Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-12-2024 00:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
81fbcdef13e98021f65872e9cc95a4a22cd754513de7eb687ea933143338a8c6.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
81fbcdef13e98021f65872e9cc95a4a22cd754513de7eb687ea933143338a8c6.exe
-
Size
454KB
-
MD5
ddbb08113a08f4e24b27d944c03a9245
-
SHA1
e7b0d4617d16e760c72661a6c6e4d77e58bb7fc2
-
SHA256
81fbcdef13e98021f65872e9cc95a4a22cd754513de7eb687ea933143338a8c6
-
SHA512
a7e756d20231933cbf8131bc238299c95a7f108db41565c5632cf15abdc55cad10daed9e7d9d7bef52e41175c0b2e48bc1107eb0b7c77027a47f918bdab1c2a5
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeT2:q7Tc2NYHUrAwfMp3CDa
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/1884-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2496-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1636-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-54-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2448-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2312-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1312-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/808-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/808-148-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1796-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1352-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/840-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1144-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/236-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1660-268-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2228-279-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2260-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2496-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/604-442-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1976-474-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1680-488-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1900-513-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-646-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-665-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2140-752-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2596-871-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2304-914-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2868-975-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2308-1140-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1328-1224-0x0000000001C80000-0x0000000001CAA000-memory.dmp family_blackmoon behavioral1/memory/2968-1252-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1148-1286-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/944-1346-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1916-1358-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2548 dddvv.exe 2556 5jpjp.exe 2496 pjjpj.exe 2252 ffxxxlx.exe 2920 btnnhn.exe 1636 9llflrf.exe 2448 hhnthn.exe 2656 5tbbnt.exe 1912 pvvdv.exe 2684 5ffffrr.exe 2312 lrlxrxl.exe 1328 djdpd.exe 1312 rrlrlrl.exe 2824 vpjjv.exe 808 xfrfffr.exe 928 1rxrxxl.exe 1796 xxrxlrl.exe 2972 vpjpp.exe 3032 rlxfrrx.exe 1352 hbbnbb.exe 840 xffrfrl.exe 1144 dvppd.exe 1640 xxrlxfl.exe 2884 bnhnth.exe 1376 vvvjp.exe 236 5btntb.exe 2544 ppjjj.exe 1660 3bbnnn.exe 2228 ddvvp.exe 2260 rlxxffr.exe 1816 5jjpp.exe 2180 lxrfrrf.exe 1616 bbthnb.exe 2308 djpvv.exe 2320 1xrxflx.exe 2516 nnnnth.exe 2496 btthhh.exe 2252 jdpvd.exe 2300 xrlrxrf.exe 2108 nntbnt.exe 2668 1bnnnt.exe 2952 vvjvd.exe 2148 lxfrrll.exe 2828 1btbtb.exe 2704 bthnbh.exe 2684 pdjjp.exe 2364 1lffllx.exe 560 thtbbb.exe 1116 nbtbhh.exe 2820 vpdvd.exe 2968 lxffllr.exe 2864 hhtttt.exe 484 bnbttt.exe 604 jvpvj.exe 928 7lxxxxx.exe 1668 lxrxxxl.exe 1776 hbbttn.exe 2996 9pjpj.exe 1976 1dvdj.exe 3032 rlxxxxf.exe 2836 bthhhh.exe 1680 thttnn.exe 1932 9jjjp.exe 1100 1xxrrlx.exe -
resource yara_rule behavioral1/memory/1884-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1312-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/808-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1796-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1796-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1352-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/840-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1144-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1640-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/236-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/604-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1668-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-481-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1900-513-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-646-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-665-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/604-715-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-820-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-855-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-900-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-975-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-982-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-1025-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/496-1056-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-1141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1868-1148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-1161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1328-1224-0x0000000001C80000-0x0000000001CAA000-memory.dmp upx behavioral1/memory/928-1272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1148-1279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/944-1346-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1108-1377-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ntbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xlflff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxlrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxllrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrffrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lffllx.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1884 wrote to memory of 2548 1884 81fbcdef13e98021f65872e9cc95a4a22cd754513de7eb687ea933143338a8c6.exe 30 PID 1884 wrote to memory of 2548 1884 81fbcdef13e98021f65872e9cc95a4a22cd754513de7eb687ea933143338a8c6.exe 30 PID 1884 wrote to memory of 2548 1884 81fbcdef13e98021f65872e9cc95a4a22cd754513de7eb687ea933143338a8c6.exe 30 PID 1884 wrote to memory of 2548 1884 81fbcdef13e98021f65872e9cc95a4a22cd754513de7eb687ea933143338a8c6.exe 30 PID 2548 wrote to memory of 2556 2548 dddvv.exe 31 PID 2548 wrote to memory of 2556 2548 dddvv.exe 31 PID 2548 wrote to memory of 2556 2548 dddvv.exe 31 PID 2548 wrote to memory of 2556 2548 dddvv.exe 31 PID 2556 wrote to memory of 2496 2556 5jpjp.exe 32 PID 2556 wrote to memory of 2496 2556 5jpjp.exe 32 PID 2556 wrote to memory of 2496 2556 5jpjp.exe 32 PID 2556 wrote to memory of 2496 2556 5jpjp.exe 32 PID 2496 wrote to memory of 2252 2496 pjjpj.exe 33 PID 2496 wrote to memory of 2252 2496 pjjpj.exe 33 PID 2496 wrote to memory of 2252 2496 pjjpj.exe 33 PID 2496 wrote to memory of 2252 2496 pjjpj.exe 33 PID 2252 wrote to memory of 2920 2252 ffxxxlx.exe 34 PID 2252 wrote to memory of 2920 2252 ffxxxlx.exe 34 PID 2252 wrote to memory of 2920 2252 ffxxxlx.exe 34 PID 2252 wrote to memory of 2920 2252 ffxxxlx.exe 34 PID 2920 wrote to memory of 1636 2920 btnnhn.exe 35 PID 2920 wrote to memory of 1636 2920 btnnhn.exe 35 PID 2920 wrote to memory of 1636 2920 btnnhn.exe 35 PID 2920 wrote to memory of 1636 2920 btnnhn.exe 35 PID 1636 wrote to memory of 2448 1636 9llflrf.exe 36 PID 1636 wrote to memory of 2448 1636 9llflrf.exe 36 PID 1636 wrote to memory of 2448 1636 9llflrf.exe 36 PID 1636 wrote to memory of 2448 1636 9llflrf.exe 36 PID 2448 wrote to memory of 2656 2448 hhnthn.exe 37 PID 2448 wrote to memory of 2656 2448 hhnthn.exe 37 PID 2448 wrote to memory of 2656 2448 hhnthn.exe 37 PID 2448 wrote to memory of 2656 2448 hhnthn.exe 37 PID 2656 wrote to memory of 1912 2656 5tbbnt.exe 38 PID 2656 wrote to memory of 1912 2656 5tbbnt.exe 38 PID 2656 wrote to memory of 1912 2656 5tbbnt.exe 38 PID 2656 wrote to memory of 1912 2656 5tbbnt.exe 38 PID 1912 wrote to memory of 2684 1912 pvvdv.exe 39 PID 1912 wrote to memory of 2684 1912 pvvdv.exe 39 PID 1912 wrote to memory of 2684 1912 pvvdv.exe 39 PID 1912 wrote to memory of 2684 1912 pvvdv.exe 39 PID 2684 wrote to memory of 2312 2684 5ffffrr.exe 40 PID 2684 wrote to memory of 2312 2684 5ffffrr.exe 40 PID 2684 wrote to memory of 2312 2684 5ffffrr.exe 40 PID 2684 wrote to memory of 2312 2684 5ffffrr.exe 40 PID 2312 wrote to memory of 1328 2312 lrlxrxl.exe 41 PID 2312 wrote to memory of 1328 2312 lrlxrxl.exe 41 PID 2312 wrote to memory of 1328 2312 lrlxrxl.exe 41 PID 2312 wrote to memory of 1328 2312 lrlxrxl.exe 41 PID 1328 wrote to memory of 1312 1328 djdpd.exe 42 PID 1328 wrote to memory of 1312 1328 djdpd.exe 42 PID 1328 wrote to memory of 1312 1328 djdpd.exe 42 PID 1328 wrote to memory of 1312 1328 djdpd.exe 42 PID 1312 wrote to memory of 2824 1312 rrlrlrl.exe 43 PID 1312 wrote to memory of 2824 1312 rrlrlrl.exe 43 PID 1312 wrote to memory of 2824 1312 rrlrlrl.exe 43 PID 1312 wrote to memory of 2824 1312 rrlrlrl.exe 43 PID 2824 wrote to memory of 808 2824 vpjjv.exe 44 PID 2824 wrote to memory of 808 2824 vpjjv.exe 44 PID 2824 wrote to memory of 808 2824 vpjjv.exe 44 PID 2824 wrote to memory of 808 2824 vpjjv.exe 44 PID 808 wrote to memory of 928 808 xfrfffr.exe 45 PID 808 wrote to memory of 928 808 xfrfffr.exe 45 PID 808 wrote to memory of 928 808 xfrfffr.exe 45 PID 808 wrote to memory of 928 808 xfrfffr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\81fbcdef13e98021f65872e9cc95a4a22cd754513de7eb687ea933143338a8c6.exe"C:\Users\Admin\AppData\Local\Temp\81fbcdef13e98021f65872e9cc95a4a22cd754513de7eb687ea933143338a8c6.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\dddvv.exec:\dddvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\5jpjp.exec:\5jpjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\pjjpj.exec:\pjjpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\ffxxxlx.exec:\ffxxxlx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\btnnhn.exec:\btnnhn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\9llflrf.exec:\9llflrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\hhnthn.exec:\hhnthn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\5tbbnt.exec:\5tbbnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\pvvdv.exec:\pvvdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\5ffffrr.exec:\5ffffrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\lrlxrxl.exec:\lrlxrxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\djdpd.exec:\djdpd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
\??\c:\rrlrlrl.exec:\rrlrlrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\vpjjv.exec:\vpjjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\xfrfffr.exec:\xfrfffr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
\??\c:\1rxrxxl.exec:\1rxrxxl.exe17⤵
- Executes dropped EXE
PID:928 -
\??\c:\xxrxlrl.exec:\xxrxlrl.exe18⤵
- Executes dropped EXE
PID:1796 -
\??\c:\vpjpp.exec:\vpjpp.exe19⤵
- Executes dropped EXE
PID:2972 -
\??\c:\rlxfrrx.exec:\rlxfrrx.exe20⤵
- Executes dropped EXE
PID:3032 -
\??\c:\hbbnbb.exec:\hbbnbb.exe21⤵
- Executes dropped EXE
PID:1352 -
\??\c:\xffrfrl.exec:\xffrfrl.exe22⤵
- Executes dropped EXE
PID:840 -
\??\c:\dvppd.exec:\dvppd.exe23⤵
- Executes dropped EXE
PID:1144 -
\??\c:\xxrlxfl.exec:\xxrlxfl.exe24⤵
- Executes dropped EXE
PID:1640 -
\??\c:\bnhnth.exec:\bnhnth.exe25⤵
- Executes dropped EXE
PID:2884 -
\??\c:\vvvjp.exec:\vvvjp.exe26⤵
- Executes dropped EXE
PID:1376 -
\??\c:\5btntb.exec:\5btntb.exe27⤵
- Executes dropped EXE
PID:236 -
\??\c:\ppjjj.exec:\ppjjj.exe28⤵
- Executes dropped EXE
PID:2544 -
\??\c:\3bbnnn.exec:\3bbnnn.exe29⤵
- Executes dropped EXE
PID:1660 -
\??\c:\ddvvp.exec:\ddvvp.exe30⤵
- Executes dropped EXE
PID:2228 -
\??\c:\rlxxffr.exec:\rlxxffr.exe31⤵
- Executes dropped EXE
PID:2260 -
\??\c:\5jjpp.exec:\5jjpp.exe32⤵
- Executes dropped EXE
PID:1816 -
\??\c:\lxrfrrf.exec:\lxrfrrf.exe33⤵
- Executes dropped EXE
PID:2180 -
\??\c:\bbthnb.exec:\bbthnb.exe34⤵
- Executes dropped EXE
PID:1616 -
\??\c:\djpvv.exec:\djpvv.exe35⤵
- Executes dropped EXE
PID:2308 -
\??\c:\1xrxflx.exec:\1xrxflx.exe36⤵
- Executes dropped EXE
PID:2320 -
\??\c:\nnnnth.exec:\nnnnth.exe37⤵
- Executes dropped EXE
PID:2516 -
\??\c:\btthhh.exec:\btthhh.exe38⤵
- Executes dropped EXE
PID:2496 -
\??\c:\jdpvd.exec:\jdpvd.exe39⤵
- Executes dropped EXE
PID:2252 -
\??\c:\xrlrxrf.exec:\xrlrxrf.exe40⤵
- Executes dropped EXE
PID:2300 -
\??\c:\nntbnt.exec:\nntbnt.exe41⤵
- Executes dropped EXE
PID:2108 -
\??\c:\1bnnnt.exec:\1bnnnt.exe42⤵
- Executes dropped EXE
PID:2668 -
\??\c:\vvjvd.exec:\vvjvd.exe43⤵
- Executes dropped EXE
PID:2952 -
\??\c:\lxfrrll.exec:\lxfrrll.exe44⤵
- Executes dropped EXE
PID:2148 -
\??\c:\1btbtb.exec:\1btbtb.exe45⤵
- Executes dropped EXE
PID:2828 -
\??\c:\bthnbh.exec:\bthnbh.exe46⤵
- Executes dropped EXE
PID:2704 -
\??\c:\pdjjp.exec:\pdjjp.exe47⤵
- Executes dropped EXE
PID:2684 -
\??\c:\1lffllx.exec:\1lffllx.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2364 -
\??\c:\thtbbb.exec:\thtbbb.exe49⤵
- Executes dropped EXE
PID:560 -
\??\c:\nbtbhh.exec:\nbtbhh.exe50⤵
- Executes dropped EXE
PID:1116 -
\??\c:\vpdvd.exec:\vpdvd.exe51⤵
- Executes dropped EXE
PID:2820 -
\??\c:\lxffllr.exec:\lxffllr.exe52⤵
- Executes dropped EXE
PID:2968 -
\??\c:\hhtttt.exec:\hhtttt.exe53⤵
- Executes dropped EXE
PID:2864 -
\??\c:\bnbttt.exec:\bnbttt.exe54⤵
- Executes dropped EXE
PID:484 -
\??\c:\jvpvj.exec:\jvpvj.exe55⤵
- Executes dropped EXE
PID:604 -
\??\c:\7lxxxxx.exec:\7lxxxxx.exe56⤵
- Executes dropped EXE
PID:928 -
\??\c:\lxrxxxl.exec:\lxrxxxl.exe57⤵
- Executes dropped EXE
PID:1668 -
\??\c:\hbbttn.exec:\hbbttn.exe58⤵
- Executes dropped EXE
PID:1776 -
\??\c:\9pjpj.exec:\9pjpj.exe59⤵
- Executes dropped EXE
PID:2996 -
\??\c:\1dvdj.exec:\1dvdj.exe60⤵
- Executes dropped EXE
PID:1976 -
\??\c:\rlxxxxf.exec:\rlxxxxf.exe61⤵
- Executes dropped EXE
PID:3032 -
\??\c:\bthhhh.exec:\bthhhh.exe62⤵
- Executes dropped EXE
PID:2836 -
\??\c:\thttnn.exec:\thttnn.exe63⤵
- Executes dropped EXE
PID:1680 -
\??\c:\9jjjp.exec:\9jjjp.exe64⤵
- Executes dropped EXE
PID:1932 -
\??\c:\1xxrrlx.exec:\1xxrrlx.exe65⤵
- Executes dropped EXE
PID:1100 -
\??\c:\3lrlrlx.exec:\3lrlrlx.exe66⤵PID:1900
-
\??\c:\nhnnnn.exec:\nhnnnn.exe67⤵PID:1800
-
\??\c:\jvdvv.exec:\jvdvv.exe68⤵PID:772
-
\??\c:\7djjd.exec:\7djjd.exe69⤵PID:2244
-
\??\c:\7xxxxxf.exec:\7xxxxxf.exe70⤵PID:640
-
\??\c:\nnnnnn.exec:\nnnnnn.exe71⤵PID:3044
-
\??\c:\7nhbbh.exec:\7nhbbh.exe72⤵PID:1844
-
\??\c:\3jvvv.exec:\3jvvv.exe73⤵PID:1792
-
\??\c:\rxfxfxr.exec:\rxfxfxr.exe74⤵PID:1468
-
\??\c:\nbnnnt.exec:\nbnnnt.exe75⤵PID:2260
-
\??\c:\hthttt.exec:\hthttt.exe76⤵PID:2160
-
\??\c:\1dppp.exec:\1dppp.exe77⤵PID:348
-
\??\c:\rfrlffr.exec:\rfrlffr.exe78⤵PID:1620
-
\??\c:\1fxfffl.exec:\1fxfffl.exe79⤵PID:3064
-
\??\c:\tnhnhn.exec:\tnhnhn.exe80⤵PID:2476
-
\??\c:\9jdvj.exec:\9jdvj.exe81⤵PID:2500
-
\??\c:\dvpvj.exec:\dvpvj.exe82⤵PID:2776
-
\??\c:\rlxflxx.exec:\rlxflxx.exe83⤵PID:2784
-
\??\c:\bhhtbh.exec:\bhhtbh.exe84⤵PID:2920
-
\??\c:\vjvdj.exec:\vjvdj.exe85⤵PID:2892
-
\??\c:\vvvjj.exec:\vvvjj.exe86⤵PID:2304
-
\??\c:\frrxrfr.exec:\frrxrfr.exe87⤵PID:2216
-
\??\c:\htnbnt.exec:\htnbnt.exe88⤵PID:2184
-
\??\c:\9thbhh.exec:\9thbhh.exe89⤵PID:2916
-
\??\c:\vjvjv.exec:\vjvjv.exe90⤵PID:2752
-
\??\c:\frfflrr.exec:\frfflrr.exe91⤵PID:2940
-
\??\c:\fxllrrx.exec:\fxllrrx.exe92⤵PID:2684
-
\??\c:\3hhhhb.exec:\3hhhhb.exe93⤵PID:1512
-
\??\c:\vpdvd.exec:\vpdvd.exe94⤵PID:1280
-
\??\c:\dvpdd.exec:\dvpdd.exe95⤵PID:1116
-
\??\c:\1rrlxxf.exec:\1rrlxxf.exe96⤵PID:1532
-
\??\c:\btnttb.exec:\btnttb.exe97⤵PID:2824
-
\??\c:\pjvpv.exec:\pjvpv.exe98⤵PID:2872
-
\??\c:\pdjjv.exec:\pdjjv.exe99⤵PID:2848
-
\??\c:\fxlrlrx.exec:\fxlrlrx.exe100⤵PID:604
-
\??\c:\3nhntb.exec:\3nhntb.exe101⤵PID:1892
-
\??\c:\jjddj.exec:\jjddj.exe102⤵PID:1148
-
\??\c:\rfrrlll.exec:\rfrrlll.exe103⤵PID:3000
-
\??\c:\7nhhnt.exec:\7nhhnt.exe104⤵PID:1596
-
\??\c:\ttbhtb.exec:\ttbhtb.exe105⤵PID:2140
-
\??\c:\pdpjp.exec:\pdpjp.exe106⤵PID:2204
-
\??\c:\rrllxfx.exec:\rrllxfx.exe107⤵PID:840
-
\??\c:\3frrfff.exec:\3frrfff.exe108⤵PID:716
-
\??\c:\bhnhbn.exec:\bhnhbn.exe109⤵PID:1388
-
\??\c:\7jddd.exec:\7jddd.exe110⤵PID:2816
-
\??\c:\lxxflxx.exec:\lxxflxx.exe111⤵PID:1768
-
\??\c:\rrrflrf.exec:\rrrflrf.exe112⤵PID:1784
-
\??\c:\7hbnth.exec:\7hbnth.exe113⤵PID:944
-
\??\c:\dvdpj.exec:\dvdpj.exe114⤵PID:1756
-
\??\c:\ffxlrfr.exec:\ffxlrfr.exe115⤵PID:1052
-
\??\c:\llffffr.exec:\llffffr.exe116⤵PID:2568
-
\??\c:\nhnbnn.exec:\nhnbnn.exe117⤵PID:1764
-
\??\c:\dvppd.exec:\dvppd.exe118⤵PID:1316
-
\??\c:\llffrfr.exec:\llffrfr.exe119⤵PID:1772
-
\??\c:\fxlfrxf.exec:\fxlfrxf.exe120⤵PID:2580
-
\??\c:\tnntbn.exec:\tnntbn.exe121⤵PID:1704
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-