Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-12-2024 20:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2540835520d4d3024cbc3074a61ab8c91b5314b207771a5e75d3230c7cc72956.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
2540835520d4d3024cbc3074a61ab8c91b5314b207771a5e75d3230c7cc72956.exe
-
Size
454KB
-
MD5
ddc2edbcfadbf0fba0dfef67551b3dcf
-
SHA1
2f1f1c0037361eeeb20de50ec4fd809166a25e9d
-
SHA256
2540835520d4d3024cbc3074a61ab8c91b5314b207771a5e75d3230c7cc72956
-
SHA512
dd0d730ede188ae4222dc43bb03ccd9da40d91e98c143416d411b16b598b65913ad598ae2a415921306e1efec0b1967022546f1b2ce773d3872d9c7e1b0f77a1
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbey:q7Tc2NYHUrAwfMp3CDy
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 60 IoCs
resource yara_rule behavioral1/memory/2572-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2096-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-34-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2124-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-54-0x00000000001C0000-0x00000000001EA000-memory.dmp family_blackmoon behavioral1/memory/2756-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-65-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2652-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-97-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3064-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/308-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/308-116-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/108-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/844-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2420-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1796-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1216-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1728-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1604-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1656-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/820-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2084-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-351-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2900-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-376-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2040-412-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2040-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1924-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-426-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1104-434-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1732-447-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2152-461-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/848-518-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2312-555-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1032-609-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2108-622-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2660-641-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2648-648-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1768-676-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2528-717-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2936-736-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1524-916-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1508-1014-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2936-1022-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1544-1041-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1548-1060-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/560-1165-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2628-1216-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2628-1245-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1200-1247-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2572 3pvdp.exe 2112 xxlfflr.exe 2124 vdjvj.exe 2784 hhbhnt.exe 2756 tthnbh.exe 2512 fxxrfrr.exe 2652 hbtbhb.exe 2824 fflrxxf.exe 2748 nhnntn.exe 3064 vppvd.exe 308 3rffrxf.exe 108 ppjpv.exe 2532 lfrflfr.exe 2504 1jvjj.exe 844 7vpvd.exe 2924 7nhtht.exe 2936 nhtbnn.exe 2500 5flfllr.exe 2608 ffxlxfr.exe 2216 pjdjp.exe 1580 lfxflrx.exe 2420 5bttnt.exe 1588 ppjpj.exe 1796 5frrxfl.exe 1216 vdvjd.exe 1728 lxxrfff.exe 1604 3nnbnn.exe 1656 ddvdp.exe 820 lrrrxfr.exe 2964 tnbnth.exe 2428 7pjjj.exe 888 dvpdp.exe 3036 nhbnbh.exe 1540 7bttbh.exe 2572 jvjvv.exe 2908 lllfrxx.exe 2084 5fxflrf.exe 2732 hbhhbn.exe 2864 nhtnht.exe 2468 jdpvj.exe 2900 1pddp.exe 2904 nhttbh.exe 2928 ntnnbt.exe 2628 5dvjv.exe 2824 5fxfrrf.exe 2656 bbbhhn.exe 2668 hbntbh.exe 3064 jvppd.exe 1592 dvjvj.exe 2040 9lfrxfx.exe 1924 5ttntt.exe 2932 1dddp.exe 1104 lflrllx.exe 1612 7htbnt.exe 1732 jvpvd.exe 1616 3dvvd.exe 2152 xffrfrl.exe 2996 hthbbn.exe 2220 3bntbn.exe 1544 5ppvj.exe 444 xrffrxl.exe 840 llflrrf.exe 2420 5btntb.exe 1096 dpjjv.exe -
resource yara_rule behavioral1/memory/2572-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/308-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/108-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/844-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1796-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1216-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1604-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/820-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-351-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/2900-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2040-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1924-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1104-434-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/1732-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1544-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-641-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/1940-656-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-677-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1212-690-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-704-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-916-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2936-1015-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1216-1074-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-1216-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1564-1233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-1296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1300-1321-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7frfrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxflfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rfffxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2096 wrote to memory of 2572 2096 2540835520d4d3024cbc3074a61ab8c91b5314b207771a5e75d3230c7cc72956.exe 30 PID 2096 wrote to memory of 2572 2096 2540835520d4d3024cbc3074a61ab8c91b5314b207771a5e75d3230c7cc72956.exe 30 PID 2096 wrote to memory of 2572 2096 2540835520d4d3024cbc3074a61ab8c91b5314b207771a5e75d3230c7cc72956.exe 30 PID 2096 wrote to memory of 2572 2096 2540835520d4d3024cbc3074a61ab8c91b5314b207771a5e75d3230c7cc72956.exe 30 PID 2572 wrote to memory of 2112 2572 3pvdp.exe 31 PID 2572 wrote to memory of 2112 2572 3pvdp.exe 31 PID 2572 wrote to memory of 2112 2572 3pvdp.exe 31 PID 2572 wrote to memory of 2112 2572 3pvdp.exe 31 PID 2112 wrote to memory of 2124 2112 xxlfflr.exe 32 PID 2112 wrote to memory of 2124 2112 xxlfflr.exe 32 PID 2112 wrote to memory of 2124 2112 xxlfflr.exe 32 PID 2112 wrote to memory of 2124 2112 xxlfflr.exe 32 PID 2124 wrote to memory of 2784 2124 vdjvj.exe 33 PID 2124 wrote to memory of 2784 2124 vdjvj.exe 33 PID 2124 wrote to memory of 2784 2124 vdjvj.exe 33 PID 2124 wrote to memory of 2784 2124 vdjvj.exe 33 PID 2784 wrote to memory of 2756 2784 hhbhnt.exe 34 PID 2784 wrote to memory of 2756 2784 hhbhnt.exe 34 PID 2784 wrote to memory of 2756 2784 hhbhnt.exe 34 PID 2784 wrote to memory of 2756 2784 hhbhnt.exe 34 PID 2756 wrote to memory of 2512 2756 tthnbh.exe 35 PID 2756 wrote to memory of 2512 2756 tthnbh.exe 35 PID 2756 wrote to memory of 2512 2756 tthnbh.exe 35 PID 2756 wrote to memory of 2512 2756 tthnbh.exe 35 PID 2512 wrote to memory of 2652 2512 fxxrfrr.exe 36 PID 2512 wrote to memory of 2652 2512 fxxrfrr.exe 36 PID 2512 wrote to memory of 2652 2512 fxxrfrr.exe 36 PID 2512 wrote to memory of 2652 2512 fxxrfrr.exe 36 PID 2652 wrote to memory of 2824 2652 hbtbhb.exe 37 PID 2652 wrote to memory of 2824 2652 hbtbhb.exe 37 PID 2652 wrote to memory of 2824 2652 hbtbhb.exe 37 PID 2652 wrote to memory of 2824 2652 hbtbhb.exe 37 PID 2824 wrote to memory of 2748 2824 fflrxxf.exe 38 PID 2824 wrote to memory of 2748 2824 fflrxxf.exe 38 PID 2824 wrote to memory of 2748 2824 fflrxxf.exe 38 PID 2824 wrote to memory of 2748 2824 fflrxxf.exe 38 PID 2748 wrote to memory of 3064 2748 nhnntn.exe 39 PID 2748 wrote to memory of 3064 2748 nhnntn.exe 39 PID 2748 wrote to memory of 3064 2748 nhnntn.exe 39 PID 2748 wrote to memory of 3064 2748 nhnntn.exe 39 PID 3064 wrote to memory of 308 3064 vppvd.exe 40 PID 3064 wrote to memory of 308 3064 vppvd.exe 40 PID 3064 wrote to memory of 308 3064 vppvd.exe 40 PID 3064 wrote to memory of 308 3064 vppvd.exe 40 PID 308 wrote to memory of 108 308 3rffrxf.exe 41 PID 308 wrote to memory of 108 308 3rffrxf.exe 41 PID 308 wrote to memory of 108 308 3rffrxf.exe 41 PID 308 wrote to memory of 108 308 3rffrxf.exe 41 PID 108 wrote to memory of 2532 108 ppjpv.exe 42 PID 108 wrote to memory of 2532 108 ppjpv.exe 42 PID 108 wrote to memory of 2532 108 ppjpv.exe 42 PID 108 wrote to memory of 2532 108 ppjpv.exe 42 PID 2532 wrote to memory of 2504 2532 lfrflfr.exe 43 PID 2532 wrote to memory of 2504 2532 lfrflfr.exe 43 PID 2532 wrote to memory of 2504 2532 lfrflfr.exe 43 PID 2532 wrote to memory of 2504 2532 lfrflfr.exe 43 PID 2504 wrote to memory of 844 2504 1jvjj.exe 44 PID 2504 wrote to memory of 844 2504 1jvjj.exe 44 PID 2504 wrote to memory of 844 2504 1jvjj.exe 44 PID 2504 wrote to memory of 844 2504 1jvjj.exe 44 PID 844 wrote to memory of 2924 844 7vpvd.exe 45 PID 844 wrote to memory of 2924 844 7vpvd.exe 45 PID 844 wrote to memory of 2924 844 7vpvd.exe 45 PID 844 wrote to memory of 2924 844 7vpvd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2540835520d4d3024cbc3074a61ab8c91b5314b207771a5e75d3230c7cc72956.exe"C:\Users\Admin\AppData\Local\Temp\2540835520d4d3024cbc3074a61ab8c91b5314b207771a5e75d3230c7cc72956.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\3pvdp.exec:\3pvdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\xxlfflr.exec:\xxlfflr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\vdjvj.exec:\vdjvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\hhbhnt.exec:\hhbhnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\tthnbh.exec:\tthnbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\fxxrfrr.exec:\fxxrfrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\hbtbhb.exec:\hbtbhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\fflrxxf.exec:\fflrxxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\nhnntn.exec:\nhnntn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\vppvd.exec:\vppvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\3rffrxf.exec:\3rffrxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:308 -
\??\c:\ppjpv.exec:\ppjpv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:108 -
\??\c:\lfrflfr.exec:\lfrflfr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\1jvjj.exec:\1jvjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\7vpvd.exec:\7vpvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
\??\c:\7nhtht.exec:\7nhtht.exe17⤵
- Executes dropped EXE
PID:2924 -
\??\c:\nhtbnn.exec:\nhtbnn.exe18⤵
- Executes dropped EXE
PID:2936 -
\??\c:\5flfllr.exec:\5flfllr.exe19⤵
- Executes dropped EXE
PID:2500 -
\??\c:\ffxlxfr.exec:\ffxlxfr.exe20⤵
- Executes dropped EXE
PID:2608 -
\??\c:\pjdjp.exec:\pjdjp.exe21⤵
- Executes dropped EXE
PID:2216 -
\??\c:\lfxflrx.exec:\lfxflrx.exe22⤵
- Executes dropped EXE
PID:1580 -
\??\c:\5bttnt.exec:\5bttnt.exe23⤵
- Executes dropped EXE
PID:2420 -
\??\c:\ppjpj.exec:\ppjpj.exe24⤵
- Executes dropped EXE
PID:1588 -
\??\c:\5frrxfl.exec:\5frrxfl.exe25⤵
- Executes dropped EXE
PID:1796 -
\??\c:\vdvjd.exec:\vdvjd.exe26⤵
- Executes dropped EXE
PID:1216 -
\??\c:\lxxrfff.exec:\lxxrfff.exe27⤵
- Executes dropped EXE
PID:1728 -
\??\c:\3nnbnn.exec:\3nnbnn.exe28⤵
- Executes dropped EXE
PID:1604 -
\??\c:\ddvdp.exec:\ddvdp.exe29⤵
- Executes dropped EXE
PID:1656 -
\??\c:\lrrrxfr.exec:\lrrrxfr.exe30⤵
- Executes dropped EXE
PID:820 -
\??\c:\tnbnth.exec:\tnbnth.exe31⤵
- Executes dropped EXE
PID:2964 -
\??\c:\7pjjj.exec:\7pjjj.exe32⤵
- Executes dropped EXE
PID:2428 -
\??\c:\dvpdp.exec:\dvpdp.exe33⤵
- Executes dropped EXE
PID:888 -
\??\c:\nhbnbh.exec:\nhbnbh.exe34⤵
- Executes dropped EXE
PID:3036 -
\??\c:\7bttbh.exec:\7bttbh.exe35⤵
- Executes dropped EXE
PID:1540 -
\??\c:\jvjvv.exec:\jvjvv.exe36⤵
- Executes dropped EXE
PID:2572 -
\??\c:\lllfrxx.exec:\lllfrxx.exe37⤵
- Executes dropped EXE
PID:2908 -
\??\c:\5fxflrf.exec:\5fxflrf.exe38⤵
- Executes dropped EXE
PID:2084 -
\??\c:\hbhhbn.exec:\hbhhbn.exe39⤵
- Executes dropped EXE
PID:2732 -
\??\c:\nhtnht.exec:\nhtnht.exe40⤵
- Executes dropped EXE
PID:2864 -
\??\c:\jdpvj.exec:\jdpvj.exe41⤵
- Executes dropped EXE
PID:2468 -
\??\c:\1pddp.exec:\1pddp.exe42⤵
- Executes dropped EXE
PID:2900 -
\??\c:\nhttbh.exec:\nhttbh.exe43⤵
- Executes dropped EXE
PID:2904 -
\??\c:\ntnnbt.exec:\ntnnbt.exe44⤵
- Executes dropped EXE
PID:2928 -
\??\c:\5dvjv.exec:\5dvjv.exe45⤵
- Executes dropped EXE
PID:2628 -
\??\c:\5fxfrrf.exec:\5fxfrrf.exe46⤵
- Executes dropped EXE
PID:2824 -
\??\c:\bbbhhn.exec:\bbbhhn.exe47⤵
- Executes dropped EXE
PID:2656 -
\??\c:\hbntbh.exec:\hbntbh.exe48⤵
- Executes dropped EXE
PID:2668 -
\??\c:\jvppd.exec:\jvppd.exe49⤵
- Executes dropped EXE
PID:3064 -
\??\c:\dvjvj.exec:\dvjvj.exe50⤵
- Executes dropped EXE
PID:1592 -
\??\c:\9lfrxfx.exec:\9lfrxfx.exe51⤵
- Executes dropped EXE
PID:2040 -
\??\c:\5ttntt.exec:\5ttntt.exe52⤵
- Executes dropped EXE
PID:1924 -
\??\c:\1dddp.exec:\1dddp.exe53⤵
- Executes dropped EXE
PID:2932 -
\??\c:\lflrllx.exec:\lflrllx.exe54⤵
- Executes dropped EXE
PID:1104 -
\??\c:\7htbnt.exec:\7htbnt.exe55⤵
- Executes dropped EXE
PID:1612 -
\??\c:\jvpvd.exec:\jvpvd.exe56⤵
- Executes dropped EXE
PID:1732 -
\??\c:\3dvvd.exec:\3dvvd.exe57⤵
- Executes dropped EXE
PID:1616 -
\??\c:\xffrfrl.exec:\xffrfrl.exe58⤵
- Executes dropped EXE
PID:2152 -
\??\c:\hthbbn.exec:\hthbbn.exe59⤵
- Executes dropped EXE
PID:2996 -
\??\c:\3bntbn.exec:\3bntbn.exe60⤵
- Executes dropped EXE
PID:2220 -
\??\c:\5ppvj.exec:\5ppvj.exe61⤵
- Executes dropped EXE
PID:1544 -
\??\c:\xrffrxl.exec:\xrffrxl.exe62⤵
- Executes dropped EXE
PID:444 -
\??\c:\llflrrf.exec:\llflrrf.exe63⤵
- Executes dropped EXE
PID:840 -
\??\c:\5btntb.exec:\5btntb.exe64⤵
- Executes dropped EXE
PID:2420 -
\??\c:\dpjjv.exec:\dpjjv.exe65⤵
- Executes dropped EXE
PID:1096 -
\??\c:\fxrrxxl.exec:\fxrrxxl.exe66⤵PID:1708
-
\??\c:\hbbhbb.exec:\hbbhbb.exe67⤵PID:848
-
\??\c:\hbttnt.exec:\hbttnt.exe68⤵PID:1952
-
\??\c:\3vdjv.exec:\3vdjv.exe69⤵PID:928
-
\??\c:\1frrrxf.exec:\1frrrxf.exe70⤵PID:1228
-
\??\c:\thntbt.exec:\thntbt.exe71⤵PID:2068
-
\??\c:\hbthbb.exec:\hbthbb.exe72⤵PID:1688
-
\??\c:\vpvdj.exec:\vpvdj.exe73⤵PID:2312
-
\??\c:\jdjdp.exec:\jdjdp.exe74⤵PID:1280
-
\??\c:\xrfrflf.exec:\xrfrflf.exe75⤵PID:2128
-
\??\c:\7nbtnb.exec:\7nbtnb.exe76⤵PID:3032
-
\??\c:\ppdjv.exec:\ppdjv.exe77⤵PID:2376
-
\??\c:\jjdpj.exec:\jjdpj.exe78⤵PID:3016
-
\??\c:\xrllxxf.exec:\xrllxxf.exe79⤵PID:2536
-
\??\c:\1tnhhh.exec:\1tnhhh.exe80⤵PID:2380
-
\??\c:\dvpjj.exec:\dvpjj.exe81⤵PID:2108
-
\??\c:\xrrxlrr.exec:\xrrxlrr.exe82⤵PID:1032
-
\??\c:\9xxfxxl.exec:\9xxfxxl.exe83⤵PID:2124
-
\??\c:\nbbnbb.exec:\nbbnbb.exe84⤵PID:2760
-
\??\c:\9nbhtt.exec:\9nbhtt.exe85⤵PID:2744
-
\??\c:\ppjpv.exec:\ppjpv.exe86⤵PID:2812
-
\??\c:\xrlrrxx.exec:\xrlrrxx.exe87⤵PID:2660
-
\??\c:\hthhtt.exec:\hthhtt.exe88⤵PID:2648
-
\??\c:\bnhhbt.exec:\bnhhbt.exe89⤵PID:2636
-
\??\c:\vppvj.exec:\vppvj.exe90⤵PID:1940
-
\??\c:\lflrxrf.exec:\lflrxrf.exe91⤵PID:2600
-
\??\c:\rfxfxfl.exec:\rfxfxfl.exe92⤵PID:1768
-
\??\c:\hnnnbb.exec:\hnnnbb.exe93⤵PID:1932
-
\??\c:\5ppvv.exec:\5ppvv.exe94⤵PID:1200
-
\??\c:\5rllrxf.exec:\5rllrxf.exe95⤵PID:1212
-
\??\c:\frfflrx.exec:\frfflrx.exe96⤵PID:2064
-
\??\c:\tnbhtb.exec:\tnbhtb.exe97⤵PID:2148
-
\??\c:\jjjpd.exec:\jjjpd.exe98⤵PID:2528
-
\??\c:\jdvpp.exec:\jdvpp.exe99⤵PID:2840
-
\??\c:\lxfrxff.exec:\lxfrxff.exe100⤵PID:1508
-
\??\c:\9nbnnt.exec:\9nbnnt.exe101⤵PID:2936
-
\??\c:\bnbbhb.exec:\bnbbhb.exe102⤵PID:2248
-
\??\c:\7jdjj.exec:\7jdjj.exe103⤵PID:2224
-
\??\c:\lfxxflx.exec:\lfxxflx.exe104⤵PID:2196
-
\??\c:\1tnhtb.exec:\1tnhtb.exe105⤵PID:2804
-
\??\c:\tbthhn.exec:\tbthhn.exe106⤵PID:1852
-
\??\c:\jjjvv.exec:\jjjvv.exe107⤵PID:444
-
\??\c:\5frrxxf.exec:\5frrxxf.exe108⤵PID:840
-
\??\c:\1nhbhh.exec:\1nhbhh.exe109⤵PID:2420
-
\??\c:\nhttbb.exec:\nhttbb.exe110⤵PID:1192
-
\??\c:\dpvdd.exec:\dpvdd.exe111⤵PID:2136
-
\??\c:\7rfffxf.exec:\7rfffxf.exe112⤵
- System Location Discovery: System Language Discovery
PID:752 -
\??\c:\rxlxllx.exec:\rxlxllx.exe113⤵PID:1728
-
\??\c:\tbbttb.exec:\tbbttb.exe114⤵PID:1604
-
\??\c:\vvpvd.exec:\vvpvd.exe115⤵PID:2340
-
\??\c:\vvpdv.exec:\vvpdv.exe116⤵PID:2724
-
\??\c:\flxrrrx.exec:\flxrrrx.exe117⤵PID:2556
-
\??\c:\1hbbbb.exec:\1hbbbb.exe118⤵PID:2696
-
\??\c:\vvddv.exec:\vvddv.exe119⤵PID:2032
-
\??\c:\jdvdj.exec:\jdvdj.exe120⤵PID:2128
-
\??\c:\1xrlllr.exec:\1xrlllr.exe121⤵PID:3032
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-