Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-12-2024 04:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e0829a2c00d58c231653c30380fa62623e86c0f1464932a100594b1f0beaa886N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
e0829a2c00d58c231653c30380fa62623e86c0f1464932a100594b1f0beaa886N.exe
-
Size
454KB
-
MD5
421d2a75a6ac51faa655fd916c253000
-
SHA1
6eb113e876829cb66fe8ef582ccebdaa7b7b3417
-
SHA256
e0829a2c00d58c231653c30380fa62623e86c0f1464932a100594b1f0beaa886
-
SHA512
df16774ff525b54c59650510dbb7fb2c0dfd2739d6047535625a0b8b2b8e2bbd7d76376aa05d767ca15c95b932f16796d6552e05615f42858988ff263b50cb7a
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbec:q7Tc2NYHUrAwfMp3CDc
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/2704-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2340-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1676-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/996-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1692-102-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1692-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1380-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-139-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1636-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2240-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-196-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2092-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2312-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2328-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/896-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-308-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/2592-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2256-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-394-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2760-407-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2076-433-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-453-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2428-521-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1872-528-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2328-535-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-578-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2388-641-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/568-642-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/552-654-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/552-657-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-787-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2272-802-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2784-853-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2972-880-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2684 pjjjp.exe 2828 nnbbbt.exe 2340 xrfrlrf.exe 2548 nhtbhn.exe 2324 rxfxfxl.exe 1676 fflxfrl.exe 2940 3jdjp.exe 2420 rlfrlrr.exe 996 3dvdp.exe 1692 lffrflr.exe 1380 btnbhn.exe 1056 vdvpd.exe 772 tbtbnt.exe 2808 bbtbnb.exe 2896 vvvdp.exe 1636 tntnnh.exe 2240 dddjv.exe 1456 hbbnbh.exe 2188 fflflfx.exe 2344 bbbtbh.exe 2092 pppjd.exe 1304 xxrfrxl.exe 2312 dvpjp.exe 1732 dvppv.exe 2428 tnbhtb.exe 1592 dvpdj.exe 2328 hbbhtb.exe 2220 pjjvp.exe 1776 hhttbn.exe 896 dddpj.exe 2708 llxlfrl.exe 2228 5bntnt.exe 2652 lflllfr.exe 3008 nhbtnt.exe 2724 dvppd.exe 2592 xxrfrxf.exe 2672 thtnbb.exe 2960 5jddp.exe 2256 flfxlxl.exe 2860 btttbb.exe 2940 jdvjp.exe 1848 ddddj.exe 1464 ffflrfr.exe 1172 btbhtn.exe 2020 5ddpj.exe 2348 llxlxfl.exe 2012 ttttbn.exe 2760 nhbntb.exe 772 dddvv.exe 1684 ffrfxxf.exe 1864 5nbhnt.exe 2076 5djdp.exe 1000 xrlrlrl.exe 2216 tnhhth.exe 2380 vpjpv.exe 1456 fffxflf.exe 3044 xxlxlrf.exe 2128 1nhnht.exe 1868 1vppd.exe 804 fllxxff.exe 2800 3nbbbh.exe 1744 dvjpp.exe 1944 xrflrxl.exe 1728 nhhnbh.exe -
resource yara_rule behavioral1/memory/2684-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1676-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/996-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1380-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2240-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/896-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/772-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1872-528-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-535-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1216-554-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-578-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-641-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/568-642-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/552-649-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/552-657-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-722-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-787-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-794-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-839-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-847-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-853-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2600-855-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-880-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlflrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllfxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2704 wrote to memory of 2684 2704 e0829a2c00d58c231653c30380fa62623e86c0f1464932a100594b1f0beaa886N.exe 30 PID 2704 wrote to memory of 2684 2704 e0829a2c00d58c231653c30380fa62623e86c0f1464932a100594b1f0beaa886N.exe 30 PID 2704 wrote to memory of 2684 2704 e0829a2c00d58c231653c30380fa62623e86c0f1464932a100594b1f0beaa886N.exe 30 PID 2704 wrote to memory of 2684 2704 e0829a2c00d58c231653c30380fa62623e86c0f1464932a100594b1f0beaa886N.exe 30 PID 2684 wrote to memory of 2828 2684 pjjjp.exe 31 PID 2684 wrote to memory of 2828 2684 pjjjp.exe 31 PID 2684 wrote to memory of 2828 2684 pjjjp.exe 31 PID 2684 wrote to memory of 2828 2684 pjjjp.exe 31 PID 2828 wrote to memory of 2340 2828 nnbbbt.exe 32 PID 2828 wrote to memory of 2340 2828 nnbbbt.exe 32 PID 2828 wrote to memory of 2340 2828 nnbbbt.exe 32 PID 2828 wrote to memory of 2340 2828 nnbbbt.exe 32 PID 2340 wrote to memory of 2548 2340 xrfrlrf.exe 33 PID 2340 wrote to memory of 2548 2340 xrfrlrf.exe 33 PID 2340 wrote to memory of 2548 2340 xrfrlrf.exe 33 PID 2340 wrote to memory of 2548 2340 xrfrlrf.exe 33 PID 2548 wrote to memory of 2324 2548 nhtbhn.exe 34 PID 2548 wrote to memory of 2324 2548 nhtbhn.exe 34 PID 2548 wrote to memory of 2324 2548 nhtbhn.exe 34 PID 2548 wrote to memory of 2324 2548 nhtbhn.exe 34 PID 2324 wrote to memory of 1676 2324 rxfxfxl.exe 35 PID 2324 wrote to memory of 1676 2324 rxfxfxl.exe 35 PID 2324 wrote to memory of 1676 2324 rxfxfxl.exe 35 PID 2324 wrote to memory of 1676 2324 rxfxfxl.exe 35 PID 1676 wrote to memory of 2940 1676 fflxfrl.exe 36 PID 1676 wrote to memory of 2940 1676 fflxfrl.exe 36 PID 1676 wrote to memory of 2940 1676 fflxfrl.exe 36 PID 1676 wrote to memory of 2940 1676 fflxfrl.exe 36 PID 2940 wrote to memory of 2420 2940 3jdjp.exe 37 PID 2940 wrote to memory of 2420 2940 3jdjp.exe 37 PID 2940 wrote to memory of 2420 2940 3jdjp.exe 37 PID 2940 wrote to memory of 2420 2940 3jdjp.exe 37 PID 2420 wrote to memory of 996 2420 rlfrlrr.exe 38 PID 2420 wrote to memory of 996 2420 rlfrlrr.exe 38 PID 2420 wrote to memory of 996 2420 rlfrlrr.exe 38 PID 2420 wrote to memory of 996 2420 rlfrlrr.exe 38 PID 996 wrote to memory of 1692 996 3dvdp.exe 39 PID 996 wrote to memory of 1692 996 3dvdp.exe 39 PID 996 wrote to memory of 1692 996 3dvdp.exe 39 PID 996 wrote to memory of 1692 996 3dvdp.exe 39 PID 1692 wrote to memory of 1380 1692 lffrflr.exe 40 PID 1692 wrote to memory of 1380 1692 lffrflr.exe 40 PID 1692 wrote to memory of 1380 1692 lffrflr.exe 40 PID 1692 wrote to memory of 1380 1692 lffrflr.exe 40 PID 1380 wrote to memory of 1056 1380 btnbhn.exe 41 PID 1380 wrote to memory of 1056 1380 btnbhn.exe 41 PID 1380 wrote to memory of 1056 1380 btnbhn.exe 41 PID 1380 wrote to memory of 1056 1380 btnbhn.exe 41 PID 1056 wrote to memory of 772 1056 vdvpd.exe 42 PID 1056 wrote to memory of 772 1056 vdvpd.exe 42 PID 1056 wrote to memory of 772 1056 vdvpd.exe 42 PID 1056 wrote to memory of 772 1056 vdvpd.exe 42 PID 772 wrote to memory of 2808 772 tbtbnt.exe 43 PID 772 wrote to memory of 2808 772 tbtbnt.exe 43 PID 772 wrote to memory of 2808 772 tbtbnt.exe 43 PID 772 wrote to memory of 2808 772 tbtbnt.exe 43 PID 2808 wrote to memory of 2896 2808 bbtbnb.exe 44 PID 2808 wrote to memory of 2896 2808 bbtbnb.exe 44 PID 2808 wrote to memory of 2896 2808 bbtbnb.exe 44 PID 2808 wrote to memory of 2896 2808 bbtbnb.exe 44 PID 2896 wrote to memory of 1636 2896 vvvdp.exe 45 PID 2896 wrote to memory of 1636 2896 vvvdp.exe 45 PID 2896 wrote to memory of 1636 2896 vvvdp.exe 45 PID 2896 wrote to memory of 1636 2896 vvvdp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\e0829a2c00d58c231653c30380fa62623e86c0f1464932a100594b1f0beaa886N.exe"C:\Users\Admin\AppData\Local\Temp\e0829a2c00d58c231653c30380fa62623e86c0f1464932a100594b1f0beaa886N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\pjjjp.exec:\pjjjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\nnbbbt.exec:\nnbbbt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\xrfrlrf.exec:\xrfrlrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\nhtbhn.exec:\nhtbhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\rxfxfxl.exec:\rxfxfxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\fflxfrl.exec:\fflxfrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\3jdjp.exec:\3jdjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\rlfrlrr.exec:\rlfrlrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\3dvdp.exec:\3dvdp.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:996 -
\??\c:\lffrflr.exec:\lffrflr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\btnbhn.exec:\btnbhn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
\??\c:\vdvpd.exec:\vdvpd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\tbtbnt.exec:\tbtbnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
\??\c:\bbtbnb.exec:\bbtbnb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\vvvdp.exec:\vvvdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\tntnnh.exec:\tntnnh.exe17⤵
- Executes dropped EXE
PID:1636 -
\??\c:\dddjv.exec:\dddjv.exe18⤵
- Executes dropped EXE
PID:2240 -
\??\c:\hbbnbh.exec:\hbbnbh.exe19⤵
- Executes dropped EXE
PID:1456 -
\??\c:\fflflfx.exec:\fflflfx.exe20⤵
- Executes dropped EXE
PID:2188 -
\??\c:\bbbtbh.exec:\bbbtbh.exe21⤵
- Executes dropped EXE
PID:2344 -
\??\c:\pppjd.exec:\pppjd.exe22⤵
- Executes dropped EXE
PID:2092 -
\??\c:\xxrfrxl.exec:\xxrfrxl.exe23⤵
- Executes dropped EXE
PID:1304 -
\??\c:\dvpjp.exec:\dvpjp.exe24⤵
- Executes dropped EXE
PID:2312 -
\??\c:\dvppv.exec:\dvppv.exe25⤵
- Executes dropped EXE
PID:1732 -
\??\c:\tnbhtb.exec:\tnbhtb.exe26⤵
- Executes dropped EXE
PID:2428 -
\??\c:\dvpdj.exec:\dvpdj.exe27⤵
- Executes dropped EXE
PID:1592 -
\??\c:\hbbhtb.exec:\hbbhtb.exe28⤵
- Executes dropped EXE
PID:2328 -
\??\c:\pjjvp.exec:\pjjvp.exe29⤵
- Executes dropped EXE
PID:2220 -
\??\c:\hhttbn.exec:\hhttbn.exe30⤵
- Executes dropped EXE
PID:1776 -
\??\c:\dddpj.exec:\dddpj.exe31⤵
- Executes dropped EXE
PID:896 -
\??\c:\llxlfrl.exec:\llxlfrl.exe32⤵
- Executes dropped EXE
PID:2708 -
\??\c:\5bntnt.exec:\5bntnt.exe33⤵
- Executes dropped EXE
PID:2228 -
\??\c:\lflllfr.exec:\lflllfr.exe34⤵
- Executes dropped EXE
PID:2652 -
\??\c:\nhbtnt.exec:\nhbtnt.exe35⤵
- Executes dropped EXE
PID:3008 -
\??\c:\dvppd.exec:\dvppd.exe36⤵
- Executes dropped EXE
PID:2724 -
\??\c:\xxrfrxf.exec:\xxrfrxf.exe37⤵
- Executes dropped EXE
PID:2592 -
\??\c:\thtnbb.exec:\thtnbb.exe38⤵
- Executes dropped EXE
PID:2672 -
\??\c:\5jddp.exec:\5jddp.exe39⤵
- Executes dropped EXE
PID:2960 -
\??\c:\flfxlxl.exec:\flfxlxl.exe40⤵
- Executes dropped EXE
PID:2256 -
\??\c:\btttbb.exec:\btttbb.exe41⤵
- Executes dropped EXE
PID:2860 -
\??\c:\jdvjp.exec:\jdvjp.exe42⤵
- Executes dropped EXE
PID:2940 -
\??\c:\ddddj.exec:\ddddj.exe43⤵
- Executes dropped EXE
PID:1848 -
\??\c:\ffflrfr.exec:\ffflrfr.exe44⤵
- Executes dropped EXE
PID:1464 -
\??\c:\btbhtn.exec:\btbhtn.exe45⤵
- Executes dropped EXE
PID:1172 -
\??\c:\5ddpj.exec:\5ddpj.exe46⤵
- Executes dropped EXE
PID:2020 -
\??\c:\llxlxfl.exec:\llxlxfl.exe47⤵
- Executes dropped EXE
PID:2348 -
\??\c:\ttttbn.exec:\ttttbn.exe48⤵
- Executes dropped EXE
PID:2012 -
\??\c:\nhbntb.exec:\nhbntb.exe49⤵
- Executes dropped EXE
PID:2760 -
\??\c:\dddvv.exec:\dddvv.exe50⤵
- Executes dropped EXE
PID:772 -
\??\c:\ffrfxxf.exec:\ffrfxxf.exe51⤵
- Executes dropped EXE
PID:1684 -
\??\c:\5nbhnt.exec:\5nbhnt.exe52⤵
- Executes dropped EXE
PID:1864 -
\??\c:\5djdp.exec:\5djdp.exe53⤵
- Executes dropped EXE
PID:2076 -
\??\c:\xrlrlrl.exec:\xrlrlrl.exe54⤵
- Executes dropped EXE
PID:1000 -
\??\c:\tnhhth.exec:\tnhhth.exe55⤵
- Executes dropped EXE
PID:2216 -
\??\c:\vpjpv.exec:\vpjpv.exe56⤵
- Executes dropped EXE
PID:2380 -
\??\c:\fffxflf.exec:\fffxflf.exe57⤵
- Executes dropped EXE
PID:1456 -
\??\c:\xxlxlrf.exec:\xxlxlrf.exe58⤵
- Executes dropped EXE
PID:3044 -
\??\c:\1nhnht.exec:\1nhnht.exe59⤵
- Executes dropped EXE
PID:2128 -
\??\c:\1vppd.exec:\1vppd.exe60⤵
- Executes dropped EXE
PID:1868 -
\??\c:\fllxxff.exec:\fllxxff.exe61⤵
- Executes dropped EXE
PID:804 -
\??\c:\3nbbbh.exec:\3nbbbh.exe62⤵
- Executes dropped EXE
PID:2800 -
\??\c:\dvjpp.exec:\dvjpp.exe63⤵
- Executes dropped EXE
PID:1744 -
\??\c:\xrflrxl.exec:\xrflrxl.exe64⤵
- Executes dropped EXE
PID:1944 -
\??\c:\nhhnbh.exec:\nhhnbh.exe65⤵
- Executes dropped EXE
PID:1728 -
\??\c:\3vjvj.exec:\3vjvj.exe66⤵PID:2428
-
\??\c:\pdvvd.exec:\pdvvd.exe67⤵PID:1872
-
\??\c:\llrxffx.exec:\llrxffx.exe68⤵PID:2328
-
\??\c:\tnbntt.exec:\tnbntt.exe69⤵PID:1856
-
\??\c:\jpvjv.exec:\jpvjv.exe70⤵PID:2480
-
\??\c:\llrfxxl.exec:\llrfxxl.exe71⤵PID:1776
-
\??\c:\1hhnbn.exec:\1hhnbn.exe72⤵PID:1216
-
\??\c:\bbnbhh.exec:\bbnbhh.exe73⤵PID:2880
-
\??\c:\1ddjv.exec:\1ddjv.exe74⤵PID:2812
-
\??\c:\lfllrxf.exec:\lfllrxf.exe75⤵PID:2712
-
\??\c:\tnbbnn.exec:\tnbbnn.exe76⤵PID:2796
-
\??\c:\jjppp.exec:\jjppp.exe77⤵PID:2564
-
\??\c:\xrffrrx.exec:\xrffrrx.exe78⤵PID:2620
-
\??\c:\xrrxfff.exec:\xrrxfff.exe79⤵PID:1920
-
\??\c:\hbtbtb.exec:\hbtbtb.exe80⤵PID:1276
-
\??\c:\7pdpv.exec:\7pdpv.exe81⤵PID:2468
-
\??\c:\fxllxfr.exec:\fxllxfr.exe82⤵PID:2256
-
\??\c:\lxlfffl.exec:\lxlfffl.exe83⤵PID:1924
-
\??\c:\tntnnt.exec:\tntnnt.exe84⤵PID:824
-
\??\c:\vjjpj.exec:\vjjpj.exe85⤵PID:2388
-
\??\c:\pdddd.exec:\pdddd.exe86⤵PID:568
-
\??\c:\rflxxxf.exec:\rflxxxf.exe87⤵PID:552
-
\??\c:\ttttnb.exec:\ttttnb.exe88⤵PID:1952
-
\??\c:\ppjpd.exec:\ppjpd.exe89⤵PID:1056
-
\??\c:\xlxxrxl.exec:\xlxxrxl.exe90⤵PID:868
-
\??\c:\nntntt.exec:\nntntt.exe91⤵PID:2532
-
\??\c:\dvpvv.exec:\dvpvv.exe92⤵PID:2808
-
\??\c:\lflrrfx.exec:\lflrrfx.exe93⤵PID:1748
-
\??\c:\nhtbnn.exec:\nhtbnn.exe94⤵PID:2884
-
\??\c:\hbhhnb.exec:\hbhhnb.exe95⤵PID:2248
-
\??\c:\dvvjp.exec:\dvvjp.exe96⤵PID:2184
-
\??\c:\ffxlflf.exec:\ffxlflf.exe97⤵PID:2176
-
\??\c:\xxxrrrx.exec:\xxxrrrx.exe98⤵PID:2224
-
\??\c:\nhhbtt.exec:\nhhbtt.exe99⤵PID:1448
-
\??\c:\pjdpj.exec:\pjdpj.exe100⤵PID:3044
-
\??\c:\5lfrrrx.exec:\5lfrrrx.exe101⤵PID:2356
-
\??\c:\7fxfrxx.exec:\7fxfrxx.exe102⤵PID:288
-
\??\c:\bbnbnt.exec:\bbnbnt.exe103⤵PID:1972
-
\??\c:\3ppdv.exec:\3ppdv.exe104⤵PID:716
-
\??\c:\rlflrxl.exec:\rlflrxl.exe105⤵
- System Location Discovery: System Language Discovery
PID:1744 -
\??\c:\nttbnb.exec:\nttbnb.exe106⤵PID:348
-
\??\c:\1ttbnn.exec:\1ttbnn.exe107⤵PID:1980
-
\??\c:\pjdvd.exec:\pjdvd.exe108⤵PID:2916
-
\??\c:\llllxlr.exec:\llllxlr.exe109⤵PID:2272
-
\??\c:\nhhtnb.exec:\nhhtnb.exe110⤵PID:3004
-
\??\c:\dvjjv.exec:\dvjjv.exe111⤵PID:2140
-
\??\c:\fxrxfll.exec:\fxrxfll.exe112⤵PID:2744
-
\??\c:\jjpvv.exec:\jjpvv.exe113⤵PID:2708
-
\??\c:\fllrllx.exec:\fllrllx.exe114⤵PID:2784
-
\??\c:\9hbhbh.exec:\9hbhbh.exe115⤵PID:2880
-
\??\c:\pdddp.exec:\pdddp.exe116⤵PID:2552
-
\??\c:\lfflxll.exec:\lfflxll.exe117⤵PID:3008
-
\??\c:\btnnnt.exec:\btnnnt.exe118⤵PID:2600
-
\??\c:\jjvdj.exec:\jjvdj.exe119⤵PID:2624
-
\??\c:\pvjdp.exec:\pvjdp.exe120⤵PID:2976
-
\??\c:\5rrxflx.exec:\5rrxflx.exe121⤵PID:2972
-
\??\c:\hbtbnt.exec:\hbtbnt.exe122⤵PID:3068
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-