Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-12-2024 03:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
def77ccef9d5c3bcedc6135fc12e072d3c93b07220d23816be9bb1428273f073.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
def77ccef9d5c3bcedc6135fc12e072d3c93b07220d23816be9bb1428273f073.exe
-
Size
455KB
-
MD5
77bcfa006d7016c0715c28ef224606fd
-
SHA1
715bb07b62bbc273c8433c6d516b5000354a2cd4
-
SHA256
def77ccef9d5c3bcedc6135fc12e072d3c93b07220d23816be9bb1428273f073
-
SHA512
55949b925a5ca2cfbd954a125f7e845cf4bd8edaa90cb01a525ddc82c5495d8350c456131930086bc4124e6f6f97c33fc1aa87e80f7de230c61f76a99b311223
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeR3:q7Tc2NYHUrAwfMp3CDR3
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 56 IoCs
resource yara_rule behavioral1/memory/2580-0-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2428-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3060-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1756-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2296-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3060-37-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/3060-36-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2880-55-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2880-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-73-0x0000000000340000-0x000000000036A000-memory.dmp family_blackmoon behavioral1/memory/2176-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-75-0x0000000000340000-0x000000000036A000-memory.dmp family_blackmoon behavioral1/memory/3060-74-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2624-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3056-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-95-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/788-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-131-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1180-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1068-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1068-166-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2264-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2264-202-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2212-218-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1824-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1216-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-264-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2200-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1636-299-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1720-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-313-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2548-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3060-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2444-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1336-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1980-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-452-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1032-459-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2612-466-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/772-493-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1308-494-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1308-501-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1540-508-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2068-514-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2268-595-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2040-663-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/548-678-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2096-689-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1828-696-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1664-748-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2852-868-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3064-906-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-973-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1412-1018-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1756 rlxflfr.exe 2428 hbtthb.exe 3060 3jjdd.exe 2296 rlxflrf.exe 2880 vpppd.exe 2636 btbbnn.exe 2920 5vppv.exe 2176 dpjjv.exe 2624 9bbbbh.exe 3056 9djpj.exe 788 lfxxllr.exe 1508 vpdjp.exe 2896 ppvvj.exe 1180 llfxffl.exe 2448 bbttbh.exe 604 1vddp.exe 1068 lfxlrrf.exe 1880 hbhnnt.exe 2956 7rflflx.exe 2072 btnthb.exe 2264 pjjdp.exe 2308 fxlflxl.exe 2212 9htthn.exe 1048 jjvdv.exe 1216 htbbnt.exe 1824 9pvvd.exe 1964 vpvdj.exe 2200 xrlrxlx.exe 776 nhhhnt.exe 888 tnbntb.exe 1576 htnntt.exe 1636 rlfflrf.exe 1720 btnthh.exe 2548 ppvdj.exe 3060 fxxfrrf.exe 2444 nbhhtt.exe 2988 bhthtt.exe 2904 7vpvd.exe 2944 3rflrll.exe 2920 tnttbh.exe 2632 httbnn.exe 2684 jvjjv.exe 2704 xrxxffl.exe 2172 9nhthb.exe 1336 dvdvj.exe 596 1vjpd.exe 600 xlxxllx.exe 548 nnbbnn.exe 1980 3thhhn.exe 2692 vjddj.exe 2452 frfrfff.exe 1032 5xfllfl.exe 1748 hthbnn.exe 2900 ppppd.exe 2124 jvjjp.exe 2612 xrffrxl.exe 2600 bbbbnn.exe 2264 jdpjj.exe 1232 vjpjv.exe 772 rflfllr.exe 1308 nbntbh.exe 1540 nhtbhn.exe 2068 pjvpd.exe 628 frlrxxx.exe -
resource yara_rule behavioral1/memory/2580-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1756-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/788-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1180-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1068-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1048-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1824-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1216-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/776-272-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1720-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1336-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/596-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1032-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-466-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/772-493-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1308-494-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1540-508-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-514-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1408-547-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-588-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-595-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-638-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/548-678-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1828-716-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2772-849-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-893-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-906-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-1050-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrffxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrfxfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxrfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1flrxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxxxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9djjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bnbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2580 wrote to memory of 1756 2580 def77ccef9d5c3bcedc6135fc12e072d3c93b07220d23816be9bb1428273f073.exe 30 PID 2580 wrote to memory of 1756 2580 def77ccef9d5c3bcedc6135fc12e072d3c93b07220d23816be9bb1428273f073.exe 30 PID 2580 wrote to memory of 1756 2580 def77ccef9d5c3bcedc6135fc12e072d3c93b07220d23816be9bb1428273f073.exe 30 PID 2580 wrote to memory of 1756 2580 def77ccef9d5c3bcedc6135fc12e072d3c93b07220d23816be9bb1428273f073.exe 30 PID 1756 wrote to memory of 2428 1756 rlxflfr.exe 31 PID 1756 wrote to memory of 2428 1756 rlxflfr.exe 31 PID 1756 wrote to memory of 2428 1756 rlxflfr.exe 31 PID 1756 wrote to memory of 2428 1756 rlxflfr.exe 31 PID 2428 wrote to memory of 3060 2428 hbtthb.exe 32 PID 2428 wrote to memory of 3060 2428 hbtthb.exe 32 PID 2428 wrote to memory of 3060 2428 hbtthb.exe 32 PID 2428 wrote to memory of 3060 2428 hbtthb.exe 32 PID 3060 wrote to memory of 2296 3060 3jjdd.exe 33 PID 3060 wrote to memory of 2296 3060 3jjdd.exe 33 PID 3060 wrote to memory of 2296 3060 3jjdd.exe 33 PID 3060 wrote to memory of 2296 3060 3jjdd.exe 33 PID 2296 wrote to memory of 2880 2296 rlxflrf.exe 34 PID 2296 wrote to memory of 2880 2296 rlxflrf.exe 34 PID 2296 wrote to memory of 2880 2296 rlxflrf.exe 34 PID 2296 wrote to memory of 2880 2296 rlxflrf.exe 34 PID 2880 wrote to memory of 2636 2880 vpppd.exe 35 PID 2880 wrote to memory of 2636 2880 vpppd.exe 35 PID 2880 wrote to memory of 2636 2880 vpppd.exe 35 PID 2880 wrote to memory of 2636 2880 vpppd.exe 35 PID 2636 wrote to memory of 2920 2636 btbbnn.exe 36 PID 2636 wrote to memory of 2920 2636 btbbnn.exe 36 PID 2636 wrote to memory of 2920 2636 btbbnn.exe 36 PID 2636 wrote to memory of 2920 2636 btbbnn.exe 36 PID 2920 wrote to memory of 2176 2920 5vppv.exe 37 PID 2920 wrote to memory of 2176 2920 5vppv.exe 37 PID 2920 wrote to memory of 2176 2920 5vppv.exe 37 PID 2920 wrote to memory of 2176 2920 5vppv.exe 37 PID 2176 wrote to memory of 2624 2176 dpjjv.exe 38 PID 2176 wrote to memory of 2624 2176 dpjjv.exe 38 PID 2176 wrote to memory of 2624 2176 dpjjv.exe 38 PID 2176 wrote to memory of 2624 2176 dpjjv.exe 38 PID 2624 wrote to memory of 3056 2624 9bbbbh.exe 39 PID 2624 wrote to memory of 3056 2624 9bbbbh.exe 39 PID 2624 wrote to memory of 3056 2624 9bbbbh.exe 39 PID 2624 wrote to memory of 3056 2624 9bbbbh.exe 39 PID 3056 wrote to memory of 788 3056 9djpj.exe 40 PID 3056 wrote to memory of 788 3056 9djpj.exe 40 PID 3056 wrote to memory of 788 3056 9djpj.exe 40 PID 3056 wrote to memory of 788 3056 9djpj.exe 40 PID 788 wrote to memory of 1508 788 lfxxllr.exe 41 PID 788 wrote to memory of 1508 788 lfxxllr.exe 41 PID 788 wrote to memory of 1508 788 lfxxllr.exe 41 PID 788 wrote to memory of 1508 788 lfxxllr.exe 41 PID 1508 wrote to memory of 2896 1508 vpdjp.exe 42 PID 1508 wrote to memory of 2896 1508 vpdjp.exe 42 PID 1508 wrote to memory of 2896 1508 vpdjp.exe 42 PID 1508 wrote to memory of 2896 1508 vpdjp.exe 42 PID 2896 wrote to memory of 1180 2896 ppvvj.exe 43 PID 2896 wrote to memory of 1180 2896 ppvvj.exe 43 PID 2896 wrote to memory of 1180 2896 ppvvj.exe 43 PID 2896 wrote to memory of 1180 2896 ppvvj.exe 43 PID 1180 wrote to memory of 2448 1180 llfxffl.exe 44 PID 1180 wrote to memory of 2448 1180 llfxffl.exe 44 PID 1180 wrote to memory of 2448 1180 llfxffl.exe 44 PID 1180 wrote to memory of 2448 1180 llfxffl.exe 44 PID 2448 wrote to memory of 604 2448 bbttbh.exe 45 PID 2448 wrote to memory of 604 2448 bbttbh.exe 45 PID 2448 wrote to memory of 604 2448 bbttbh.exe 45 PID 2448 wrote to memory of 604 2448 bbttbh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\def77ccef9d5c3bcedc6135fc12e072d3c93b07220d23816be9bb1428273f073.exe"C:\Users\Admin\AppData\Local\Temp\def77ccef9d5c3bcedc6135fc12e072d3c93b07220d23816be9bb1428273f073.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\rlxflfr.exec:\rlxflfr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
\??\c:\hbtthb.exec:\hbtthb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\3jjdd.exec:\3jjdd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\rlxflrf.exec:\rlxflrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\vpppd.exec:\vpppd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\btbbnn.exec:\btbbnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\5vppv.exec:\5vppv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\dpjjv.exec:\dpjjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\9bbbbh.exec:\9bbbbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\9djpj.exec:\9djpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\lfxxllr.exec:\lfxxllr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:788 -
\??\c:\vpdjp.exec:\vpdjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\ppvvj.exec:\ppvvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\llfxffl.exec:\llfxffl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
\??\c:\bbttbh.exec:\bbttbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\1vddp.exec:\1vddp.exe17⤵
- Executes dropped EXE
PID:604 -
\??\c:\lfxlrrf.exec:\lfxlrrf.exe18⤵
- Executes dropped EXE
PID:1068 -
\??\c:\hbhnnt.exec:\hbhnnt.exe19⤵
- Executes dropped EXE
PID:1880 -
\??\c:\7rflflx.exec:\7rflflx.exe20⤵
- Executes dropped EXE
PID:2956 -
\??\c:\btnthb.exec:\btnthb.exe21⤵
- Executes dropped EXE
PID:2072 -
\??\c:\pjjdp.exec:\pjjdp.exe22⤵
- Executes dropped EXE
PID:2264 -
\??\c:\fxlflxl.exec:\fxlflxl.exe23⤵
- Executes dropped EXE
PID:2308 -
\??\c:\9htthn.exec:\9htthn.exe24⤵
- Executes dropped EXE
PID:2212 -
\??\c:\jjvdv.exec:\jjvdv.exe25⤵
- Executes dropped EXE
PID:1048 -
\??\c:\htbbnt.exec:\htbbnt.exe26⤵
- Executes dropped EXE
PID:1216 -
\??\c:\9pvvd.exec:\9pvvd.exe27⤵
- Executes dropped EXE
PID:1824 -
\??\c:\vpvdj.exec:\vpvdj.exe28⤵
- Executes dropped EXE
PID:1964 -
\??\c:\xrlrxlx.exec:\xrlrxlx.exe29⤵
- Executes dropped EXE
PID:2200 -
\??\c:\nhhhnt.exec:\nhhhnt.exe30⤵
- Executes dropped EXE
PID:776 -
\??\c:\tnbntb.exec:\tnbntb.exe31⤵
- Executes dropped EXE
PID:888 -
\??\c:\htnntt.exec:\htnntt.exe32⤵
- Executes dropped EXE
PID:1576 -
\??\c:\rlfflrf.exec:\rlfflrf.exe33⤵
- Executes dropped EXE
PID:1636 -
\??\c:\btnthh.exec:\btnthh.exe34⤵
- Executes dropped EXE
PID:1720 -
\??\c:\ppvdj.exec:\ppvdj.exe35⤵
- Executes dropped EXE
PID:2548 -
\??\c:\fxxfrrf.exec:\fxxfrrf.exe36⤵
- Executes dropped EXE
PID:3060 -
\??\c:\nbhhtt.exec:\nbhhtt.exe37⤵
- Executes dropped EXE
PID:2444 -
\??\c:\bhthtt.exec:\bhthtt.exe38⤵
- Executes dropped EXE
PID:2988 -
\??\c:\7vpvd.exec:\7vpvd.exe39⤵
- Executes dropped EXE
PID:2904 -
\??\c:\3rflrll.exec:\3rflrll.exe40⤵
- Executes dropped EXE
PID:2944 -
\??\c:\tnttbh.exec:\tnttbh.exe41⤵
- Executes dropped EXE
PID:2920 -
\??\c:\httbnn.exec:\httbnn.exe42⤵
- Executes dropped EXE
PID:2632 -
\??\c:\jvjjv.exec:\jvjjv.exe43⤵
- Executes dropped EXE
PID:2684 -
\??\c:\xrxxffl.exec:\xrxxffl.exe44⤵
- Executes dropped EXE
PID:2704 -
\??\c:\9nhthb.exec:\9nhthb.exe45⤵
- Executes dropped EXE
PID:2172 -
\??\c:\dvdvj.exec:\dvdvj.exe46⤵
- Executes dropped EXE
PID:1336 -
\??\c:\1vjpd.exec:\1vjpd.exe47⤵
- Executes dropped EXE
PID:596 -
\??\c:\xlxxllx.exec:\xlxxllx.exe48⤵
- Executes dropped EXE
PID:600 -
\??\c:\nnbbnn.exec:\nnbbnn.exe49⤵
- Executes dropped EXE
PID:548 -
\??\c:\3thhhn.exec:\3thhhn.exe50⤵
- Executes dropped EXE
PID:1980 -
\??\c:\vjddj.exec:\vjddj.exe51⤵
- Executes dropped EXE
PID:2692 -
\??\c:\frfrfff.exec:\frfrfff.exe52⤵
- Executes dropped EXE
PID:2452 -
\??\c:\5xfllfl.exec:\5xfllfl.exe53⤵
- Executes dropped EXE
PID:1032 -
\??\c:\hthbnn.exec:\hthbnn.exe54⤵
- Executes dropped EXE
PID:1748 -
\??\c:\ppppd.exec:\ppppd.exe55⤵
- Executes dropped EXE
PID:2900 -
\??\c:\jvjjp.exec:\jvjjp.exe56⤵
- Executes dropped EXE
PID:2124 -
\??\c:\xrffrxl.exec:\xrffrxl.exe57⤵
- Executes dropped EXE
PID:2612 -
\??\c:\bbbbnn.exec:\bbbbnn.exe58⤵
- Executes dropped EXE
PID:2600 -
\??\c:\jdpjj.exec:\jdpjj.exe59⤵
- Executes dropped EXE
PID:2264 -
\??\c:\vjpjv.exec:\vjpjv.exe60⤵
- Executes dropped EXE
PID:1232 -
\??\c:\rflfllr.exec:\rflfllr.exe61⤵
- Executes dropped EXE
PID:772 -
\??\c:\nbntbh.exec:\nbntbh.exe62⤵
- Executes dropped EXE
PID:1308 -
\??\c:\nhtbhn.exec:\nhtbhn.exe63⤵
- Executes dropped EXE
PID:1540 -
\??\c:\pjvpd.exec:\pjvpd.exe64⤵
- Executes dropped EXE
PID:2068 -
\??\c:\frlrxxx.exec:\frlrxxx.exe65⤵
- Executes dropped EXE
PID:628 -
\??\c:\1ttntb.exec:\1ttntb.exe66⤵PID:2388
-
\??\c:\btbhtt.exec:\btbhtt.exe67⤵PID:2332
-
\??\c:\9djjp.exec:\9djjp.exe68⤵
- System Location Discovery: System Language Discovery
PID:1016 -
\??\c:\fxlrffl.exec:\fxlrffl.exe69⤵PID:284
-
\??\c:\lflfrrf.exec:\lflfrrf.exe70⤵PID:1408
-
\??\c:\bthhnh.exec:\bthhnh.exe71⤵PID:2108
-
\??\c:\5jddp.exec:\5jddp.exe72⤵PID:1576
-
\??\c:\pjvjv.exec:\pjvjv.exe73⤵PID:2112
-
\??\c:\llxxfff.exec:\llxxfff.exe74⤵PID:2540
-
\??\c:\hhtthn.exec:\hhtthn.exe75⤵PID:2136
-
\??\c:\htnnbh.exec:\htnnbh.exe76⤵PID:2776
-
\??\c:\vpvjd.exec:\vpvjd.exe77⤵PID:3060
-
\??\c:\3ffxxff.exec:\3ffxxff.exe78⤵PID:2268
-
\??\c:\llffrlf.exec:\llffrlf.exe79⤵PID:2932
-
\??\c:\3tnntt.exec:\3tnntt.exe80⤵PID:2952
-
\??\c:\pjppd.exec:\pjppd.exe81⤵PID:2804
-
\??\c:\9pjpv.exec:\9pjpv.exe82⤵PID:2856
-
\??\c:\1rxrlff.exec:\1rxrlff.exe83⤵PID:2676
-
\??\c:\htbbnt.exec:\htbbnt.exe84⤵PID:3068
-
\??\c:\nhhnnh.exec:\nhhnnh.exe85⤵PID:2312
-
\??\c:\vdvvp.exec:\vdvvp.exe86⤵PID:2292
-
\??\c:\lxxrfxx.exec:\lxxrfxx.exe87⤵PID:476
-
\??\c:\xlxrfff.exec:\xlxrfff.exe88⤵PID:2040
-
\??\c:\bnbbhn.exec:\bnbbhn.exe89⤵PID:904
-
\??\c:\ppvjj.exec:\ppvjj.exe90⤵PID:600
-
\??\c:\1flfxxx.exec:\1flfxxx.exe91⤵PID:548
-
\??\c:\nbhhnt.exec:\nbhhnt.exe92⤵PID:2096
-
\??\c:\bnbbhh.exec:\bnbbhh.exe93⤵PID:1828
-
\??\c:\9vppd.exec:\9vppd.exe94⤵PID:2452
-
\??\c:\5xfxrrx.exec:\5xfxrrx.exe95⤵PID:2668
-
\??\c:\rxxxfxx.exec:\rxxxfxx.exe96⤵PID:1748
-
\??\c:\thnhnh.exec:\thnhnh.exe97⤵PID:2808
-
\??\c:\1pdvv.exec:\1pdvv.exe98⤵PID:1752
-
\??\c:\lxxxrll.exec:\lxxxrll.exe99⤵PID:2544
-
\??\c:\flrxxrx.exec:\flrxxrx.exe100⤵PID:1380
-
\??\c:\nnbbhb.exec:\nnbbhb.exe101⤵PID:1664
-
\??\c:\jvddp.exec:\jvddp.exe102⤵PID:448
-
\??\c:\9jdvv.exec:\9jdvv.exe103⤵PID:1524
-
\??\c:\9flrxrr.exec:\9flrxrr.exe104⤵PID:2688
-
\??\c:\7nnttt.exec:\7nnttt.exe105⤵PID:2348
-
\??\c:\tttbtb.exec:\tttbtb.exe106⤵PID:1216
-
\??\c:\vpdvj.exec:\vpdvj.exe107⤵PID:2196
-
\??\c:\9lrlrll.exec:\9lrlrll.exe108⤵PID:2200
-
\??\c:\3xfxfxf.exec:\3xfxfxf.exe109⤵PID:1220
-
\??\c:\nthbhb.exec:\nthbhb.exe110⤵PID:2300
-
\??\c:\hthbnn.exec:\hthbnn.exe111⤵PID:2152
-
\??\c:\dvdpd.exec:\dvdpd.exe112⤵PID:284
-
\??\c:\5rxrxrx.exec:\5rxrxrx.exe113⤵PID:1604
-
\??\c:\9ntnnh.exec:\9ntnnh.exe114⤵PID:1700
-
\??\c:\ttnbhh.exec:\ttnbhh.exe115⤵PID:2552
-
\??\c:\pvdjv.exec:\pvdjv.exe116⤵PID:2940
-
\??\c:\7xrxrxf.exec:\7xrxrxf.exe117⤵PID:1724
-
\??\c:\3rrxflr.exec:\3rrxflr.exe118⤵PID:2772
-
\??\c:\tnhtbh.exec:\tnhtbh.exe119⤵PID:2880
-
\??\c:\7ddjp.exec:\7ddjp.exe120⤵PID:2852
-
\??\c:\jvddp.exec:\jvddp.exe121⤵PID:2924
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-