Analysis
-
max time kernel
150s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
22-12-2024 20:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2b3ffc75e4e9262cd784ceef21575be7cf3bfd99bd364adeeedb960e8ad6626e.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
150 seconds
General
-
Target
2b3ffc75e4e9262cd784ceef21575be7cf3bfd99bd364adeeedb960e8ad6626e.exe
-
Size
454KB
-
MD5
b08059df499c6b915ba8fe6e31f29e72
-
SHA1
f2745afbd5e4062b79c5c14fcc39dc17ce9027be
-
SHA256
2b3ffc75e4e9262cd784ceef21575be7cf3bfd99bd364adeeedb960e8ad6626e
-
SHA512
1cf2b7329b9a4e9ed497a0d774fd772f621550f38b173e31dd7096ca49e3cd15f0b53457d00afd78a60f9dfe8f66f9c8e755d4804c22b1f1510d27d98a306b12
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbetX:q7Tc2NYHUrAwfMp3CDtX
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/2316-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1688-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2444-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2444-52-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3000-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2412-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/924-103-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2432-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2084-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2480-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1356-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-165-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2980-163-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1968-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1968-183-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2260-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1836-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1836-224-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2452-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1104-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/832-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2376-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2376-309-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2420-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1320-409-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2472-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-440-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2708-449-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-502-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1684-533-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/832-578-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2160-603-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3024-628-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-734-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1912-836-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1660-845-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2572-858-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/620-874-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1732-988-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1688 9htnhh.exe 3012 3dvdj.exe 2732 bttbth.exe 2848 9rlrxlf.exe 2444 hnbbhn.exe 2756 jvpvd.exe 3000 xxlfrxf.exe 2412 nnhhnt.exe 2672 rffrlrr.exe 2584 pvpdv.exe 924 xxrxlxr.exe 2432 tnbhbt.exe 2480 ddppv.exe 2084 nnnnth.exe 1356 jdpvj.exe 2872 llflflx.exe 2980 thhnbh.exe 2108 1ppvd.exe 1968 nbnntb.exe 2168 7vvdp.exe 2260 7thhbh.exe 1156 rrxflxl.exe 2508 ppdjp.exe 1836 7lflxfx.exe 2452 7hhtht.exe 1448 xxlrfrl.exe 1720 9bbnbh.exe 1584 frffrxl.exe 1752 nbtbnb.exe 1104 3xfllrx.exe 832 7hhntt.exe 112 pjvjp.exe 2368 xfxxflr.exe 2376 nhnhht.exe 1716 pppvj.exe 1216 rfxxlxl.exe 2420 nbtnht.exe 2768 7jpvj.exe 2844 vvjjp.exe 2748 xlfxrlx.exe 2444 3ttbnn.exe 852 9ppdp.exe 2128 xxlllfr.exe 3000 xfrrflx.exe 2712 5btbhb.exe 2692 9vjvp.exe 600 lxrxfxf.exe 1288 bnhtbh.exe 1320 hbbtbh.exe 2472 jjdpj.exe 2976 xxlfxrf.exe 2968 bttthh.exe 2552 nthhnt.exe 2964 jpjvp.exe 2708 lrlrxfl.exe 2740 9hnnhn.exe 2988 ppddj.exe 1996 5rlfrfx.exe 1944 lrlxlxl.exe 2436 bhbhbn.exe 2448 pvjpp.exe 560 lrxxfrl.exe 2404 lrxlllx.exe 2596 tbnbnb.exe -
resource yara_rule behavioral1/memory/2316-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1356-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1836-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1104-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/832-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1216-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1320-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-456-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-502-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-533-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/832-571-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/832-578-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-628-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-668-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-682-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-734-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/684-793-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1896-812-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2572-858-0x00000000005C0000-0x00000000005EA000-memory.dmp upx behavioral1/memory/2132-879-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxffffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hnnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlllfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxfflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tbbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bntnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3frrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xlxxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllrfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpvv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2316 wrote to memory of 1688 2316 2b3ffc75e4e9262cd784ceef21575be7cf3bfd99bd364adeeedb960e8ad6626e.exe 29 PID 2316 wrote to memory of 1688 2316 2b3ffc75e4e9262cd784ceef21575be7cf3bfd99bd364adeeedb960e8ad6626e.exe 29 PID 2316 wrote to memory of 1688 2316 2b3ffc75e4e9262cd784ceef21575be7cf3bfd99bd364adeeedb960e8ad6626e.exe 29 PID 2316 wrote to memory of 1688 2316 2b3ffc75e4e9262cd784ceef21575be7cf3bfd99bd364adeeedb960e8ad6626e.exe 29 PID 1688 wrote to memory of 3012 1688 9htnhh.exe 30 PID 1688 wrote to memory of 3012 1688 9htnhh.exe 30 PID 1688 wrote to memory of 3012 1688 9htnhh.exe 30 PID 1688 wrote to memory of 3012 1688 9htnhh.exe 30 PID 3012 wrote to memory of 2732 3012 3dvdj.exe 31 PID 3012 wrote to memory of 2732 3012 3dvdj.exe 31 PID 3012 wrote to memory of 2732 3012 3dvdj.exe 31 PID 3012 wrote to memory of 2732 3012 3dvdj.exe 31 PID 2732 wrote to memory of 2848 2732 bttbth.exe 32 PID 2732 wrote to memory of 2848 2732 bttbth.exe 32 PID 2732 wrote to memory of 2848 2732 bttbth.exe 32 PID 2732 wrote to memory of 2848 2732 bttbth.exe 32 PID 2848 wrote to memory of 2444 2848 9rlrxlf.exe 33 PID 2848 wrote to memory of 2444 2848 9rlrxlf.exe 33 PID 2848 wrote to memory of 2444 2848 9rlrxlf.exe 33 PID 2848 wrote to memory of 2444 2848 9rlrxlf.exe 33 PID 2444 wrote to memory of 2756 2444 hnbbhn.exe 34 PID 2444 wrote to memory of 2756 2444 hnbbhn.exe 34 PID 2444 wrote to memory of 2756 2444 hnbbhn.exe 34 PID 2444 wrote to memory of 2756 2444 hnbbhn.exe 34 PID 2756 wrote to memory of 3000 2756 jvpvd.exe 35 PID 2756 wrote to memory of 3000 2756 jvpvd.exe 35 PID 2756 wrote to memory of 3000 2756 jvpvd.exe 35 PID 2756 wrote to memory of 3000 2756 jvpvd.exe 35 PID 3000 wrote to memory of 2412 3000 xxlfrxf.exe 36 PID 3000 wrote to memory of 2412 3000 xxlfrxf.exe 36 PID 3000 wrote to memory of 2412 3000 xxlfrxf.exe 36 PID 3000 wrote to memory of 2412 3000 xxlfrxf.exe 36 PID 2412 wrote to memory of 2672 2412 nnhhnt.exe 37 PID 2412 wrote to memory of 2672 2412 nnhhnt.exe 37 PID 2412 wrote to memory of 2672 2412 nnhhnt.exe 37 PID 2412 wrote to memory of 2672 2412 nnhhnt.exe 37 PID 2672 wrote to memory of 2584 2672 rffrlrr.exe 38 PID 2672 wrote to memory of 2584 2672 rffrlrr.exe 38 PID 2672 wrote to memory of 2584 2672 rffrlrr.exe 38 PID 2672 wrote to memory of 2584 2672 rffrlrr.exe 38 PID 2584 wrote to memory of 924 2584 pvpdv.exe 39 PID 2584 wrote to memory of 924 2584 pvpdv.exe 39 PID 2584 wrote to memory of 924 2584 pvpdv.exe 39 PID 2584 wrote to memory of 924 2584 pvpdv.exe 39 PID 924 wrote to memory of 2432 924 xxrxlxr.exe 40 PID 924 wrote to memory of 2432 924 xxrxlxr.exe 40 PID 924 wrote to memory of 2432 924 xxrxlxr.exe 40 PID 924 wrote to memory of 2432 924 xxrxlxr.exe 40 PID 2432 wrote to memory of 2480 2432 tnbhbt.exe 41 PID 2432 wrote to memory of 2480 2432 tnbhbt.exe 41 PID 2432 wrote to memory of 2480 2432 tnbhbt.exe 41 PID 2432 wrote to memory of 2480 2432 tnbhbt.exe 41 PID 2480 wrote to memory of 2084 2480 ddppv.exe 42 PID 2480 wrote to memory of 2084 2480 ddppv.exe 42 PID 2480 wrote to memory of 2084 2480 ddppv.exe 42 PID 2480 wrote to memory of 2084 2480 ddppv.exe 42 PID 2084 wrote to memory of 1356 2084 nnnnth.exe 43 PID 2084 wrote to memory of 1356 2084 nnnnth.exe 43 PID 2084 wrote to memory of 1356 2084 nnnnth.exe 43 PID 2084 wrote to memory of 1356 2084 nnnnth.exe 43 PID 1356 wrote to memory of 2872 1356 jdpvj.exe 44 PID 1356 wrote to memory of 2872 1356 jdpvj.exe 44 PID 1356 wrote to memory of 2872 1356 jdpvj.exe 44 PID 1356 wrote to memory of 2872 1356 jdpvj.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b3ffc75e4e9262cd784ceef21575be7cf3bfd99bd364adeeedb960e8ad6626e.exe"C:\Users\Admin\AppData\Local\Temp\2b3ffc75e4e9262cd784ceef21575be7cf3bfd99bd364adeeedb960e8ad6626e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\9htnhh.exec:\9htnhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\3dvdj.exec:\3dvdj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\bttbth.exec:\bttbth.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\9rlrxlf.exec:\9rlrxlf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\hnbbhn.exec:\hnbbhn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\jvpvd.exec:\jvpvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\xxlfrxf.exec:\xxlfrxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\nnhhnt.exec:\nnhhnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\rffrlrr.exec:\rffrlrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\pvpdv.exec:\pvpdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\xxrxlxr.exec:\xxrxlxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
\??\c:\tnbhbt.exec:\tnbhbt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\ddppv.exec:\ddppv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\nnnnth.exec:\nnnnth.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\jdpvj.exec:\jdpvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
\??\c:\llflflx.exec:\llflflx.exe17⤵
- Executes dropped EXE
PID:2872 -
\??\c:\thhnbh.exec:\thhnbh.exe18⤵
- Executes dropped EXE
PID:2980 -
\??\c:\1ppvd.exec:\1ppvd.exe19⤵
- Executes dropped EXE
PID:2108 -
\??\c:\nbnntb.exec:\nbnntb.exe20⤵
- Executes dropped EXE
PID:1968 -
\??\c:\7vvdp.exec:\7vvdp.exe21⤵
- Executes dropped EXE
PID:2168 -
\??\c:\7thhbh.exec:\7thhbh.exe22⤵
- Executes dropped EXE
PID:2260 -
\??\c:\rrxflxl.exec:\rrxflxl.exe23⤵
- Executes dropped EXE
PID:1156 -
\??\c:\ppdjp.exec:\ppdjp.exe24⤵
- Executes dropped EXE
PID:2508 -
\??\c:\7lflxfx.exec:\7lflxfx.exe25⤵
- Executes dropped EXE
PID:1836 -
\??\c:\7hhtht.exec:\7hhtht.exe26⤵
- Executes dropped EXE
PID:2452 -
\??\c:\xxlrfrl.exec:\xxlrfrl.exe27⤵
- Executes dropped EXE
PID:1448 -
\??\c:\9bbnbh.exec:\9bbnbh.exe28⤵
- Executes dropped EXE
PID:1720 -
\??\c:\frffrxl.exec:\frffrxl.exe29⤵
- Executes dropped EXE
PID:1584 -
\??\c:\nbtbnb.exec:\nbtbnb.exe30⤵
- Executes dropped EXE
PID:1752 -
\??\c:\3xfllrx.exec:\3xfllrx.exe31⤵
- Executes dropped EXE
PID:1104 -
\??\c:\7hhntt.exec:\7hhntt.exe32⤵
- Executes dropped EXE
PID:832 -
\??\c:\pjvjp.exec:\pjvjp.exe33⤵
- Executes dropped EXE
PID:112 -
\??\c:\xfxxflr.exec:\xfxxflr.exe34⤵
- Executes dropped EXE
PID:2368 -
\??\c:\nhnhht.exec:\nhnhht.exe35⤵
- Executes dropped EXE
PID:2376 -
\??\c:\pppvj.exec:\pppvj.exe36⤵
- Executes dropped EXE
PID:1716 -
\??\c:\rfxxlxl.exec:\rfxxlxl.exe37⤵
- Executes dropped EXE
PID:1216 -
\??\c:\nbtnht.exec:\nbtnht.exe38⤵
- Executes dropped EXE
PID:2420 -
\??\c:\7jpvj.exec:\7jpvj.exe39⤵
- Executes dropped EXE
PID:2768 -
\??\c:\vvjjp.exec:\vvjjp.exe40⤵
- Executes dropped EXE
PID:2844 -
\??\c:\xlfxrlx.exec:\xlfxrlx.exe41⤵
- Executes dropped EXE
PID:2748 -
\??\c:\3ttbnn.exec:\3ttbnn.exe42⤵
- Executes dropped EXE
PID:2444 -
\??\c:\9ppdp.exec:\9ppdp.exe43⤵
- Executes dropped EXE
PID:852 -
\??\c:\xxlllfr.exec:\xxlllfr.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2128 -
\??\c:\xfrrflx.exec:\xfrrflx.exe45⤵
- Executes dropped EXE
PID:3000 -
\??\c:\5btbhb.exec:\5btbhb.exe46⤵
- Executes dropped EXE
PID:2712 -
\??\c:\9vjvp.exec:\9vjvp.exe47⤵
- Executes dropped EXE
PID:2692 -
\??\c:\lxrxfxf.exec:\lxrxfxf.exe48⤵
- Executes dropped EXE
PID:600 -
\??\c:\bnhtbh.exec:\bnhtbh.exe49⤵
- Executes dropped EXE
PID:1288 -
\??\c:\hbbtbh.exec:\hbbtbh.exe50⤵
- Executes dropped EXE
PID:1320 -
\??\c:\jjdpj.exec:\jjdpj.exe51⤵
- Executes dropped EXE
PID:2472 -
\??\c:\xxlfxrf.exec:\xxlfxrf.exe52⤵
- Executes dropped EXE
PID:2976 -
\??\c:\bttthh.exec:\bttthh.exe53⤵
- Executes dropped EXE
PID:2968 -
\??\c:\nthhnt.exec:\nthhnt.exe54⤵
- Executes dropped EXE
PID:2552 -
\??\c:\jpjvp.exec:\jpjvp.exe55⤵
- Executes dropped EXE
PID:2964 -
\??\c:\lrlrxfl.exec:\lrlrxfl.exe56⤵
- Executes dropped EXE
PID:2708 -
\??\c:\9hnnhn.exec:\9hnnhn.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2740 -
\??\c:\ppddj.exec:\ppddj.exe58⤵
- Executes dropped EXE
PID:2988 -
\??\c:\5rlfrfx.exec:\5rlfrfx.exe59⤵
- Executes dropped EXE
PID:1996 -
\??\c:\lrlxlxl.exec:\lrlxlxl.exe60⤵
- Executes dropped EXE
PID:1944 -
\??\c:\bhbhbn.exec:\bhbhbn.exe61⤵
- Executes dropped EXE
PID:2436 -
\??\c:\pvjpp.exec:\pvjpp.exe62⤵
- Executes dropped EXE
PID:2448 -
\??\c:\lrxxfrl.exec:\lrxxfrl.exe63⤵
- Executes dropped EXE
PID:560 -
\??\c:\lrxlllx.exec:\lrxlllx.exe64⤵
- Executes dropped EXE
PID:2404 -
\??\c:\tbnbnb.exec:\tbnbnb.exe65⤵
- Executes dropped EXE
PID:2596 -
\??\c:\vpvvj.exec:\vpvvj.exe66⤵PID:1628
-
\??\c:\9fffrfr.exec:\9fffrfr.exe67⤵PID:2172
-
\??\c:\bhthbt.exec:\bhthbt.exe68⤵PID:2308
-
\??\c:\tbhhnt.exec:\tbhhnt.exe69⤵PID:1684
-
\??\c:\jvpdp.exec:\jvpdp.exe70⤵PID:1764
-
\??\c:\lrrlrrl.exec:\lrrlrrl.exe71⤵PID:1720
-
\??\c:\xrllxlx.exec:\xrllxlx.exe72⤵PID:948
-
\??\c:\nnnnth.exec:\nnnnth.exe73⤵PID:1532
-
\??\c:\9pvdv.exec:\9pvdv.exe74⤵PID:2720
-
\??\c:\frlrxrl.exec:\frlrxrl.exe75⤵PID:2408
-
\??\c:\lrffxfl.exec:\lrffxfl.exe76⤵PID:832
-
\??\c:\1htbht.exec:\1htbht.exe77⤵PID:3016
-
\??\c:\pvjvd.exec:\pvjvd.exe78⤵PID:2576
-
\??\c:\rxllrxl.exec:\rxllrxl.exe79⤵PID:2604
-
\??\c:\ffrxffl.exec:\ffrxffl.exe80⤵PID:2160
-
\??\c:\hnbhhb.exec:\hnbhhb.exe81⤵PID:604
-
\??\c:\bhhnbh.exec:\bhhnbh.exe82⤵
- System Location Discovery: System Language Discovery
PID:2784 -
\??\c:\djvdp.exec:\djvdp.exe83⤵PID:2732
-
\??\c:\rllrfrl.exec:\rllrfrl.exe84⤵
- System Location Discovery: System Language Discovery
PID:3024 -
\??\c:\5ttbtb.exec:\5ttbtb.exe85⤵PID:2928
-
\??\c:\jppvp.exec:\jppvp.exe86⤵PID:2828
-
\??\c:\vdvdj.exec:\vdvdj.exe87⤵PID:2728
-
\??\c:\fxlxlrf.exec:\fxlxlrf.exe88⤵PID:2696
-
\??\c:\1nhhnb.exec:\1nhhnb.exe89⤵PID:2656
-
\??\c:\vvjjp.exec:\vvjjp.exe90⤵PID:2636
-
\??\c:\jpjjd.exec:\jpjjd.exe91⤵PID:2144
-
\??\c:\xfrlxlx.exec:\xfrlxlx.exe92⤵PID:1956
-
\??\c:\hhthtb.exec:\hhthtb.exe93⤵PID:2180
-
\??\c:\pdjpd.exec:\pdjpd.exe94⤵PID:956
-
\??\c:\ppdjj.exec:\ppdjj.exe95⤵PID:1076
-
\??\c:\xxlfrxx.exec:\xxlfrxx.exe96⤵PID:2996
-
\??\c:\7hnthn.exec:\7hnthn.exe97⤵PID:1292
-
\??\c:\ppdjv.exec:\ppdjv.exe98⤵PID:908
-
\??\c:\xrlxlrx.exec:\xrlxlrx.exe99⤵PID:2884
-
\??\c:\fffrrfr.exec:\fffrrfr.exe100⤵PID:2972
-
\??\c:\3hbhtb.exec:\3hbhtb.exe101⤵PID:2380
-
\??\c:\jjpvd.exec:\jjpvd.exe102⤵PID:2108
-
\??\c:\3vjdj.exec:\3vjdj.exe103⤵PID:2520
-
\??\c:\rrfflfl.exec:\rrfflfl.exe104⤵PID:2284
-
\??\c:\bnbbhn.exec:\bnbbhn.exe105⤵PID:2060
-
\??\c:\jpvpv.exec:\jpvpv.exe106⤵PID:2120
-
\??\c:\vpppp.exec:\vpppp.exe107⤵PID:1648
-
\??\c:\7xflxxl.exec:\7xflxxl.exe108⤵PID:2592
-
\??\c:\bbhhnt.exec:\bbhhnt.exe109⤵PID:352
-
\??\c:\bbtbhh.exec:\bbtbhh.exe110⤵PID:684
-
\??\c:\djvpv.exec:\djvpv.exe111⤵PID:2484
-
\??\c:\rrxlxxl.exec:\rrxlxxl.exe112⤵PID:1896
-
\??\c:\nhbhnn.exec:\nhbhnn.exe113⤵PID:1760
-
\??\c:\hbttbb.exec:\hbttbb.exe114⤵PID:1492
-
\??\c:\jvjjj.exec:\jvjjj.exe115⤵PID:1832
-
\??\c:\vpjpp.exec:\vpjpp.exe116⤵PID:1912
-
\??\c:\flrllrx.exec:\flrllrx.exe117⤵PID:1660
-
\??\c:\1tbnhh.exec:\1tbnhh.exe118⤵PID:620
-
\??\c:\1pddd.exec:\1pddd.exe119⤵PID:2572
-
\??\c:\3vvvd.exec:\3vvvd.exe120⤵PID:2396
-
\??\c:\3bnthh.exec:\3bnthh.exe121⤵PID:2612
-
\??\c:\1nnnbn.exec:\1nnnbn.exe122⤵PID:1624
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-