Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-12-2024 01:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a0513790c80db293a82e9e71bcedc31618da52d7434ae9142fec4fc3a6048ec5.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
a0513790c80db293a82e9e71bcedc31618da52d7434ae9142fec4fc3a6048ec5.exe
-
Size
453KB
-
MD5
1767a84134b8741183ff99cb91227d91
-
SHA1
ace019c2b92f5183dcc683aa302c2530018428df
-
SHA256
a0513790c80db293a82e9e71bcedc31618da52d7434ae9142fec4fc3a6048ec5
-
SHA512
397d2decccd1046f78848d8e5fcdce92ac2342ffca6e1a398edf86817484a83371d576467b88eb64af8c5acd93714b0915db90206edb3beeee9af220d8bc7053
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeN:q7Tc2NYHUrAwfMp3CDN
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/1908-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1308-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2092-35-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/2092-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-80-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2896-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-94-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2644-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1500-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1188-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1200-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1988-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1856-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/760-291-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1588-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1608-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1608-307-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1608-311-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2412-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-356-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2892-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2412-364-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2700-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2444-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-408-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/784-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-448-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1080-456-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1080-455-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2980-467-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/628-516-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1604-582-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1612-585-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2212-596-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-652-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2784-674-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1308 vddjv.exe 2944 ffrxlfl.exe 2092 ddppj.exe 2800 xfrlrfl.exe 2760 3httnt.exe 2868 ddjdv.exe 2336 3thnbh.exe 2964 bbtntn.exe 2896 3vvpv.exe 2644 bhbhtt.exe 2456 1pjvd.exe 664 btntbh.exe 1500 7pddd.exe 1188 nhnbtb.exe 2836 vpjvp.exe 1200 thttth.exe 1856 djpvv.exe 1988 3bntbh.exe 2976 nttnbn.exe 2360 7bhhhn.exe 2168 9hbtnn.exe 556 dddpd.exe 3020 tttnbn.exe 1076 rlxlfxl.exe 1392 xffflrf.exe 2280 vpjpd.exe 2104 bbnthn.exe 1232 5lrflfl.exe 2576 hhthbb.exe 760 5xlfllr.exe 1588 7hhhtb.exe 1608 xxxrxrx.exe 2544 bbbtbh.exe 1536 jdvdp.exe 2992 rlxfxrl.exe 2412 nnnbnt.exe 2872 ddjvj.exe 2892 rxxrfrl.exe 2772 fllfrfr.exe 2700 1jjpv.exe 1644 dvvdj.exe 2608 fxrxfrf.exe 2444 7hhnbh.exe 2188 9jjpd.exe 524 vvpdj.exe 1972 llfrfrl.exe 2712 3bbhnb.exe 316 dvvjd.exe 1488 jjppd.exe 784 5fflrrf.exe 2940 hhbhnt.exe 1080 tnhtnt.exe 1956 pjjpj.exe 2980 lxxxlxf.exe 2368 hhhbhh.exe 2028 pvpdv.exe 1792 9jvvj.exe 2376 lxrlrrf.exe 2076 tnhtbn.exe 2448 pvvjp.exe 628 3pdvd.exe 2832 ffrxrrx.exe 1780 tthtbn.exe 1660 tnbbhn.exe -
resource yara_rule behavioral1/memory/1908-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1308-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-74-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2964-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/664-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1188-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1500-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1188-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1200-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1988-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1856-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1232-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/760-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1588-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/784-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1080-456-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-464-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-478-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-517-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1604-582-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-596-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-621-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-660-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-667-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-674-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/560-675-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fflrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffflxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rrrfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllrlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrlrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxxrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9fxxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tttbh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1908 wrote to memory of 1308 1908 a0513790c80db293a82e9e71bcedc31618da52d7434ae9142fec4fc3a6048ec5.exe 30 PID 1908 wrote to memory of 1308 1908 a0513790c80db293a82e9e71bcedc31618da52d7434ae9142fec4fc3a6048ec5.exe 30 PID 1908 wrote to memory of 1308 1908 a0513790c80db293a82e9e71bcedc31618da52d7434ae9142fec4fc3a6048ec5.exe 30 PID 1908 wrote to memory of 1308 1908 a0513790c80db293a82e9e71bcedc31618da52d7434ae9142fec4fc3a6048ec5.exe 30 PID 1308 wrote to memory of 2944 1308 vddjv.exe 31 PID 1308 wrote to memory of 2944 1308 vddjv.exe 31 PID 1308 wrote to memory of 2944 1308 vddjv.exe 31 PID 1308 wrote to memory of 2944 1308 vddjv.exe 31 PID 2944 wrote to memory of 2092 2944 ffrxlfl.exe 32 PID 2944 wrote to memory of 2092 2944 ffrxlfl.exe 32 PID 2944 wrote to memory of 2092 2944 ffrxlfl.exe 32 PID 2944 wrote to memory of 2092 2944 ffrxlfl.exe 32 PID 2092 wrote to memory of 2800 2092 ddppj.exe 33 PID 2092 wrote to memory of 2800 2092 ddppj.exe 33 PID 2092 wrote to memory of 2800 2092 ddppj.exe 33 PID 2092 wrote to memory of 2800 2092 ddppj.exe 33 PID 2800 wrote to memory of 2760 2800 xfrlrfl.exe 34 PID 2800 wrote to memory of 2760 2800 xfrlrfl.exe 34 PID 2800 wrote to memory of 2760 2800 xfrlrfl.exe 34 PID 2800 wrote to memory of 2760 2800 xfrlrfl.exe 34 PID 2760 wrote to memory of 2868 2760 3httnt.exe 35 PID 2760 wrote to memory of 2868 2760 3httnt.exe 35 PID 2760 wrote to memory of 2868 2760 3httnt.exe 35 PID 2760 wrote to memory of 2868 2760 3httnt.exe 35 PID 2868 wrote to memory of 2336 2868 ddjdv.exe 36 PID 2868 wrote to memory of 2336 2868 ddjdv.exe 36 PID 2868 wrote to memory of 2336 2868 ddjdv.exe 36 PID 2868 wrote to memory of 2336 2868 ddjdv.exe 36 PID 2336 wrote to memory of 2964 2336 3thnbh.exe 37 PID 2336 wrote to memory of 2964 2336 3thnbh.exe 37 PID 2336 wrote to memory of 2964 2336 3thnbh.exe 37 PID 2336 wrote to memory of 2964 2336 3thnbh.exe 37 PID 2964 wrote to memory of 2896 2964 bbtntn.exe 38 PID 2964 wrote to memory of 2896 2964 bbtntn.exe 38 PID 2964 wrote to memory of 2896 2964 bbtntn.exe 38 PID 2964 wrote to memory of 2896 2964 bbtntn.exe 38 PID 2896 wrote to memory of 2644 2896 3vvpv.exe 39 PID 2896 wrote to memory of 2644 2896 3vvpv.exe 39 PID 2896 wrote to memory of 2644 2896 3vvpv.exe 39 PID 2896 wrote to memory of 2644 2896 3vvpv.exe 39 PID 2644 wrote to memory of 2456 2644 bhbhtt.exe 40 PID 2644 wrote to memory of 2456 2644 bhbhtt.exe 40 PID 2644 wrote to memory of 2456 2644 bhbhtt.exe 40 PID 2644 wrote to memory of 2456 2644 bhbhtt.exe 40 PID 2456 wrote to memory of 664 2456 1pjvd.exe 41 PID 2456 wrote to memory of 664 2456 1pjvd.exe 41 PID 2456 wrote to memory of 664 2456 1pjvd.exe 41 PID 2456 wrote to memory of 664 2456 1pjvd.exe 41 PID 664 wrote to memory of 1500 664 btntbh.exe 42 PID 664 wrote to memory of 1500 664 btntbh.exe 42 PID 664 wrote to memory of 1500 664 btntbh.exe 42 PID 664 wrote to memory of 1500 664 btntbh.exe 42 PID 1500 wrote to memory of 1188 1500 7pddd.exe 43 PID 1500 wrote to memory of 1188 1500 7pddd.exe 43 PID 1500 wrote to memory of 1188 1500 7pddd.exe 43 PID 1500 wrote to memory of 1188 1500 7pddd.exe 43 PID 1188 wrote to memory of 2836 1188 nhnbtb.exe 44 PID 1188 wrote to memory of 2836 1188 nhnbtb.exe 44 PID 1188 wrote to memory of 2836 1188 nhnbtb.exe 44 PID 1188 wrote to memory of 2836 1188 nhnbtb.exe 44 PID 2836 wrote to memory of 1200 2836 vpjvp.exe 45 PID 2836 wrote to memory of 1200 2836 vpjvp.exe 45 PID 2836 wrote to memory of 1200 2836 vpjvp.exe 45 PID 2836 wrote to memory of 1200 2836 vpjvp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\a0513790c80db293a82e9e71bcedc31618da52d7434ae9142fec4fc3a6048ec5.exe"C:\Users\Admin\AppData\Local\Temp\a0513790c80db293a82e9e71bcedc31618da52d7434ae9142fec4fc3a6048ec5.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\vddjv.exec:\vddjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
\??\c:\ffrxlfl.exec:\ffrxlfl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\ddppj.exec:\ddppj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\xfrlrfl.exec:\xfrlrfl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\3httnt.exec:\3httnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\ddjdv.exec:\ddjdv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\3thnbh.exec:\3thnbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\bbtntn.exec:\bbtntn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\3vvpv.exec:\3vvpv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\bhbhtt.exec:\bhbhtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\1pjvd.exec:\1pjvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\btntbh.exec:\btntbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:664 -
\??\c:\7pddd.exec:\7pddd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
\??\c:\nhnbtb.exec:\nhnbtb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
\??\c:\vpjvp.exec:\vpjvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\thttth.exec:\thttth.exe17⤵
- Executes dropped EXE
PID:1200 -
\??\c:\djpvv.exec:\djpvv.exe18⤵
- Executes dropped EXE
PID:1856 -
\??\c:\3bntbh.exec:\3bntbh.exe19⤵
- Executes dropped EXE
PID:1988 -
\??\c:\nttnbn.exec:\nttnbn.exe20⤵
- Executes dropped EXE
PID:2976 -
\??\c:\7bhhhn.exec:\7bhhhn.exe21⤵
- Executes dropped EXE
PID:2360 -
\??\c:\9hbtnn.exec:\9hbtnn.exe22⤵
- Executes dropped EXE
PID:2168 -
\??\c:\dddpd.exec:\dddpd.exe23⤵
- Executes dropped EXE
PID:556 -
\??\c:\tttnbn.exec:\tttnbn.exe24⤵
- Executes dropped EXE
PID:3020 -
\??\c:\rlxlfxl.exec:\rlxlfxl.exe25⤵
- Executes dropped EXE
PID:1076 -
\??\c:\xffflrf.exec:\xffflrf.exe26⤵
- Executes dropped EXE
PID:1392 -
\??\c:\vpjpd.exec:\vpjpd.exe27⤵
- Executes dropped EXE
PID:2280 -
\??\c:\bbnthn.exec:\bbnthn.exe28⤵
- Executes dropped EXE
PID:2104 -
\??\c:\5lrflfl.exec:\5lrflfl.exe29⤵
- Executes dropped EXE
PID:1232 -
\??\c:\hhthbb.exec:\hhthbb.exe30⤵
- Executes dropped EXE
PID:2576 -
\??\c:\5xlfllr.exec:\5xlfllr.exe31⤵
- Executes dropped EXE
PID:760 -
\??\c:\7hhhtb.exec:\7hhhtb.exe32⤵
- Executes dropped EXE
PID:1588 -
\??\c:\xxxrxrx.exec:\xxxrxrx.exe33⤵
- Executes dropped EXE
PID:1608 -
\??\c:\bbbtbh.exec:\bbbtbh.exe34⤵
- Executes dropped EXE
PID:2544 -
\??\c:\jdvdp.exec:\jdvdp.exe35⤵
- Executes dropped EXE
PID:1536 -
\??\c:\rlxfxrl.exec:\rlxfxrl.exe36⤵
- Executes dropped EXE
PID:2992 -
\??\c:\nnnbnt.exec:\nnnbnt.exe37⤵
- Executes dropped EXE
PID:2412 -
\??\c:\ddjvj.exec:\ddjvj.exe38⤵
- Executes dropped EXE
PID:2872 -
\??\c:\rxxrfrl.exec:\rxxrfrl.exe39⤵
- Executes dropped EXE
PID:2892 -
\??\c:\fllfrfr.exec:\fllfrfr.exe40⤵
- Executes dropped EXE
PID:2772 -
\??\c:\1jjpv.exec:\1jjpv.exe41⤵
- Executes dropped EXE
PID:2700 -
\??\c:\dvvdj.exec:\dvvdj.exe42⤵
- Executes dropped EXE
PID:1644 -
\??\c:\fxrxfrf.exec:\fxrxfrf.exe43⤵
- Executes dropped EXE
PID:2608 -
\??\c:\7hhnbh.exec:\7hhnbh.exe44⤵
- Executes dropped EXE
PID:2444 -
\??\c:\9jjpd.exec:\9jjpd.exe45⤵
- Executes dropped EXE
PID:2188 -
\??\c:\vvpdj.exec:\vvpdj.exe46⤵
- Executes dropped EXE
PID:524 -
\??\c:\llfrfrl.exec:\llfrfrl.exe47⤵
- Executes dropped EXE
PID:1972 -
\??\c:\3bbhnb.exec:\3bbhnb.exe48⤵
- Executes dropped EXE
PID:2712 -
\??\c:\dvvjd.exec:\dvvjd.exe49⤵
- Executes dropped EXE
PID:316 -
\??\c:\jjppd.exec:\jjppd.exe50⤵
- Executes dropped EXE
PID:1488 -
\??\c:\5fflrrf.exec:\5fflrrf.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:784 -
\??\c:\hhbhnt.exec:\hhbhnt.exe52⤵
- Executes dropped EXE
PID:2940 -
\??\c:\tnhtnt.exec:\tnhtnt.exe53⤵
- Executes dropped EXE
PID:1080 -
\??\c:\pjjpj.exec:\pjjpj.exe54⤵
- Executes dropped EXE
PID:1956 -
\??\c:\lxxxlxf.exec:\lxxxlxf.exe55⤵
- Executes dropped EXE
PID:2980 -
\??\c:\hhhbhh.exec:\hhhbhh.exe56⤵
- Executes dropped EXE
PID:2368 -
\??\c:\pvpdv.exec:\pvpdv.exe57⤵
- Executes dropped EXE
PID:2028 -
\??\c:\9jvvj.exec:\9jvvj.exe58⤵
- Executes dropped EXE
PID:1792 -
\??\c:\lxrlrrf.exec:\lxrlrrf.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2376 -
\??\c:\tnhtbn.exec:\tnhtbn.exe60⤵
- Executes dropped EXE
PID:2076 -
\??\c:\pvvjp.exec:\pvvjp.exe61⤵
- Executes dropped EXE
PID:2448 -
\??\c:\3pdvd.exec:\3pdvd.exe62⤵
- Executes dropped EXE
PID:628 -
\??\c:\ffrxrrx.exec:\ffrxrrx.exe63⤵
- Executes dropped EXE
PID:2832 -
\??\c:\tthtbn.exec:\tthtbn.exe64⤵
- Executes dropped EXE
PID:1780 -
\??\c:\tnbbhn.exec:\tnbbhn.exe65⤵
- Executes dropped EXE
PID:1660 -
\??\c:\dddpj.exec:\dddpj.exe66⤵PID:2552
-
\??\c:\xlfrxfr.exec:\xlfrxfr.exe67⤵PID:2460
-
\??\c:\bbtnth.exec:\bbtnth.exe68⤵PID:2296
-
\??\c:\vvjdv.exec:\vvjdv.exe69⤵PID:564
-
\??\c:\vvdjj.exec:\vvdjj.exe70⤵PID:2000
-
\??\c:\ffflxll.exec:\ffflxll.exe71⤵
- System Location Discovery: System Language Discovery
PID:2328 -
\??\c:\7nhnbh.exec:\7nhnbh.exe72⤵PID:1604
-
\??\c:\hhnbbh.exec:\hhnbbh.exe73⤵PID:1612
-
\??\c:\jjdjv.exec:\jjdjv.exe74⤵PID:2212
-
\??\c:\lrlrfrx.exec:\lrlrfrx.exe75⤵PID:2384
-
\??\c:\5nttnt.exec:\5nttnt.exe76⤵PID:1536
-
\??\c:\bntnnb.exec:\bntnnb.exe77⤵PID:2380
-
\??\c:\pjvpj.exec:\pjvpj.exe78⤵PID:2408
-
\??\c:\3lrxlrx.exec:\3lrxlrx.exe79⤵PID:2932
-
\??\c:\lrrxlrf.exec:\lrrxlrf.exe80⤵PID:2096
-
\??\c:\htnhbh.exec:\htnhbh.exe81⤵PID:2916
-
\??\c:\dvddj.exec:\dvddj.exe82⤵PID:2924
-
\??\c:\dvppj.exec:\dvppj.exe83⤵PID:2660
-
\??\c:\llrlxlf.exec:\llrlxlf.exe84⤵PID:2616
-
\??\c:\9tthbn.exec:\9tthbn.exe85⤵PID:2684
-
\??\c:\jjjpd.exec:\jjjpd.exe86⤵PID:2784
-
\??\c:\5fxlxxf.exec:\5fxlxxf.exe87⤵PID:560
-
\??\c:\rfxxrfl.exec:\rfxxrfl.exe88⤵
- System Location Discovery: System Language Discovery
PID:1676 -
\??\c:\3ththt.exec:\3ththt.exe89⤵PID:2816
-
\??\c:\5pdpj.exec:\5pdpj.exe90⤵PID:1104
-
\??\c:\jvdvj.exec:\jvdvj.exe91⤵PID:1112
-
\??\c:\xlflxfr.exec:\xlflxfr.exe92⤵PID:1732
-
\??\c:\nbhhht.exec:\nbhhht.exe93⤵PID:340
-
\??\c:\vvpvp.exec:\vvpvp.exe94⤵PID:2820
-
\??\c:\5dvpp.exec:\5dvpp.exe95⤵PID:1856
-
\??\c:\frlrxlx.exec:\frlrxlx.exe96⤵PID:1960
-
\??\c:\3hbbhh.exec:\3hbbhh.exe97⤵PID:1428
-
\??\c:\bnnbth.exec:\bnnbth.exe98⤵PID:2140
-
\??\c:\djjpj.exec:\djjpj.exe99⤵PID:2360
-
\??\c:\fxxlfxl.exec:\fxxlfxl.exe100⤵PID:2272
-
\??\c:\1fffrff.exec:\1fffrff.exe101⤵PID:1792
-
\??\c:\nbhnth.exec:\nbhnth.exe102⤵PID:600
-
\??\c:\ppjjj.exec:\ppjjj.exe103⤵PID:2072
-
\??\c:\rxffrfl.exec:\rxffrfl.exe104⤵PID:1976
-
\??\c:\lxrxfff.exec:\lxrxfff.exe105⤵PID:1784
-
\??\c:\nnnbnn.exec:\nnnbnn.exe106⤵PID:1392
-
\??\c:\vpjvp.exec:\vpjvp.exe107⤵PID:2236
-
\??\c:\pjpvv.exec:\pjpvv.exe108⤵PID:2532
-
\??\c:\fflrxxl.exec:\fflrxxl.exe109⤵PID:2552
-
\??\c:\9hhntn.exec:\9hhntn.exe110⤵PID:2492
-
\??\c:\nbnthh.exec:\nbnthh.exe111⤵PID:2220
-
\??\c:\vpjjj.exec:\vpjjj.exe112⤵PID:872
-
\??\c:\rrfrflr.exec:\rrfrflr.exe113⤵PID:2000
-
\??\c:\rlxffrl.exec:\rlxffrl.exe114⤵PID:2500
-
\??\c:\5httth.exec:\5httth.exe115⤵PID:1604
-
\??\c:\jddpv.exec:\jddpv.exe116⤵PID:1136
-
\??\c:\dvjjd.exec:\dvjjd.exe117⤵PID:2544
-
\??\c:\frlxlxl.exec:\frlxlxl.exe118⤵PID:2064
-
\??\c:\jpvjv.exec:\jpvjv.exe119⤵PID:1468
-
\??\c:\1rllllr.exec:\1rllllr.exe120⤵PID:2876
-
\??\c:\7rrrfff.exec:\7rrrfff.exe121⤵
- System Location Discovery: System Language Discovery
PID:2872
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-