Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-12-2024 21:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2ceff16e99c461a47d2801340265225b653d1a45271b047047b4baaced88bb91.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
2ceff16e99c461a47d2801340265225b653d1a45271b047047b4baaced88bb91.exe
-
Size
454KB
-
MD5
ce5ff046d425c02c565a595818dd40ef
-
SHA1
0bc68b9b0fa454341790c221c867d6a13dd69a80
-
SHA256
2ceff16e99c461a47d2801340265225b653d1a45271b047047b4baaced88bb91
-
SHA512
5e01fa7a4cd6508ab1f7702ea9e700c65a6f070d1f407845a62081fbdda87c0d7d22a8038567f2cb11102d2e2083708fe227a4b5dd49e6bf974e8db416e5c44a
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeTB:q7Tc2NYHUrAwfMp3CDV
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/2088-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-52-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2624-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2472-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-102-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2100-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2520-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/316-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/864-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1084-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2012-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2268-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-200-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/2476-218-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1264-238-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1264-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1664-247-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/1732-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1940-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1524-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-318-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2992-339-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2828-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-361-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2204-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2508-427-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/1496-440-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1268-448-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1496-461-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2104-480-0x00000000001C0000-0x00000000001EA000-memory.dmp family_blackmoon behavioral1/memory/904-503-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1348-516-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2192-537-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-588-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-608-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2264-646-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2940-696-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2696 frrxrfl.exe 2820 7bnthh.exe 2760 7vpdd.exe 2876 htnhnn.exe 2624 jpjpp.exe 2824 9llrlrl.exe 2676 llrlxfr.exe 2472 jjdvd.exe 2884 llffrxl.exe 2100 3btbht.exe 2520 bnthnt.exe 316 5jvdv.exe 1312 hnhnbh.exe 864 9dvdv.exe 1084 vvpvp.exe 2012 rrllxrl.exe 2580 vjjpd.exe 2332 xxlrlrl.exe 2268 xxxfrxr.exe 2176 nnhnbn.exe 1080 xfxlxlx.exe 2476 3hnhnn.exe 2496 rlrfrxr.exe 1264 9bhbtb.exe 1664 fxlrxfl.exe 1732 jppvp.exe 2212 5tnbbn.exe 2984 rrlrlrx.exe 1940 nthttb.exe 872 xxrfxfx.exe 1524 ddvjv.exe 2788 fffrflx.exe 2564 ppvvj.exe 2832 rflfxfx.exe 1588 tnhbbb.exe 2992 dvvdv.exe 2720 fxrxlrl.exe 2892 3flfxrx.exe 2828 9bbhhn.exe 2616 jjddd.exe 2204 bnttbt.exe 2680 pvpjd.exe 296 9lflrrl.exe 1744 hhbhbh.exe 2884 djjpv.exe 2452 lllxrxr.exe 320 hbbbhn.exe 1992 tttnbh.exe 2508 jjdpv.exe 2780 rllffxl.exe 1496 9btbhn.exe 864 djvdj.exe 1268 lrrxlfl.exe 1900 7nhthh.exe 908 jjdpp.exe 2424 xxrlxlx.exe 2104 hnnbnb.exe 2436 7vvdv.exe 2172 ffrrffl.exe 904 hhbhnb.exe 408 7ppdp.exe 1348 xfxfrrl.exe 2024 rllfxxx.exe 1356 tththt.exe -
resource yara_rule behavioral1/memory/2696-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/316-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/864-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1084-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1264-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1940-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-318-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2828-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-361-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2204-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-427-0x00000000002A0000-0x00000000002CA000-memory.dmp upx behavioral1/memory/1496-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1268-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-480-0x00000000001C0000-0x00000000001EA000-memory.dmp upx behavioral1/memory/2172-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/904-496-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/904-503-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-537-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-588-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-608-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-659-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-696-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/352-745-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-834-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrllxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxfffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xlrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxllrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlxrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxlrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrxlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frflxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllxrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlxrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxlrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2088 wrote to memory of 2696 2088 2ceff16e99c461a47d2801340265225b653d1a45271b047047b4baaced88bb91.exe 30 PID 2088 wrote to memory of 2696 2088 2ceff16e99c461a47d2801340265225b653d1a45271b047047b4baaced88bb91.exe 30 PID 2088 wrote to memory of 2696 2088 2ceff16e99c461a47d2801340265225b653d1a45271b047047b4baaced88bb91.exe 30 PID 2088 wrote to memory of 2696 2088 2ceff16e99c461a47d2801340265225b653d1a45271b047047b4baaced88bb91.exe 30 PID 2696 wrote to memory of 2820 2696 frrxrfl.exe 31 PID 2696 wrote to memory of 2820 2696 frrxrfl.exe 31 PID 2696 wrote to memory of 2820 2696 frrxrfl.exe 31 PID 2696 wrote to memory of 2820 2696 frrxrfl.exe 31 PID 2820 wrote to memory of 2760 2820 7bnthh.exe 32 PID 2820 wrote to memory of 2760 2820 7bnthh.exe 32 PID 2820 wrote to memory of 2760 2820 7bnthh.exe 32 PID 2820 wrote to memory of 2760 2820 7bnthh.exe 32 PID 2760 wrote to memory of 2876 2760 7vpdd.exe 33 PID 2760 wrote to memory of 2876 2760 7vpdd.exe 33 PID 2760 wrote to memory of 2876 2760 7vpdd.exe 33 PID 2760 wrote to memory of 2876 2760 7vpdd.exe 33 PID 2876 wrote to memory of 2624 2876 htnhnn.exe 34 PID 2876 wrote to memory of 2624 2876 htnhnn.exe 34 PID 2876 wrote to memory of 2624 2876 htnhnn.exe 34 PID 2876 wrote to memory of 2624 2876 htnhnn.exe 34 PID 2624 wrote to memory of 2824 2624 jpjpp.exe 35 PID 2624 wrote to memory of 2824 2624 jpjpp.exe 35 PID 2624 wrote to memory of 2824 2624 jpjpp.exe 35 PID 2624 wrote to memory of 2824 2624 jpjpp.exe 35 PID 2824 wrote to memory of 2676 2824 9llrlrl.exe 36 PID 2824 wrote to memory of 2676 2824 9llrlrl.exe 36 PID 2824 wrote to memory of 2676 2824 9llrlrl.exe 36 PID 2824 wrote to memory of 2676 2824 9llrlrl.exe 36 PID 2676 wrote to memory of 2472 2676 llrlxfr.exe 37 PID 2676 wrote to memory of 2472 2676 llrlxfr.exe 37 PID 2676 wrote to memory of 2472 2676 llrlxfr.exe 37 PID 2676 wrote to memory of 2472 2676 llrlxfr.exe 37 PID 2472 wrote to memory of 2884 2472 jjdvd.exe 38 PID 2472 wrote to memory of 2884 2472 jjdvd.exe 38 PID 2472 wrote to memory of 2884 2472 jjdvd.exe 38 PID 2472 wrote to memory of 2884 2472 jjdvd.exe 38 PID 2884 wrote to memory of 2100 2884 llffrxl.exe 39 PID 2884 wrote to memory of 2100 2884 llffrxl.exe 39 PID 2884 wrote to memory of 2100 2884 llffrxl.exe 39 PID 2884 wrote to memory of 2100 2884 llffrxl.exe 39 PID 2100 wrote to memory of 2520 2100 3btbht.exe 40 PID 2100 wrote to memory of 2520 2100 3btbht.exe 40 PID 2100 wrote to memory of 2520 2100 3btbht.exe 40 PID 2100 wrote to memory of 2520 2100 3btbht.exe 40 PID 2520 wrote to memory of 316 2520 bnthnt.exe 41 PID 2520 wrote to memory of 316 2520 bnthnt.exe 41 PID 2520 wrote to memory of 316 2520 bnthnt.exe 41 PID 2520 wrote to memory of 316 2520 bnthnt.exe 41 PID 316 wrote to memory of 1312 316 5jvdv.exe 42 PID 316 wrote to memory of 1312 316 5jvdv.exe 42 PID 316 wrote to memory of 1312 316 5jvdv.exe 42 PID 316 wrote to memory of 1312 316 5jvdv.exe 42 PID 1312 wrote to memory of 864 1312 hnhnbh.exe 43 PID 1312 wrote to memory of 864 1312 hnhnbh.exe 43 PID 1312 wrote to memory of 864 1312 hnhnbh.exe 43 PID 1312 wrote to memory of 864 1312 hnhnbh.exe 43 PID 864 wrote to memory of 1084 864 9dvdv.exe 44 PID 864 wrote to memory of 1084 864 9dvdv.exe 44 PID 864 wrote to memory of 1084 864 9dvdv.exe 44 PID 864 wrote to memory of 1084 864 9dvdv.exe 44 PID 1084 wrote to memory of 2012 1084 vvpvp.exe 45 PID 1084 wrote to memory of 2012 1084 vvpvp.exe 45 PID 1084 wrote to memory of 2012 1084 vvpvp.exe 45 PID 1084 wrote to memory of 2012 1084 vvpvp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ceff16e99c461a47d2801340265225b653d1a45271b047047b4baaced88bb91.exe"C:\Users\Admin\AppData\Local\Temp\2ceff16e99c461a47d2801340265225b653d1a45271b047047b4baaced88bb91.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\frrxrfl.exec:\frrxrfl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\7bnthh.exec:\7bnthh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\7vpdd.exec:\7vpdd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\htnhnn.exec:\htnhnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\jpjpp.exec:\jpjpp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\9llrlrl.exec:\9llrlrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\llrlxfr.exec:\llrlxfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\jjdvd.exec:\jjdvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\llffrxl.exec:\llffrxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\3btbht.exec:\3btbht.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\bnthnt.exec:\bnthnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\5jvdv.exec:\5jvdv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316 -
\??\c:\hnhnbh.exec:\hnhnbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\9dvdv.exec:\9dvdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\vvpvp.exec:\vvpvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
\??\c:\rrllxrl.exec:\rrllxrl.exe17⤵
- Executes dropped EXE
PID:2012 -
\??\c:\vjjpd.exec:\vjjpd.exe18⤵
- Executes dropped EXE
PID:2580 -
\??\c:\xxlrlrl.exec:\xxlrlrl.exe19⤵
- Executes dropped EXE
PID:2332 -
\??\c:\xxxfrxr.exec:\xxxfrxr.exe20⤵
- Executes dropped EXE
PID:2268 -
\??\c:\nnhnbn.exec:\nnhnbn.exe21⤵
- Executes dropped EXE
PID:2176 -
\??\c:\xfxlxlx.exec:\xfxlxlx.exe22⤵
- Executes dropped EXE
PID:1080 -
\??\c:\3hnhnn.exec:\3hnhnn.exe23⤵
- Executes dropped EXE
PID:2476 -
\??\c:\rlrfrxr.exec:\rlrfrxr.exe24⤵
- Executes dropped EXE
PID:2496 -
\??\c:\9bhbtb.exec:\9bhbtb.exe25⤵
- Executes dropped EXE
PID:1264 -
\??\c:\fxlrxfl.exec:\fxlrxfl.exe26⤵
- Executes dropped EXE
PID:1664 -
\??\c:\jppvp.exec:\jppvp.exe27⤵
- Executes dropped EXE
PID:1732 -
\??\c:\5tnbbn.exec:\5tnbbn.exe28⤵
- Executes dropped EXE
PID:2212 -
\??\c:\rrlrlrx.exec:\rrlrlrx.exe29⤵
- Executes dropped EXE
PID:2984 -
\??\c:\nthttb.exec:\nthttb.exe30⤵
- Executes dropped EXE
PID:1940 -
\??\c:\xxrfxfx.exec:\xxrfxfx.exe31⤵
- Executes dropped EXE
PID:872 -
\??\c:\ddvjv.exec:\ddvjv.exe32⤵
- Executes dropped EXE
PID:1524 -
\??\c:\fffrflx.exec:\fffrflx.exe33⤵
- Executes dropped EXE
PID:2788 -
\??\c:\ppvvj.exec:\ppvvj.exe34⤵
- Executes dropped EXE
PID:2564 -
\??\c:\rflfxfx.exec:\rflfxfx.exe35⤵
- Executes dropped EXE
PID:2832 -
\??\c:\tnhbbb.exec:\tnhbbb.exe36⤵
- Executes dropped EXE
PID:1588 -
\??\c:\dvvdv.exec:\dvvdv.exe37⤵
- Executes dropped EXE
PID:2992 -
\??\c:\fxrxlrl.exec:\fxrxlrl.exe38⤵
- Executes dropped EXE
PID:2720 -
\??\c:\3flfxrx.exec:\3flfxrx.exe39⤵
- Executes dropped EXE
PID:2892 -
\??\c:\9bbhhn.exec:\9bbhhn.exe40⤵
- Executes dropped EXE
PID:2828 -
\??\c:\jjddd.exec:\jjddd.exe41⤵
- Executes dropped EXE
PID:2616 -
\??\c:\bnttbt.exec:\bnttbt.exe42⤵
- Executes dropped EXE
PID:2204 -
\??\c:\pvpjd.exec:\pvpjd.exe43⤵
- Executes dropped EXE
PID:2680 -
\??\c:\9lflrrl.exec:\9lflrrl.exe44⤵
- Executes dropped EXE
PID:296 -
\??\c:\hhbhbh.exec:\hhbhbh.exe45⤵
- Executes dropped EXE
PID:1744 -
\??\c:\djjpv.exec:\djjpv.exe46⤵
- Executes dropped EXE
PID:2884 -
\??\c:\lllxrxr.exec:\lllxrxr.exe47⤵
- Executes dropped EXE
PID:2452 -
\??\c:\hbbbhn.exec:\hbbbhn.exe48⤵
- Executes dropped EXE
PID:320 -
\??\c:\tttnbh.exec:\tttnbh.exe49⤵
- Executes dropped EXE
PID:1992 -
\??\c:\jjdpv.exec:\jjdpv.exe50⤵
- Executes dropped EXE
PID:2508 -
\??\c:\rllffxl.exec:\rllffxl.exe51⤵
- Executes dropped EXE
PID:2780 -
\??\c:\9btbhn.exec:\9btbhn.exe52⤵
- Executes dropped EXE
PID:1496 -
\??\c:\djvdj.exec:\djvdj.exe53⤵
- Executes dropped EXE
PID:864 -
\??\c:\lrrxlfl.exec:\lrrxlfl.exe54⤵
- Executes dropped EXE
PID:1268 -
\??\c:\7nhthh.exec:\7nhthh.exe55⤵
- Executes dropped EXE
PID:1900 -
\??\c:\jjdpp.exec:\jjdpp.exe56⤵
- Executes dropped EXE
PID:908 -
\??\c:\xxrlxlx.exec:\xxrlxlx.exe57⤵
- Executes dropped EXE
PID:2424 -
\??\c:\hnnbnb.exec:\hnnbnb.exe58⤵
- Executes dropped EXE
PID:2104 -
\??\c:\7vvdv.exec:\7vvdv.exe59⤵
- Executes dropped EXE
PID:2436 -
\??\c:\ffrrffl.exec:\ffrrffl.exe60⤵
- Executes dropped EXE
PID:2172 -
\??\c:\hhbhnb.exec:\hhbhnb.exe61⤵
- Executes dropped EXE
PID:904 -
\??\c:\7ppdp.exec:\7ppdp.exe62⤵
- Executes dropped EXE
PID:408 -
\??\c:\xfxfrrl.exec:\xfxfrrl.exe63⤵
- Executes dropped EXE
PID:1348 -
\??\c:\rllfxxx.exec:\rllfxxx.exe64⤵
- Executes dropped EXE
PID:2024 -
\??\c:\tththt.exec:\tththt.exe65⤵
- Executes dropped EXE
PID:1356 -
\??\c:\1dpvp.exec:\1dpvp.exe66⤵PID:2192
-
\??\c:\ffflxlx.exec:\ffflxlx.exe67⤵PID:1840
-
\??\c:\nnntbb.exec:\nnntbb.exe68⤵PID:2528
-
\??\c:\jdpdv.exec:\jdpdv.exe69⤵PID:976
-
\??\c:\dpppv.exec:\dpppv.exe70⤵PID:2300
-
\??\c:\7lffflx.exec:\7lffflx.exe71⤵PID:356
-
\??\c:\tnhhbn.exec:\tnhhbn.exe72⤵PID:1740
-
\??\c:\vvpvj.exec:\vvpvj.exe73⤵PID:1632
-
\??\c:\jjdpv.exec:\jjdpv.exe74⤵PID:2292
-
\??\c:\llfrflx.exec:\llfrflx.exe75⤵PID:2484
-
\??\c:\nnhtbh.exec:\nnhtbh.exe76⤵PID:2812
-
\??\c:\vvvdj.exec:\vvvdj.exe77⤵PID:2816
-
\??\c:\1lfrflx.exec:\1lfrflx.exe78⤵PID:2756
-
\??\c:\nththn.exec:\nththn.exe79⤵PID:1568
-
\??\c:\ntnthh.exec:\ntnthh.exe80⤵PID:2264
-
\??\c:\9jvvj.exec:\9jvvj.exe81⤵PID:2796
-
\??\c:\5lxxfrx.exec:\5lxxfrx.exe82⤵PID:2740
-
\??\c:\tnbtnh.exec:\tnbtnh.exe83⤵PID:2944
-
\??\c:\3vjpd.exec:\3vjpd.exe84⤵PID:2620
-
\??\c:\xrrxxrr.exec:\xrrxxrr.exe85⤵PID:2616
-
\??\c:\fxxrfxl.exec:\fxxrfxl.exe86⤵PID:2644
-
\??\c:\1tttth.exec:\1tttth.exe87⤵PID:2676
-
\??\c:\vvpjv.exec:\vvpjv.exe88⤵PID:2972
-
\??\c:\9lflrff.exec:\9lflrff.exe89⤵PID:1804
-
\??\c:\lffxffr.exec:\lffxffr.exe90⤵PID:2888
-
\??\c:\5nhnbh.exec:\5nhnbh.exe91⤵PID:2940
-
\??\c:\jpdpv.exec:\jpdpv.exe92⤵PID:1988
-
\??\c:\bbnnbb.exec:\bbnnbb.exe93⤵PID:2784
-
\??\c:\vppvd.exec:\vppvd.exe94⤵PID:2344
-
\??\c:\fxrxffx.exec:\fxrxffx.exe95⤵PID:1928
-
\??\c:\bbntbh.exec:\bbntbh.exe96⤵PID:2968
-
\??\c:\ddvvj.exec:\ddvvj.exe97⤵PID:568
-
\??\c:\xxlxffr.exec:\xxlxffr.exe98⤵PID:1260
-
\??\c:\3hnttt.exec:\3hnttt.exe99⤵PID:2012
-
\??\c:\pjddv.exec:\pjddv.exe100⤵PID:352
-
\??\c:\dvjjd.exec:\dvjjd.exe101⤵PID:1148
-
\??\c:\lxrrxxx.exec:\lxrrxxx.exe102⤵PID:2248
-
\??\c:\tttbht.exec:\tttbht.exe103⤵PID:2492
-
\??\c:\3dddj.exec:\3dddj.exe104⤵PID:1308
-
\??\c:\1ffxlrx.exec:\1ffxlrx.exe105⤵PID:2172
-
\??\c:\9bbbbh.exec:\9bbbbh.exe106⤵PID:1132
-
\??\c:\1hntbb.exec:\1hntbb.exe107⤵PID:2476
-
\??\c:\dvjjp.exec:\dvjjp.exe108⤵PID:800
-
\??\c:\fxrlxrx.exec:\fxrlxrx.exe109⤵PID:1640
-
\??\c:\hhnnnn.exec:\hhnnnn.exe110⤵PID:1616
-
\??\c:\7bnnnn.exec:\7bnnnn.exe111⤵PID:1688
-
\??\c:\vvdjj.exec:\vvdjj.exe112⤵PID:984
-
\??\c:\3llxflf.exec:\3llxflf.exe113⤵PID:2064
-
\??\c:\btnhtn.exec:\btnhtn.exe114⤵PID:2212
-
\??\c:\ppjdj.exec:\ppjdj.exe115⤵PID:2148
-
\??\c:\rfrrrlr.exec:\rfrrrlr.exe116⤵PID:1736
-
\??\c:\lfxfflx.exec:\lfxfflx.exe117⤵PID:1320
-
\??\c:\7bntbn.exec:\7bntbn.exe118⤵PID:2360
-
\??\c:\ppjpd.exec:\ppjpd.exe119⤵PID:3056
-
\??\c:\rllxrrx.exec:\rllxrrx.exe120⤵PID:2328
-
\??\c:\lllxxfl.exec:\lllxxfl.exe121⤵PID:2708
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-