Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-12-2024 04:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f54f12a8bdbe8a71dd3d90f2197f708f734b822fe849d4ac823f31671318fdaf.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
f54f12a8bdbe8a71dd3d90f2197f708f734b822fe849d4ac823f31671318fdaf.exe
-
Size
454KB
-
MD5
461470b4af3eecdfe0353a10b7114339
-
SHA1
f28906cfbcc6482783b7f3920f033e8127e2893c
-
SHA256
f54f12a8bdbe8a71dd3d90f2197f708f734b822fe849d4ac823f31671318fdaf
-
SHA512
4cbd68100dd8cde189a3d54fc29eb5381a4df4bc99e7d02f6d00dd0cfbb5aebb7b7934e690f75302696e4493943769b2be418c90bedac2405d8c45e1b698c3e0
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbew:q7Tc2NYHUrAwfMp3CDw
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/548-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/280-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/768-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2064-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/492-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1404-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-173-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2492-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/572-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-236-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2292-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1900-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1864-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1756-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1592-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1220-416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2132-437-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2192-467-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-542-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-548-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1984-557-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2892-717-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-725-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-850-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2652-894-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1060-1002-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2192-1010-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2528-1145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1140-1268-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2960-1325-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2612 pjddp.exe 280 jvjdj.exe 2836 ddjjp.exe 2672 xxflxxf.exe 2796 1bhhhh.exe 2540 jdvvd.exe 2568 5pjjp.exe 2704 frffllx.exe 2544 nnhhtt.exe 2988 vpvvv.exe 768 bttthh.exe 1840 jvjpp.exe 2064 nbttbt.exe 492 dddvv.exe 2780 hbtbtb.exe 1300 nhtbhb.exe 2876 nnhbnb.exe 1404 hbntnh.exe 2968 rlrxxff.exe 1208 9nnthn.exe 2104 pjddj.exe 564 rfrrrrx.exe 1292 vjdjd.exe 2492 fxlxrxl.exe 572 7jdpv.exe 2292 rxrxrrf.exe 3028 1bnbhn.exe 692 jpjpv.exe 1900 pjvdj.exe 1864 9dvpv.exe 1756 7bhnbh.exe 1052 ddvvj.exe 2004 5bnttt.exe 1592 nhbbhb.exe 2508 3dvdp.exe 2680 flflffx.exe 3044 rfrxrrf.exe 2684 tthnnn.exe 3060 jdddj.exe 2636 dvjpd.exe 2852 fxlllfl.exe 2568 1thnbh.exe 2552 bnbbbb.exe 2984 jvjdj.exe 1960 7frrffl.exe 888 hbhhbh.exe 1752 nhntbb.exe 2844 jdpjd.exe 776 3lfxxfr.exe 1000 7lllfrx.exe 1220 hhbthn.exe 2780 vjvpp.exe 636 3fxxffl.exe 1976 frxxffr.exe 2132 1vjpp.exe 2892 jjvdd.exe 2968 xxllrrf.exe 2348 tnhnbb.exe 2192 nnbhtb.exe 2940 vppjv.exe 1032 1rllrxf.exe 1308 nbnttn.exe 1680 bhhnbb.exe 2492 dvjdj.exe -
resource yara_rule behavioral1/memory/548-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/280-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/768-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/492-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1404-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/572-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1900-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1864-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1756-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/776-399-0x00000000005C0000-0x00000000005EA000-memory.dmp upx behavioral1/memory/1220-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-437-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2192-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-498-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-542-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-548-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1000-674-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/636-718-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2892-717-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-725-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-732-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1852-764-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-826-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-850-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2540-876-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1060-1002-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-1010-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-1042-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-1049-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1004-1056-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-1069-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2808-1132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-1145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-1158-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfffllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nttbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frflrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlfrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllxllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 548 wrote to memory of 2612 548 f54f12a8bdbe8a71dd3d90f2197f708f734b822fe849d4ac823f31671318fdaf.exe 31 PID 548 wrote to memory of 2612 548 f54f12a8bdbe8a71dd3d90f2197f708f734b822fe849d4ac823f31671318fdaf.exe 31 PID 548 wrote to memory of 2612 548 f54f12a8bdbe8a71dd3d90f2197f708f734b822fe849d4ac823f31671318fdaf.exe 31 PID 548 wrote to memory of 2612 548 f54f12a8bdbe8a71dd3d90f2197f708f734b822fe849d4ac823f31671318fdaf.exe 31 PID 2612 wrote to memory of 280 2612 pjddp.exe 32 PID 2612 wrote to memory of 280 2612 pjddp.exe 32 PID 2612 wrote to memory of 280 2612 pjddp.exe 32 PID 2612 wrote to memory of 280 2612 pjddp.exe 32 PID 280 wrote to memory of 2836 280 jvjdj.exe 33 PID 280 wrote to memory of 2836 280 jvjdj.exe 33 PID 280 wrote to memory of 2836 280 jvjdj.exe 33 PID 280 wrote to memory of 2836 280 jvjdj.exe 33 PID 2836 wrote to memory of 2672 2836 ddjjp.exe 34 PID 2836 wrote to memory of 2672 2836 ddjjp.exe 34 PID 2836 wrote to memory of 2672 2836 ddjjp.exe 34 PID 2836 wrote to memory of 2672 2836 ddjjp.exe 34 PID 2672 wrote to memory of 2796 2672 xxflxxf.exe 35 PID 2672 wrote to memory of 2796 2672 xxflxxf.exe 35 PID 2672 wrote to memory of 2796 2672 xxflxxf.exe 35 PID 2672 wrote to memory of 2796 2672 xxflxxf.exe 35 PID 2796 wrote to memory of 2540 2796 1bhhhh.exe 36 PID 2796 wrote to memory of 2540 2796 1bhhhh.exe 36 PID 2796 wrote to memory of 2540 2796 1bhhhh.exe 36 PID 2796 wrote to memory of 2540 2796 1bhhhh.exe 36 PID 2540 wrote to memory of 2568 2540 jdvvd.exe 37 PID 2540 wrote to memory of 2568 2540 jdvvd.exe 37 PID 2540 wrote to memory of 2568 2540 jdvvd.exe 37 PID 2540 wrote to memory of 2568 2540 jdvvd.exe 37 PID 2568 wrote to memory of 2704 2568 5pjjp.exe 38 PID 2568 wrote to memory of 2704 2568 5pjjp.exe 38 PID 2568 wrote to memory of 2704 2568 5pjjp.exe 38 PID 2568 wrote to memory of 2704 2568 5pjjp.exe 38 PID 2704 wrote to memory of 2544 2704 frffllx.exe 39 PID 2704 wrote to memory of 2544 2704 frffllx.exe 39 PID 2704 wrote to memory of 2544 2704 frffllx.exe 39 PID 2704 wrote to memory of 2544 2704 frffllx.exe 39 PID 2544 wrote to memory of 2988 2544 nnhhtt.exe 40 PID 2544 wrote to memory of 2988 2544 nnhhtt.exe 40 PID 2544 wrote to memory of 2988 2544 nnhhtt.exe 40 PID 2544 wrote to memory of 2988 2544 nnhhtt.exe 40 PID 2988 wrote to memory of 768 2988 vpvvv.exe 41 PID 2988 wrote to memory of 768 2988 vpvvv.exe 41 PID 2988 wrote to memory of 768 2988 vpvvv.exe 41 PID 2988 wrote to memory of 768 2988 vpvvv.exe 41 PID 768 wrote to memory of 1840 768 bttthh.exe 42 PID 768 wrote to memory of 1840 768 bttthh.exe 42 PID 768 wrote to memory of 1840 768 bttthh.exe 42 PID 768 wrote to memory of 1840 768 bttthh.exe 42 PID 1840 wrote to memory of 2064 1840 jvjpp.exe 43 PID 1840 wrote to memory of 2064 1840 jvjpp.exe 43 PID 1840 wrote to memory of 2064 1840 jvjpp.exe 43 PID 1840 wrote to memory of 2064 1840 jvjpp.exe 43 PID 2064 wrote to memory of 492 2064 nbttbt.exe 44 PID 2064 wrote to memory of 492 2064 nbttbt.exe 44 PID 2064 wrote to memory of 492 2064 nbttbt.exe 44 PID 2064 wrote to memory of 492 2064 nbttbt.exe 44 PID 492 wrote to memory of 2780 492 dddvv.exe 45 PID 492 wrote to memory of 2780 492 dddvv.exe 45 PID 492 wrote to memory of 2780 492 dddvv.exe 45 PID 492 wrote to memory of 2780 492 dddvv.exe 45 PID 2780 wrote to memory of 1300 2780 hbtbtb.exe 46 PID 2780 wrote to memory of 1300 2780 hbtbtb.exe 46 PID 2780 wrote to memory of 1300 2780 hbtbtb.exe 46 PID 2780 wrote to memory of 1300 2780 hbtbtb.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\f54f12a8bdbe8a71dd3d90f2197f708f734b822fe849d4ac823f31671318fdaf.exe"C:\Users\Admin\AppData\Local\Temp\f54f12a8bdbe8a71dd3d90f2197f708f734b822fe849d4ac823f31671318fdaf.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:548 -
\??\c:\pjddp.exec:\pjddp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\jvjdj.exec:\jvjdj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:280 -
\??\c:\ddjjp.exec:\ddjjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\xxflxxf.exec:\xxflxxf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\1bhhhh.exec:\1bhhhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\jdvvd.exec:\jdvvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\5pjjp.exec:\5pjjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\frffllx.exec:\frffllx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\nnhhtt.exec:\nnhhtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\vpvvv.exec:\vpvvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\bttthh.exec:\bttthh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
\??\c:\jvjpp.exec:\jvjpp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
\??\c:\nbttbt.exec:\nbttbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\dddvv.exec:\dddvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:492 -
\??\c:\hbtbtb.exec:\hbtbtb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\nhtbhb.exec:\nhtbhb.exe17⤵
- Executes dropped EXE
PID:1300 -
\??\c:\nnhbnb.exec:\nnhbnb.exe18⤵
- Executes dropped EXE
PID:2876 -
\??\c:\hbntnh.exec:\hbntnh.exe19⤵
- Executes dropped EXE
PID:1404 -
\??\c:\rlrxxff.exec:\rlrxxff.exe20⤵
- Executes dropped EXE
PID:2968 -
\??\c:\9nnthn.exec:\9nnthn.exe21⤵
- Executes dropped EXE
PID:1208 -
\??\c:\pjddj.exec:\pjddj.exe22⤵
- Executes dropped EXE
PID:2104 -
\??\c:\rfrrrrx.exec:\rfrrrrx.exe23⤵
- Executes dropped EXE
PID:564 -
\??\c:\vjdjd.exec:\vjdjd.exe24⤵
- Executes dropped EXE
PID:1292 -
\??\c:\fxlxrxl.exec:\fxlxrxl.exe25⤵
- Executes dropped EXE
PID:2492 -
\??\c:\7jdpv.exec:\7jdpv.exe26⤵
- Executes dropped EXE
PID:572 -
\??\c:\rxrxrrf.exec:\rxrxrrf.exe27⤵
- Executes dropped EXE
PID:2292 -
\??\c:\1bnbhn.exec:\1bnbhn.exe28⤵
- Executes dropped EXE
PID:3028 -
\??\c:\jpjpv.exec:\jpjpv.exe29⤵
- Executes dropped EXE
PID:692 -
\??\c:\pjvdj.exec:\pjvdj.exe30⤵
- Executes dropped EXE
PID:1900 -
\??\c:\9dvpv.exec:\9dvpv.exe31⤵
- Executes dropped EXE
PID:1864 -
\??\c:\7bhnbh.exec:\7bhnbh.exe32⤵
- Executes dropped EXE
PID:1756 -
\??\c:\ddvvj.exec:\ddvvj.exe33⤵
- Executes dropped EXE
PID:1052 -
\??\c:\5bnttt.exec:\5bnttt.exe34⤵
- Executes dropped EXE
PID:2004 -
\??\c:\nhbbhb.exec:\nhbbhb.exe35⤵
- Executes dropped EXE
PID:1592 -
\??\c:\3dvdp.exec:\3dvdp.exe36⤵
- Executes dropped EXE
PID:2508 -
\??\c:\flflffx.exec:\flflffx.exe37⤵
- Executes dropped EXE
PID:2680 -
\??\c:\rfrxrrf.exec:\rfrxrrf.exe38⤵
- Executes dropped EXE
PID:3044 -
\??\c:\tthnnn.exec:\tthnnn.exe39⤵
- Executes dropped EXE
PID:2684 -
\??\c:\jdddj.exec:\jdddj.exe40⤵
- Executes dropped EXE
PID:3060 -
\??\c:\dvjpd.exec:\dvjpd.exe41⤵
- Executes dropped EXE
PID:2636 -
\??\c:\fxlllfl.exec:\fxlllfl.exe42⤵
- Executes dropped EXE
PID:2852 -
\??\c:\1thnbh.exec:\1thnbh.exe43⤵
- Executes dropped EXE
PID:2568 -
\??\c:\bnbbbb.exec:\bnbbbb.exe44⤵
- Executes dropped EXE
PID:2552 -
\??\c:\jvjdj.exec:\jvjdj.exe45⤵
- Executes dropped EXE
PID:2984 -
\??\c:\7frrffl.exec:\7frrffl.exe46⤵
- Executes dropped EXE
PID:1960 -
\??\c:\hbhhbh.exec:\hbhhbh.exe47⤵
- Executes dropped EXE
PID:888 -
\??\c:\nhntbb.exec:\nhntbb.exe48⤵
- Executes dropped EXE
PID:1752 -
\??\c:\jdpjd.exec:\jdpjd.exe49⤵
- Executes dropped EXE
PID:2844 -
\??\c:\3lfxxfr.exec:\3lfxxfr.exe50⤵
- Executes dropped EXE
PID:776 -
\??\c:\7lllfrx.exec:\7lllfrx.exe51⤵
- Executes dropped EXE
PID:1000 -
\??\c:\hhbthn.exec:\hhbthn.exe52⤵
- Executes dropped EXE
PID:1220 -
\??\c:\vjvpp.exec:\vjvpp.exe53⤵
- Executes dropped EXE
PID:2780 -
\??\c:\3fxxffl.exec:\3fxxffl.exe54⤵
- Executes dropped EXE
PID:636 -
\??\c:\frxxffr.exec:\frxxffr.exe55⤵
- Executes dropped EXE
PID:1976 -
\??\c:\1vjpp.exec:\1vjpp.exe56⤵
- Executes dropped EXE
PID:2132 -
\??\c:\jjvdd.exec:\jjvdd.exe57⤵
- Executes dropped EXE
PID:2892 -
\??\c:\xxllrrf.exec:\xxllrrf.exe58⤵
- Executes dropped EXE
PID:2968 -
\??\c:\tnhnbb.exec:\tnhnbb.exe59⤵
- Executes dropped EXE
PID:2348 -
\??\c:\nnbhtb.exec:\nnbhtb.exe60⤵
- Executes dropped EXE
PID:2192 -
\??\c:\vppjv.exec:\vppjv.exe61⤵
- Executes dropped EXE
PID:2940 -
\??\c:\1rllrxf.exec:\1rllrxf.exe62⤵
- Executes dropped EXE
PID:1032 -
\??\c:\nbnttn.exec:\nbnttn.exe63⤵
- Executes dropped EXE
PID:1308 -
\??\c:\bhhnbb.exec:\bhhnbb.exe64⤵
- Executes dropped EXE
PID:1680 -
\??\c:\dvjdj.exec:\dvjdj.exe65⤵
- Executes dropped EXE
PID:2492 -
\??\c:\rfrrxxl.exec:\rfrrxxl.exe66⤵PID:2060
-
\??\c:\rlllrrf.exec:\rlllrrf.exe67⤵PID:1284
-
\??\c:\nhbhhh.exec:\nhbhhh.exe68⤵PID:3028
-
\??\c:\5jpvd.exec:\5jpvd.exe69⤵PID:2924
-
\??\c:\pjvvv.exec:\pjvvv.exe70⤵PID:2164
-
\??\c:\xrfflrf.exec:\xrfflrf.exe71⤵PID:880
-
\??\c:\lxlfrlx.exec:\lxlfrlx.exe72⤵PID:2900
-
\??\c:\hbtbhn.exec:\hbtbhn.exe73⤵PID:2904
-
\??\c:\vvpvd.exec:\vvpvd.exe74⤵PID:1984
-
\??\c:\5fxxrxl.exec:\5fxxrxl.exe75⤵PID:2320
-
\??\c:\xxrxrlx.exec:\xxrxrlx.exe76⤵PID:2108
-
\??\c:\tnhntt.exec:\tnhntt.exe77⤵PID:2168
-
\??\c:\dvppd.exec:\dvppd.exe78⤵PID:2836
-
\??\c:\jdppd.exec:\jdppd.exe79⤵PID:2640
-
\??\c:\lfrrffr.exec:\lfrrffr.exe80⤵PID:2736
-
\??\c:\1bnhnn.exec:\1bnhnn.exe81⤵PID:2824
-
\??\c:\vjpjj.exec:\vjpjj.exe82⤵PID:2648
-
\??\c:\jdpdd.exec:\jdpdd.exe83⤵PID:2540
-
\??\c:\xlrrrxx.exec:\xlrrrxx.exe84⤵PID:2696
-
\??\c:\3btbbh.exec:\3btbbh.exe85⤵PID:2532
-
\??\c:\9ntnbn.exec:\9ntnbn.exe86⤵PID:2564
-
\??\c:\ppddj.exec:\ppddj.exe87⤵PID:2544
-
\??\c:\5fxflrx.exec:\5fxflrx.exe88⤵PID:3008
-
\??\c:\lxflllr.exec:\lxflllr.exe89⤵PID:1392
-
\??\c:\ttbntt.exec:\ttbntt.exe90⤵PID:1516
-
\??\c:\pjdjd.exec:\pjdjd.exe91⤵PID:1668
-
\??\c:\dpvdj.exec:\dpvdj.exe92⤵PID:696
-
\??\c:\7frrflr.exec:\7frrflr.exe93⤵PID:2828
-
\??\c:\9frxfff.exec:\9frxfff.exe94⤵PID:1000
-
\??\c:\nbnbnt.exec:\nbnbnt.exe95⤵PID:2020
-
\??\c:\jddjp.exec:\jddjp.exe96⤵PID:2780
-
\??\c:\jdvpv.exec:\jdvpv.exe97⤵PID:636
-
\??\c:\1rlxxxx.exec:\1rlxxxx.exe98⤵PID:1976
-
\??\c:\tnhhnn.exec:\tnhhnn.exe99⤵PID:1404
-
\??\c:\nbnnbb.exec:\nbnnbb.exe100⤵PID:2892
-
\??\c:\jdvdp.exec:\jdvdp.exe101⤵PID:2216
-
\??\c:\9xrxflr.exec:\9xrxflr.exe102⤵PID:2348
-
\??\c:\5hthth.exec:\5hthth.exe103⤵PID:2212
-
\??\c:\btnnnn.exec:\btnnnn.exe104⤵PID:2376
-
\??\c:\ppjpp.exec:\ppjpp.exe105⤵PID:1700
-
\??\c:\7flffff.exec:\7flffff.exe106⤵PID:1308
-
\??\c:\lfllrrx.exec:\lfllrrx.exe107⤵PID:1552
-
\??\c:\nbnhbb.exec:\nbnhbb.exe108⤵PID:1852
-
\??\c:\jdvdj.exec:\jdvdj.exe109⤵PID:3032
-
\??\c:\xxxxflr.exec:\xxxxflr.exe110⤵PID:1784
-
\??\c:\lxrrxxx.exec:\lxrrxxx.exe111⤵PID:1504
-
\??\c:\3nnnbh.exec:\3nnnbh.exe112⤵PID:692
-
\??\c:\bbntbb.exec:\bbntbb.exe113⤵PID:2164
-
\??\c:\ddjdj.exec:\ddjdj.exe114⤵PID:900
-
\??\c:\9xrllrf.exec:\9xrllrf.exe115⤵PID:2616
-
\??\c:\9rllxrr.exec:\9rllxrr.exe116⤵PID:2016
-
\??\c:\1nbntt.exec:\1nbntt.exe117⤵PID:1984
-
\??\c:\pdjjv.exec:\pdjjv.exe118⤵PID:2496
-
\??\c:\9jdjv.exec:\9jdjv.exe119⤵PID:2108
-
\??\c:\xlfxffr.exec:\xlfxffr.exe120⤵PID:2128
-
\??\c:\bnhnnn.exec:\bnhnnn.exe121⤵PID:2836
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-