Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-12-2024 20:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
22a4cacbdfac7f39519c8c22c63a1221567378952e8694a306e0a952f53cc62e.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
22a4cacbdfac7f39519c8c22c63a1221567378952e8694a306e0a952f53cc62e.exe
-
Size
454KB
-
MD5
ae56846ea334b9da4d29e64ee3657f20
-
SHA1
48bfb42c918fdb0c8073474603dd1b0c5c0a4c3d
-
SHA256
22a4cacbdfac7f39519c8c22c63a1221567378952e8694a306e0a952f53cc62e
-
SHA512
ac3113845ceb49d1c8e4ba69362b5ab49590677f0186dd1ac74aa4ab8ee2a753f39c528171b8f41e67112426745d3b1bede6f21f28d218619558a670c2703dc2
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeq:q7Tc2NYHUrAwfMp3CDq
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/2244-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-23-0x0000000000350000-0x000000000037A000-memory.dmp family_blackmoon behavioral1/memory/2824-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1116-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1248-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1968-138-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/632-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/548-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1276-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2444-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1724-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1600-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1600-230-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2272-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2272-263-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/768-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/800-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/332-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/768-308-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2816-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-353-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2764-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2232-506-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1888-531-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2248-592-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-607-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3000-605-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2836-632-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2368-712-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/316-851-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2332-858-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2472-1037-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2320-1065-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1644-1164-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1084-1347-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1452-1359-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1452-1361-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2244 pdjjp.exe 3064 dvpvd.exe 2956 lfxlxxr.exe 484 bbthth.exe 2824 dvpjp.exe 2732 vvppd.exe 2724 bntbbh.exe 2644 pjpjp.exe 2880 3ttthb.exe 2728 vpvjp.exe 3052 7jjdp.exe 1116 7pddj.exe 1248 nnbhnt.exe 1968 pjdjd.exe 632 vvvjp.exe 548 htbbhb.exe 1276 xxffllr.exe 268 9btthn.exe 2668 lfflrlx.exe 2704 ntthth.exe 2444 3vpvp.exe 960 5rxxlrf.exe 1724 pjvvj.exe 1600 9xlfxlx.exe 2316 5vppv.exe 1292 pjddp.exe 2464 vpvdj.exe 2272 llxlxfr.exe 2132 7tnttt.exe 768 lfxfrrf.exe 800 3hbnnn.exe 332 5fffrxl.exe 2128 7ntthn.exe 3004 3djpv.exe 320 jpvjp.exe 2264 3lxfflr.exe 3020 bthbnn.exe 2100 htbthh.exe 2816 jdppj.exe 2764 1xflrxf.exe 2284 hbtbhn.exe 2888 bthhnh.exe 2772 pjvpv.exe 2720 dvjpd.exe 2636 lxlfrrr.exe 2660 nbtthh.exe 2600 5nbhth.exe 1664 pppdj.exe 1988 7lxlrrx.exe 1256 bnbhhh.exe 1856 tthntn.exe 1708 9jvpj.exe 1892 fxrxffr.exe 1300 3rxflrx.exe 1320 htnbhn.exe 2580 tnntbb.exe 1932 jdjdv.exe 2852 5xrrxxl.exe 1680 bnbbbb.exe 2944 btthnt.exe 2940 jdpvv.exe 2196 lflxffl.exe 620 1lxfxxr.exe 2232 5bntbh.exe -
resource yara_rule behavioral1/memory/2244-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1116-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1248-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/632-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/548-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1276-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1276-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/768-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/800-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/332-299-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/332-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/320-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-353-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2764-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-480-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/620-493-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-506-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2248-592-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-599-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2100-620-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-632-0x0000000000250000-0x000000000027A000-memory.dmp upx behavioral1/memory/2368-712-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/316-851-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-858-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-877-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-1000-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1780-1075-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-1164-0x0000000000430000-0x000000000045A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlxxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1frlrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxxrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxlxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bntth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1flllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2128 wrote to memory of 2244 2128 22a4cacbdfac7f39519c8c22c63a1221567378952e8694a306e0a952f53cc62e.exe 31 PID 2128 wrote to memory of 2244 2128 22a4cacbdfac7f39519c8c22c63a1221567378952e8694a306e0a952f53cc62e.exe 31 PID 2128 wrote to memory of 2244 2128 22a4cacbdfac7f39519c8c22c63a1221567378952e8694a306e0a952f53cc62e.exe 31 PID 2128 wrote to memory of 2244 2128 22a4cacbdfac7f39519c8c22c63a1221567378952e8694a306e0a952f53cc62e.exe 31 PID 2244 wrote to memory of 3064 2244 pdjjp.exe 32 PID 2244 wrote to memory of 3064 2244 pdjjp.exe 32 PID 2244 wrote to memory of 3064 2244 pdjjp.exe 32 PID 2244 wrote to memory of 3064 2244 pdjjp.exe 32 PID 3064 wrote to memory of 2956 3064 dvpvd.exe 33 PID 3064 wrote to memory of 2956 3064 dvpvd.exe 33 PID 3064 wrote to memory of 2956 3064 dvpvd.exe 33 PID 3064 wrote to memory of 2956 3064 dvpvd.exe 33 PID 2956 wrote to memory of 484 2956 lfxlxxr.exe 34 PID 2956 wrote to memory of 484 2956 lfxlxxr.exe 34 PID 2956 wrote to memory of 484 2956 lfxlxxr.exe 34 PID 2956 wrote to memory of 484 2956 lfxlxxr.exe 34 PID 484 wrote to memory of 2824 484 bbthth.exe 35 PID 484 wrote to memory of 2824 484 bbthth.exe 35 PID 484 wrote to memory of 2824 484 bbthth.exe 35 PID 484 wrote to memory of 2824 484 bbthth.exe 35 PID 2824 wrote to memory of 2732 2824 dvpjp.exe 36 PID 2824 wrote to memory of 2732 2824 dvpjp.exe 36 PID 2824 wrote to memory of 2732 2824 dvpjp.exe 36 PID 2824 wrote to memory of 2732 2824 dvpjp.exe 36 PID 2732 wrote to memory of 2724 2732 vvppd.exe 37 PID 2732 wrote to memory of 2724 2732 vvppd.exe 37 PID 2732 wrote to memory of 2724 2732 vvppd.exe 37 PID 2732 wrote to memory of 2724 2732 vvppd.exe 37 PID 2724 wrote to memory of 2644 2724 bntbbh.exe 38 PID 2724 wrote to memory of 2644 2724 bntbbh.exe 38 PID 2724 wrote to memory of 2644 2724 bntbbh.exe 38 PID 2724 wrote to memory of 2644 2724 bntbbh.exe 38 PID 2644 wrote to memory of 2880 2644 pjpjp.exe 39 PID 2644 wrote to memory of 2880 2644 pjpjp.exe 39 PID 2644 wrote to memory of 2880 2644 pjpjp.exe 39 PID 2644 wrote to memory of 2880 2644 pjpjp.exe 39 PID 2880 wrote to memory of 2728 2880 3ttthb.exe 40 PID 2880 wrote to memory of 2728 2880 3ttthb.exe 40 PID 2880 wrote to memory of 2728 2880 3ttthb.exe 40 PID 2880 wrote to memory of 2728 2880 3ttthb.exe 40 PID 2728 wrote to memory of 3052 2728 vpvjp.exe 41 PID 2728 wrote to memory of 3052 2728 vpvjp.exe 41 PID 2728 wrote to memory of 3052 2728 vpvjp.exe 41 PID 2728 wrote to memory of 3052 2728 vpvjp.exe 41 PID 3052 wrote to memory of 1116 3052 7jjdp.exe 42 PID 3052 wrote to memory of 1116 3052 7jjdp.exe 42 PID 3052 wrote to memory of 1116 3052 7jjdp.exe 42 PID 3052 wrote to memory of 1116 3052 7jjdp.exe 42 PID 1116 wrote to memory of 1248 1116 7pddj.exe 43 PID 1116 wrote to memory of 1248 1116 7pddj.exe 43 PID 1116 wrote to memory of 1248 1116 7pddj.exe 43 PID 1116 wrote to memory of 1248 1116 7pddj.exe 43 PID 1248 wrote to memory of 1968 1248 nnbhnt.exe 44 PID 1248 wrote to memory of 1968 1248 nnbhnt.exe 44 PID 1248 wrote to memory of 1968 1248 nnbhnt.exe 44 PID 1248 wrote to memory of 1968 1248 nnbhnt.exe 44 PID 1968 wrote to memory of 632 1968 pjdjd.exe 45 PID 1968 wrote to memory of 632 1968 pjdjd.exe 45 PID 1968 wrote to memory of 632 1968 pjdjd.exe 45 PID 1968 wrote to memory of 632 1968 pjdjd.exe 45 PID 632 wrote to memory of 548 632 vvvjp.exe 46 PID 632 wrote to memory of 548 632 vvvjp.exe 46 PID 632 wrote to memory of 548 632 vvvjp.exe 46 PID 632 wrote to memory of 548 632 vvvjp.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\22a4cacbdfac7f39519c8c22c63a1221567378952e8694a306e0a952f53cc62e.exe"C:\Users\Admin\AppData\Local\Temp\22a4cacbdfac7f39519c8c22c63a1221567378952e8694a306e0a952f53cc62e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\pdjjp.exec:\pdjjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\dvpvd.exec:\dvpvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\lfxlxxr.exec:\lfxlxxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\bbthth.exec:\bbthth.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:484 -
\??\c:\dvpjp.exec:\dvpjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\vvppd.exec:\vvppd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\bntbbh.exec:\bntbbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\pjpjp.exec:\pjpjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\3ttthb.exec:\3ttthb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\vpvjp.exec:\vpvjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\7jjdp.exec:\7jjdp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\7pddj.exec:\7pddj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
\??\c:\nnbhnt.exec:\nnbhnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
\??\c:\pjdjd.exec:\pjdjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\vvvjp.exec:\vvvjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
\??\c:\htbbhb.exec:\htbbhb.exe17⤵
- Executes dropped EXE
PID:548 -
\??\c:\xxffllr.exec:\xxffllr.exe18⤵
- Executes dropped EXE
PID:1276 -
\??\c:\9btthn.exec:\9btthn.exe19⤵
- Executes dropped EXE
PID:268 -
\??\c:\lfflrlx.exec:\lfflrlx.exe20⤵
- Executes dropped EXE
PID:2668 -
\??\c:\ntthth.exec:\ntthth.exe21⤵
- Executes dropped EXE
PID:2704 -
\??\c:\3vpvp.exec:\3vpvp.exe22⤵
- Executes dropped EXE
PID:2444 -
\??\c:\5rxxlrf.exec:\5rxxlrf.exe23⤵
- Executes dropped EXE
PID:960 -
\??\c:\pjvvj.exec:\pjvvj.exe24⤵
- Executes dropped EXE
PID:1724 -
\??\c:\9xlfxlx.exec:\9xlfxlx.exe25⤵
- Executes dropped EXE
PID:1600 -
\??\c:\5vppv.exec:\5vppv.exe26⤵
- Executes dropped EXE
PID:2316 -
\??\c:\pjddp.exec:\pjddp.exe27⤵
- Executes dropped EXE
PID:1292 -
\??\c:\vpvdj.exec:\vpvdj.exe28⤵
- Executes dropped EXE
PID:2464 -
\??\c:\llxlxfr.exec:\llxlxfr.exe29⤵
- Executes dropped EXE
PID:2272 -
\??\c:\7tnttt.exec:\7tnttt.exe30⤵
- Executes dropped EXE
PID:2132 -
\??\c:\lfxfrrf.exec:\lfxfrrf.exe31⤵
- Executes dropped EXE
PID:768 -
\??\c:\3hbnnn.exec:\3hbnnn.exe32⤵
- Executes dropped EXE
PID:800 -
\??\c:\5fffrxl.exec:\5fffrxl.exe33⤵
- Executes dropped EXE
PID:332 -
\??\c:\7ntthn.exec:\7ntthn.exe34⤵
- Executes dropped EXE
PID:2128 -
\??\c:\3djpv.exec:\3djpv.exe35⤵
- Executes dropped EXE
PID:3004 -
\??\c:\jpvjp.exec:\jpvjp.exe36⤵
- Executes dropped EXE
PID:320 -
\??\c:\3lxfflr.exec:\3lxfflr.exe37⤵
- Executes dropped EXE
PID:2264 -
\??\c:\bthbnn.exec:\bthbnn.exe38⤵
- Executes dropped EXE
PID:3020 -
\??\c:\htbthh.exec:\htbthh.exe39⤵
- Executes dropped EXE
PID:2100 -
\??\c:\jdppj.exec:\jdppj.exe40⤵
- Executes dropped EXE
PID:2816 -
\??\c:\1xflrxf.exec:\1xflrxf.exe41⤵
- Executes dropped EXE
PID:2764 -
\??\c:\hbtbhn.exec:\hbtbhn.exe42⤵
- Executes dropped EXE
PID:2284 -
\??\c:\bthhnh.exec:\bthhnh.exe43⤵
- Executes dropped EXE
PID:2888 -
\??\c:\pjvpv.exec:\pjvpv.exe44⤵
- Executes dropped EXE
PID:2772 -
\??\c:\dvjpd.exec:\dvjpd.exe45⤵
- Executes dropped EXE
PID:2720 -
\??\c:\lxlfrrr.exec:\lxlfrrr.exe46⤵
- Executes dropped EXE
PID:2636 -
\??\c:\nbtthh.exec:\nbtthh.exe47⤵
- Executes dropped EXE
PID:2660 -
\??\c:\5nbhth.exec:\5nbhth.exe48⤵
- Executes dropped EXE
PID:2600 -
\??\c:\pppdj.exec:\pppdj.exe49⤵
- Executes dropped EXE
PID:1664 -
\??\c:\7lxlrrx.exec:\7lxlrrx.exe50⤵
- Executes dropped EXE
PID:1988 -
\??\c:\bnbhhh.exec:\bnbhhh.exe51⤵
- Executes dropped EXE
PID:1256 -
\??\c:\tthntn.exec:\tthntn.exe52⤵
- Executes dropped EXE
PID:1856 -
\??\c:\9jvpj.exec:\9jvpj.exe53⤵
- Executes dropped EXE
PID:1708 -
\??\c:\fxrxffr.exec:\fxrxffr.exe54⤵
- Executes dropped EXE
PID:1892 -
\??\c:\3rxflrx.exec:\3rxflrx.exe55⤵
- Executes dropped EXE
PID:1300 -
\??\c:\htnbhn.exec:\htnbhn.exe56⤵
- Executes dropped EXE
PID:1320 -
\??\c:\tnntbb.exec:\tnntbb.exe57⤵
- Executes dropped EXE
PID:2580 -
\??\c:\jdjdv.exec:\jdjdv.exe58⤵
- Executes dropped EXE
PID:1932 -
\??\c:\5xrrxxl.exec:\5xrrxxl.exe59⤵
- Executes dropped EXE
PID:2852 -
\??\c:\bnbbbb.exec:\bnbbbb.exe60⤵
- Executes dropped EXE
PID:1680 -
\??\c:\btthnt.exec:\btthnt.exe61⤵
- Executes dropped EXE
PID:2944 -
\??\c:\jdpvv.exec:\jdpvv.exe62⤵
- Executes dropped EXE
PID:2940 -
\??\c:\lflxffl.exec:\lflxffl.exe63⤵
- Executes dropped EXE
PID:2196 -
\??\c:\1lxfxxr.exec:\1lxfxxr.exe64⤵
- Executes dropped EXE
PID:620 -
\??\c:\5bntbh.exec:\5bntbh.exe65⤵
- Executes dropped EXE
PID:2232 -
\??\c:\pdjdj.exec:\pdjdj.exe66⤵PID:1888
-
\??\c:\jjvpd.exec:\jjvpd.exe67⤵PID:1600
-
\??\c:\3rfxxxr.exec:\3rfxxxr.exe68⤵PID:2848
-
\??\c:\5bnhht.exec:\5bnhht.exe69⤵PID:1824
-
\??\c:\nbtnnh.exec:\nbtnnh.exe70⤵PID:2288
-
\??\c:\vdppd.exec:\vdppd.exe71⤵PID:2064
-
\??\c:\3rxflrr.exec:\3rxflrr.exe72⤵PID:860
-
\??\c:\frxxllr.exec:\frxxllr.exe73⤵PID:992
-
\??\c:\nhhntt.exec:\nhhntt.exe74⤵PID:2280
-
\??\c:\dvdjp.exec:\dvdjp.exe75⤵PID:552
-
\??\c:\flrfxrx.exec:\flrfxrx.exe76⤵PID:2332
-
\??\c:\ffxrflr.exec:\ffxrflr.exe77⤵PID:2376
-
\??\c:\9tbtbt.exec:\9tbtbt.exe78⤵PID:1576
-
\??\c:\bthntt.exec:\bthntt.exe79⤵PID:2248
-
\??\c:\pjppv.exec:\pjppv.exe80⤵
- System Location Discovery: System Language Discovery
PID:3028 -
\??\c:\rlxfrxr.exec:\rlxfrxr.exe81⤵PID:3000
-
\??\c:\3lxffxx.exec:\3lxffxx.exe82⤵PID:3016
-
\??\c:\bnhhtb.exec:\bnhhtb.exe83⤵PID:3020
-
\??\c:\9dppd.exec:\9dppd.exe84⤵PID:2100
-
\??\c:\jdpvj.exec:\jdpvj.exe85⤵PID:2836
-
\??\c:\7frrrll.exec:\7frrrll.exe86⤵PID:2764
-
\??\c:\hbtbnn.exec:\hbtbnn.exe87⤵PID:2968
-
\??\c:\1ntttt.exec:\1ntttt.exe88⤵PID:2780
-
\??\c:\pjvvj.exec:\pjvvj.exe89⤵PID:2664
-
\??\c:\pjjjp.exec:\pjjjp.exe90⤵PID:2620
-
\??\c:\xrlrfff.exec:\xrlrfff.exe91⤵PID:2884
-
\??\c:\hhttbh.exec:\hhttbh.exe92⤵PID:2212
-
\??\c:\5bhbtb.exec:\5bhbtb.exe93⤵PID:2728
-
\??\c:\pdvvd.exec:\pdvvd.exe94⤵PID:664
-
\??\c:\lfxflrx.exec:\lfxflrx.exe95⤵PID:1764
-
\??\c:\bnbbhh.exec:\bnbbhh.exe96⤵PID:1248
-
\??\c:\7hbhnn.exec:\7hbhnn.exe97⤵PID:1800
-
\??\c:\pjvvv.exec:\pjvvv.exe98⤵PID:2368
-
\??\c:\1vjdd.exec:\1vjdd.exe99⤵PID:1852
-
\??\c:\xrlxxfr.exec:\xrlxxfr.exe100⤵
- System Location Discovery: System Language Discovery
PID:1692 -
\??\c:\5tbttn.exec:\5tbttn.exe101⤵PID:1960
-
\??\c:\7bhttt.exec:\7bhttt.exe102⤵PID:1760
-
\??\c:\jjvdp.exec:\jjvdp.exe103⤵PID:1828
-
\??\c:\rxxrfxf.exec:\rxxrfxf.exe104⤵PID:1744
-
\??\c:\llxlxfr.exec:\llxlxfr.exe105⤵
- System Location Discovery: System Language Discovery
PID:2192 -
\??\c:\7ntttt.exec:\7ntttt.exe106⤵PID:2708
-
\??\c:\pdjpv.exec:\pdjpv.exe107⤵PID:2312
-
\??\c:\1pdvd.exec:\1pdvd.exe108⤵PID:2208
-
\??\c:\xrflffl.exec:\xrflffl.exe109⤵PID:2276
-
\??\c:\9htttn.exec:\9htttn.exe110⤵PID:1196
-
\??\c:\thtntt.exec:\thtntt.exe111⤵PID:1564
-
\??\c:\ddvvp.exec:\ddvvp.exe112⤵PID:1888
-
\??\c:\vpjjp.exec:\vpjjp.exe113⤵PID:2316
-
\??\c:\lfrrffl.exec:\lfrrffl.exe114⤵PID:2848
-
\??\c:\hhtthh.exec:\hhtthh.exe115⤵PID:1824
-
\??\c:\nnbhnh.exec:\nnbhnh.exe116⤵PID:1292
-
\??\c:\5pvpj.exec:\5pvpj.exe117⤵PID:2120
-
\??\c:\7flfxxx.exec:\7flfxxx.exe118⤵PID:860
-
\??\c:\lfxxfxf.exec:\lfxxfxf.exe119⤵PID:2096
-
\??\c:\thnhhb.exec:\thnhhb.exe120⤵PID:2280
-
\??\c:\vvdjv.exec:\vvdjv.exe121⤵PID:316
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-