104⤵PID:2784
-
\??\c:\djjpv.exec:\djjpv.exe105⤵PID:1568
-
\??\c:\vpdjj.exec:\vpdjj.exe106⤵
- System Location Discovery: System Language Discovery
PID:2912 -
\??\c:\ddddd.exec:\ddddd.exe107⤵PID:392
-
\??\c:\rllxfrx.exec:\rllxfrx.exe108⤵PID:1552
-
\??\c:\lfxfxlx.exec:\lfxfxlx.exe109⤵PID:876
-
\??\c:\btntbb.exec:\btntbb.exe110⤵PID:1896
-
\??\c:\nhnnnh.exec:\nhnnnh.exe111⤵PID:1864
-
\??\c:\vpddj.exec:\vpddj.exe112⤵PID:2524
-
\??\c:\ppdvd.exec:\ppdvd.exe113⤵PID:328
-
\??\c:\lfxrxfr.exec:\lfxrxfr.exe114⤵PID:1168
-
\??\c:\xxrxllr.exec:\xxrxllr.exe115⤵PID:844
-
\??\c:\1nnthn.exec:\1nnthn.exe116⤵PID:756
-
\??\c:\bbtbhn.exec:\bbtbhn.exe117⤵PID:2084
-
\??\c:\pjddj.exec:\pjddj.exe118⤵PID:1508
-
\??\c:\rllxllf.exec:\rllxllf.exe119⤵PID:2664
-
\??\c:\lxlrxff.exec:\lxlrxff.exe120⤵PID:2884
-
\??\c:\bthntt.exec:\bthntt.exe121⤵PID:2728
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-