Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-12-2024 03:47
Behavioral task
behavioral1
Sample
dba6988841f86d18a62df5ab724e9d96b170ea0071d5f5f03b6bcf34e2171518.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
dba6988841f86d18a62df5ab724e9d96b170ea0071d5f5f03b6bcf34e2171518.exe
-
Size
406KB
-
MD5
a54435cfa0729aba573f4eb2abd3f827
-
SHA1
3d8968b4c79a64ac0e61ad27808301b65e74c5ff
-
SHA256
dba6988841f86d18a62df5ab724e9d96b170ea0071d5f5f03b6bcf34e2171518
-
SHA512
f86dae4b94c54600a1a10aea59b325ca4269f49e2319330f492fb47b20ec82b295f48b7771cb86c539436cdd7d9274d07a098dc86e156e51306057292bb3282d
-
SSDEEP
6144:0cm4FmowdHoSH5BCwdyPUVn1/PRN2kIHVtS6o:C4wFHoS3C8Vnnqo6o
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/684-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2676-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2784-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2984-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2568-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2348-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2536-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2984-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3056-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2888-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1052-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/332-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2876-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1748-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2396-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1972-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2724-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2952-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1580-281-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1580-284-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2760-300-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2068-313-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2560-326-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2568-333-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2936-368-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/444-401-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2192-447-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2168-454-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2056-473-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1708-575-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2956-642-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2504-655-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1908-749-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1852-762-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1312-770-0x00000000003D0000-0x00000000003F7000-memory.dmp family_blackmoon behavioral1/memory/1296-822-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2128-934-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2316-1002-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2320-1007-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1852-1041-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2676 hnnbtb.exe 2984 3jpvd.exe 2784 9dddp.exe 2568 nnntnt.exe 2348 ddvjp.exe 2536 7jvdp.exe 3040 3llfrxf.exe 3056 1tbbtt.exe 2920 dvjdd.exe 2380 7lxxxff.exe 2096 5hbbbh.exe 2888 9pvvp.exe 332 5hbbhh.exe 1052 dvppd.exe 2868 llrxlrf.exe 2876 pdppp.exe 292 llxflrl.exe 1660 bnbhhn.exe 1780 vjpjj.exe 2336 5fxlrxl.exe 2056 ttnthn.exe 1160 hhbbhn.exe 1748 xlfxfxf.exe 2396 5htbbb.exe 2724 7xfflll.exe 1972 nnhhnh.exe 2308 9dvpj.exe 2952 1jvvp.exe 696 lfxrfrf.exe 1396 btnthn.exe 1580 vppvv.exe 1044 ntnhnn.exe 2760 vppvj.exe 2764 rrrxxlr.exe 2640 ttnthh.exe 2068 btnntb.exe 2560 9pvvj.exe 2568 fxllrrr.exe 2348 1tthtb.exe 2536 jpjjj.exe 3048 9vjjv.exe 3052 fxrxfff.exe 2936 9tbbhn.exe 2376 hhbbbb.exe 2908 1jjpd.exe 1680 rrllfff.exe 576 hnbbnn.exe 444 hnbbbb.exe 1252 pjpjp.exe 2248 lffflrf.exe 2212 hnhnbb.exe 1404 tnhhtn.exe 2768 pjvdj.exe 1544 lfxfllx.exe 2192 tnhnth.exe 2168 vjdvv.exe 448 5rlxfxx.exe 1292 xrrxflr.exe 1932 5hhbhh.exe 2056 3dppv.exe 1160 jdvvv.exe 924 7fffffl.exe 1772 hbhhtt.exe 2500 pdpjj.exe -
resource yara_rule behavioral1/memory/684-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000d00000001226b-5.dat upx behavioral1/memory/684-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015f81-18.dat upx behavioral1/memory/2676-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000800000001612f-25.dat upx behavioral1/memory/2784-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2984-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2568-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016307-36.dat upx behavioral1/files/0x00070000000164c8-44.dat upx behavioral1/memory/2348-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000900000001662e-62.dat upx behavioral1/memory/2536-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000001658c-54.dat upx behavioral1/files/0x0008000000016855-72.dat upx behavioral1/memory/3056-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016dd1-80.dat upx behavioral1/files/0x0006000000016dd7-89.dat upx behavioral1/files/0x0006000000016ea4-97.dat upx behavioral1/memory/2888-109-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016eca-107.dat upx behavioral1/files/0x000600000001706d-115.dat upx behavioral1/memory/1052-126-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000173da-125.dat upx behavioral1/memory/332-124-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000173f1-133.dat upx behavioral1/files/0x00060000000173f4-144.dat upx behavioral1/memory/2876-143-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000173fc-152.dat upx behavioral1/memory/2876-151-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017472-159.dat upx behavioral1/memory/1660-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0033000000015db1-169.dat upx behavioral1/files/0x0006000000017487-180.dat upx behavioral1/files/0x00060000000174a2-188.dat upx behavioral1/files/0x0006000000017525-198.dat upx behavioral1/files/0x0014000000018663-205.dat upx behavioral1/files/0x000d00000001866e-215.dat upx behavioral1/memory/1748-213-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018687-223.dat upx behavioral1/memory/2396-222-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1972-234-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018792-233.dat upx behavioral1/memory/2724-232-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018c1a-241.dat upx behavioral1/files/0x0006000000018c26-249.dat upx behavioral1/files/0x0006000000018f53-258.dat upx behavioral1/memory/2952-257-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001903b-266.dat upx behavioral1/files/0x00060000000190ce-274.dat upx behavioral1/files/0x00060000000190e0-282.dat upx behavioral1/memory/1044-285-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1580-284-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2760-293-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2760-300-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2068-313-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2560-326-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2568-333-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2068-341-0x00000000003C0000-0x00000000003E7000-memory.dmp upx behavioral1/memory/2536-342-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2936-368-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2376-393-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/444-394-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxlxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxlxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffllxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nhhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tnbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxffrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 684 wrote to memory of 2676 684 dba6988841f86d18a62df5ab724e9d96b170ea0071d5f5f03b6bcf34e2171518.exe 30 PID 684 wrote to memory of 2676 684 dba6988841f86d18a62df5ab724e9d96b170ea0071d5f5f03b6bcf34e2171518.exe 30 PID 684 wrote to memory of 2676 684 dba6988841f86d18a62df5ab724e9d96b170ea0071d5f5f03b6bcf34e2171518.exe 30 PID 684 wrote to memory of 2676 684 dba6988841f86d18a62df5ab724e9d96b170ea0071d5f5f03b6bcf34e2171518.exe 30 PID 2676 wrote to memory of 2984 2676 hnnbtb.exe 31 PID 2676 wrote to memory of 2984 2676 hnnbtb.exe 31 PID 2676 wrote to memory of 2984 2676 hnnbtb.exe 31 PID 2676 wrote to memory of 2984 2676 hnnbtb.exe 31 PID 2984 wrote to memory of 2784 2984 3jpvd.exe 32 PID 2984 wrote to memory of 2784 2984 3jpvd.exe 32 PID 2984 wrote to memory of 2784 2984 3jpvd.exe 32 PID 2984 wrote to memory of 2784 2984 3jpvd.exe 32 PID 2784 wrote to memory of 2568 2784 9dddp.exe 33 PID 2784 wrote to memory of 2568 2784 9dddp.exe 33 PID 2784 wrote to memory of 2568 2784 9dddp.exe 33 PID 2784 wrote to memory of 2568 2784 9dddp.exe 33 PID 2568 wrote to memory of 2348 2568 nnntnt.exe 34 PID 2568 wrote to memory of 2348 2568 nnntnt.exe 34 PID 2568 wrote to memory of 2348 2568 nnntnt.exe 34 PID 2568 wrote to memory of 2348 2568 nnntnt.exe 34 PID 2348 wrote to memory of 2536 2348 ddvjp.exe 35 PID 2348 wrote to memory of 2536 2348 ddvjp.exe 35 PID 2348 wrote to memory of 2536 2348 ddvjp.exe 35 PID 2348 wrote to memory of 2536 2348 ddvjp.exe 35 PID 2536 wrote to memory of 3040 2536 7jvdp.exe 36 PID 2536 wrote to memory of 3040 2536 7jvdp.exe 36 PID 2536 wrote to memory of 3040 2536 7jvdp.exe 36 PID 2536 wrote to memory of 3040 2536 7jvdp.exe 36 PID 3040 wrote to memory of 3056 3040 3llfrxf.exe 37 PID 3040 wrote to memory of 3056 3040 3llfrxf.exe 37 PID 3040 wrote to memory of 3056 3040 3llfrxf.exe 37 PID 3040 wrote to memory of 3056 3040 3llfrxf.exe 37 PID 3056 wrote to memory of 2920 3056 1tbbtt.exe 38 PID 3056 wrote to memory of 2920 3056 1tbbtt.exe 38 PID 3056 wrote to memory of 2920 3056 1tbbtt.exe 38 PID 3056 wrote to memory of 2920 3056 1tbbtt.exe 38 PID 2920 wrote to memory of 2380 2920 dvjdd.exe 39 PID 2920 wrote to memory of 2380 2920 dvjdd.exe 39 PID 2920 wrote to memory of 2380 2920 dvjdd.exe 39 PID 2920 wrote to memory of 2380 2920 dvjdd.exe 39 PID 2380 wrote to memory of 2096 2380 7lxxxff.exe 40 PID 2380 wrote to memory of 2096 2380 7lxxxff.exe 40 PID 2380 wrote to memory of 2096 2380 7lxxxff.exe 40 PID 2380 wrote to memory of 2096 2380 7lxxxff.exe 40 PID 2096 wrote to memory of 2888 2096 5hbbbh.exe 41 PID 2096 wrote to memory of 2888 2096 5hbbbh.exe 41 PID 2096 wrote to memory of 2888 2096 5hbbbh.exe 41 PID 2096 wrote to memory of 2888 2096 5hbbbh.exe 41 PID 2888 wrote to memory of 332 2888 9pvvp.exe 42 PID 2888 wrote to memory of 332 2888 9pvvp.exe 42 PID 2888 wrote to memory of 332 2888 9pvvp.exe 42 PID 2888 wrote to memory of 332 2888 9pvvp.exe 42 PID 332 wrote to memory of 1052 332 5hbbhh.exe 43 PID 332 wrote to memory of 1052 332 5hbbhh.exe 43 PID 332 wrote to memory of 1052 332 5hbbhh.exe 43 PID 332 wrote to memory of 1052 332 5hbbhh.exe 43 PID 1052 wrote to memory of 2868 1052 dvppd.exe 44 PID 1052 wrote to memory of 2868 1052 dvppd.exe 44 PID 1052 wrote to memory of 2868 1052 dvppd.exe 44 PID 1052 wrote to memory of 2868 1052 dvppd.exe 44 PID 2868 wrote to memory of 2876 2868 llrxlrf.exe 45 PID 2868 wrote to memory of 2876 2868 llrxlrf.exe 45 PID 2868 wrote to memory of 2876 2868 llrxlrf.exe 45 PID 2868 wrote to memory of 2876 2868 llrxlrf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\dba6988841f86d18a62df5ab724e9d96b170ea0071d5f5f03b6bcf34e2171518.exe"C:\Users\Admin\AppData\Local\Temp\dba6988841f86d18a62df5ab724e9d96b170ea0071d5f5f03b6bcf34e2171518.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:684 -
\??\c:\hnnbtb.exec:\hnnbtb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\3jpvd.exec:\3jpvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\9dddp.exec:\9dddp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\nnntnt.exec:\nnntnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\ddvjp.exec:\ddvjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\7jvdp.exec:\7jvdp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\3llfrxf.exec:\3llfrxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\1tbbtt.exec:\1tbbtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\dvjdd.exec:\dvjdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\7lxxxff.exec:\7lxxxff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\5hbbbh.exec:\5hbbbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\9pvvp.exec:\9pvvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\5hbbhh.exec:\5hbbhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:332 -
\??\c:\dvppd.exec:\dvppd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
\??\c:\llrxlrf.exec:\llrxlrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\pdppp.exec:\pdppp.exe17⤵
- Executes dropped EXE
PID:2876 -
\??\c:\llxflrl.exec:\llxflrl.exe18⤵
- Executes dropped EXE
PID:292 -
\??\c:\bnbhhn.exec:\bnbhhn.exe19⤵
- Executes dropped EXE
PID:1660 -
\??\c:\vjpjj.exec:\vjpjj.exe20⤵
- Executes dropped EXE
PID:1780 -
\??\c:\5fxlrxl.exec:\5fxlrxl.exe21⤵
- Executes dropped EXE
PID:2336 -
\??\c:\ttnthn.exec:\ttnthn.exe22⤵
- Executes dropped EXE
PID:2056 -
\??\c:\hhbbhn.exec:\hhbbhn.exe23⤵
- Executes dropped EXE
PID:1160 -
\??\c:\xlfxfxf.exec:\xlfxfxf.exe24⤵
- Executes dropped EXE
PID:1748 -
\??\c:\5htbbb.exec:\5htbbb.exe25⤵
- Executes dropped EXE
PID:2396 -
\??\c:\7xfflll.exec:\7xfflll.exe26⤵
- Executes dropped EXE
PID:2724 -
\??\c:\nnhhnh.exec:\nnhhnh.exe27⤵
- Executes dropped EXE
PID:1972 -
\??\c:\9dvpj.exec:\9dvpj.exe28⤵
- Executes dropped EXE
PID:2308 -
\??\c:\1jvvp.exec:\1jvvp.exe29⤵
- Executes dropped EXE
PID:2952 -
\??\c:\lfxrfrf.exec:\lfxrfrf.exe30⤵
- Executes dropped EXE
PID:696 -
\??\c:\btnthn.exec:\btnthn.exe31⤵
- Executes dropped EXE
PID:1396 -
\??\c:\vppvv.exec:\vppvv.exe32⤵
- Executes dropped EXE
PID:1580 -
\??\c:\ntnhnn.exec:\ntnhnn.exe33⤵
- Executes dropped EXE
PID:1044 -
\??\c:\vppvj.exec:\vppvj.exe34⤵
- Executes dropped EXE
PID:2760 -
\??\c:\rrrxxlr.exec:\rrrxxlr.exe35⤵
- Executes dropped EXE
PID:2764 -
\??\c:\ttnthh.exec:\ttnthh.exe36⤵
- Executes dropped EXE
PID:2640 -
\??\c:\btnntb.exec:\btnntb.exe37⤵
- Executes dropped EXE
PID:2068 -
\??\c:\9pvvj.exec:\9pvvj.exe38⤵
- Executes dropped EXE
PID:2560 -
\??\c:\fxllrrr.exec:\fxllrrr.exe39⤵
- Executes dropped EXE
PID:2568 -
\??\c:\1tthtb.exec:\1tthtb.exe40⤵
- Executes dropped EXE
PID:2348 -
\??\c:\jpjjj.exec:\jpjjj.exe41⤵
- Executes dropped EXE
PID:2536 -
\??\c:\9vjjv.exec:\9vjjv.exe42⤵
- Executes dropped EXE
PID:3048 -
\??\c:\fxrxfff.exec:\fxrxfff.exe43⤵
- Executes dropped EXE
PID:3052 -
\??\c:\9tbbhn.exec:\9tbbhn.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2936 -
\??\c:\hhbbbb.exec:\hhbbbb.exe45⤵
- Executes dropped EXE
PID:2376 -
\??\c:\1jjpd.exec:\1jjpd.exe46⤵
- Executes dropped EXE
PID:2908 -
\??\c:\rrllfff.exec:\rrllfff.exe47⤵
- Executes dropped EXE
PID:1680 -
\??\c:\hnbbnn.exec:\hnbbnn.exe48⤵
- Executes dropped EXE
PID:576 -
\??\c:\hnbbbb.exec:\hnbbbb.exe49⤵
- Executes dropped EXE
PID:444 -
\??\c:\pjpjp.exec:\pjpjp.exe50⤵
- Executes dropped EXE
PID:1252 -
\??\c:\lffflrf.exec:\lffflrf.exe51⤵
- Executes dropped EXE
PID:2248 -
\??\c:\hnhnbb.exec:\hnhnbb.exe52⤵
- Executes dropped EXE
PID:2212 -
\??\c:\tnhhtn.exec:\tnhhtn.exe53⤵
- Executes dropped EXE
PID:1404 -
\??\c:\pjvdj.exec:\pjvdj.exe54⤵
- Executes dropped EXE
PID:2768 -
\??\c:\lfxfllx.exec:\lfxfllx.exe55⤵
- Executes dropped EXE
PID:1544 -
\??\c:\tnhnth.exec:\tnhnth.exe56⤵
- Executes dropped EXE
PID:2192 -
\??\c:\vjdvv.exec:\vjdvv.exe57⤵
- Executes dropped EXE
PID:2168 -
\??\c:\5rlxfxx.exec:\5rlxfxx.exe58⤵
- Executes dropped EXE
PID:448 -
\??\c:\xrrxflr.exec:\xrrxflr.exe59⤵
- Executes dropped EXE
PID:1292 -
\??\c:\5hhbhh.exec:\5hhbhh.exe60⤵
- Executes dropped EXE
PID:1932 -
\??\c:\3dppv.exec:\3dppv.exe61⤵
- Executes dropped EXE
PID:2056 -
\??\c:\jdvvv.exec:\jdvvv.exe62⤵
- Executes dropped EXE
PID:1160 -
\??\c:\7fffffl.exec:\7fffffl.exe63⤵
- Executes dropped EXE
PID:924 -
\??\c:\hbhhtt.exec:\hbhhtt.exe64⤵
- Executes dropped EXE
PID:1772 -
\??\c:\pdpjj.exec:\pdpjj.exe65⤵
- Executes dropped EXE
PID:2500 -
\??\c:\1dpjv.exec:\1dpjv.exe66⤵PID:1984
-
\??\c:\9rlrxfr.exec:\9rlrxfr.exe67⤵PID:1388
-
\??\c:\nnbnbh.exec:\nnbnbh.exe68⤵PID:2304
-
\??\c:\btbhbb.exec:\btbhbb.exe69⤵PID:3068
-
\??\c:\djjjj.exec:\djjjj.exe70⤵PID:2952
-
\??\c:\9frxxxl.exec:\9frxxxl.exe71⤵PID:1012
-
\??\c:\bbhhnh.exec:\bbhhnh.exe72⤵PID:1656
-
\??\c:\btnnnn.exec:\btnnnn.exe73⤵PID:2612
-
\??\c:\1jdpp.exec:\1jdpp.exe74⤵PID:1848
-
\??\c:\lxffxfl.exec:\lxffxfl.exe75⤵PID:684
-
\??\c:\bthnbb.exec:\bthnbb.exe76⤵PID:1708
-
\??\c:\nhtthb.exec:\nhtthb.exe77⤵PID:2684
-
\??\c:\pdvdd.exec:\pdvdd.exe78⤵PID:2748
-
\??\c:\rxlfxxx.exec:\rxlfxxx.exe79⤵PID:2100
-
\??\c:\7hhhtb.exec:\7hhhtb.exe80⤵PID:2620
-
\??\c:\dvdpv.exec:\dvdpv.exe81⤵PID:2644
-
\??\c:\ppvvj.exec:\ppvvj.exe82⤵PID:2596
-
\??\c:\vjpjj.exec:\vjpjj.exe83⤵PID:2144
-
\??\c:\dvjjp.exec:\dvjjp.exe84⤵PID:1032
-
\??\c:\1xlffff.exec:\1xlffff.exe85⤵PID:3056
-
\??\c:\3lxlllr.exec:\3lxlllr.exe86⤵PID:2956
-
\??\c:\hthbhh.exec:\hthbhh.exe87⤵PID:2936
-
\??\c:\vvjjv.exec:\vvjjv.exe88⤵PID:1988
-
\??\c:\pjvpj.exec:\pjvpj.exe89⤵PID:2504
-
\??\c:\lflrrrf.exec:\lflrrrf.exe90⤵PID:2844
-
\??\c:\hbtthn.exec:\hbtthn.exe91⤵PID:864
-
\??\c:\btnthh.exec:\btnthh.exe92⤵PID:1684
-
\??\c:\vpjdp.exec:\vpjdp.exe93⤵PID:484
-
\??\c:\rrflrrx.exec:\rrflrrx.exe94⤵PID:2904
-
\??\c:\9lxxxxl.exec:\9lxxxxl.exe95⤵PID:2868
-
\??\c:\nhbbhh.exec:\nhbbhh.exe96⤵PID:2220
-
\??\c:\5nthhn.exec:\5nthhn.exe97⤵PID:2768
-
\??\c:\dpvpv.exec:\dpvpv.exe98⤵PID:2180
-
\??\c:\7ffrlrf.exec:\7ffrlrf.exe99⤵PID:2196
-
\??\c:\lfxlllr.exec:\lfxlllr.exe100⤵PID:2156
-
\??\c:\nnbhtt.exec:\nnbhtt.exe101⤵PID:2336
-
\??\c:\thntbb.exec:\thntbb.exe102⤵PID:1908
-
\??\c:\vpdpv.exec:\vpdpv.exe103⤵PID:2976
-
\??\c:\fxlxllr.exec:\fxlxllr.exe104⤵PID:1852
-
\??\c:\ffxfrrf.exec:\ffxfrrf.exe105⤵PID:1312
-
\??\c:\9thntb.exec:\9thntb.exe106⤵PID:1764
-
\??\c:\9jjjp.exec:\9jjjp.exe107⤵PID:1728
-
\??\c:\9fxxfrr.exec:\9fxxfrr.exe108⤵PID:1724
-
\??\c:\9rffllr.exec:\9rffllr.exe109⤵PID:2460
-
\??\c:\1hbthn.exec:\1hbthn.exe110⤵PID:1296
-
\??\c:\dvdjp.exec:\dvdjp.exe111⤵PID:2268
-
\??\c:\lfrxxff.exec:\lfrxxff.exe112⤵PID:1004
-
\??\c:\5fxxflr.exec:\5fxxflr.exe113⤵PID:2392
-
\??\c:\thbhnn.exec:\thbhnn.exe114⤵PID:1796
-
\??\c:\3vjjj.exec:\3vjjj.exe115⤵PID:1580
-
\??\c:\dvpjj.exec:\dvpjj.exe116⤵PID:1956
-
\??\c:\rllfrrf.exec:\rllfrrf.exe117⤵PID:1844
-
\??\c:\hbnhnt.exec:\hbnhnt.exe118⤵PID:2636
-
\??\c:\nbbthn.exec:\nbbthn.exe119⤵PID:2756
-
\??\c:\pvvdj.exec:\pvvdj.exe120⤵PID:2664
-
\??\c:\llrrllr.exec:\llrrllr.exe121⤵PID:2416
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-