Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24-12-2024 22:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
58e2533261b6535dc69d7826c2be86af65c7f03a8327837cec194bc9862bdab7.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
58e2533261b6535dc69d7826c2be86af65c7f03a8327837cec194bc9862bdab7.exe
-
Size
454KB
-
MD5
70ec4dcdfb5655fcf8ef57952cd978a2
-
SHA1
670e2b90ba7db614d0888071d81cdb9485447c47
-
SHA256
58e2533261b6535dc69d7826c2be86af65c7f03a8327837cec194bc9862bdab7
-
SHA512
bd3068e190c201ca8a5505ea757571af4ec3038ca91165e11cea44b73720e88f7ede52c6b552cdba1f08c6f3c374b294ab10c0d72a8e86d361172373904039f8
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbec:q7Tc2NYHUrAwfMp3CDc
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/2692-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1724-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/648-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-189-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1864-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2192-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/264-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2248-339-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2120-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1616-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/604-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1112-466-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2044-465-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1788-485-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1904-492-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1052-505-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/880-531-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2148-620-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-658-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2000-746-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/956-753-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2268-767-0x00000000001C0000-0x00000000001EA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2788 rlxfflr.exe 2552 1vppd.exe 2736 rlffrxl.exe 2680 tthntt.exe 2540 jdvvp.exe 1724 hhbbtt.exe 2816 jddjp.exe 648 7fxxfxf.exe 2968 pppvv.exe 2640 lflfrlr.exe 2992 9lxfllx.exe 2748 jjvdp.exe 2864 lfrxffr.exe 2876 jdvjd.exe 2956 vpjpv.exe 1584 tnbbnt.exe 2360 dpddp.exe 2512 bbhttt.exe 1608 tthntt.exe 2112 5rllxfl.exe 2224 fxrrxxf.exe 1188 jdppp.exe 1960 lxlxffl.exe 1864 hththb.exe 756 dpjvv.exe 3060 9xlrxxr.exe 1980 7hbhnb.exe 2192 xxxfrrx.exe 1432 hbntth.exe 264 lflffff.exe 2768 fxlrxrx.exe 2788 5vppd.exe 2552 xlfxfxr.exe 2780 bbbnth.exe 2600 jdpvd.exe 2708 9rfffff.exe 2272 nbntbh.exe 2248 dvpvd.exe 2604 7fllflf.exe 1664 7htnhh.exe 648 nbntbb.exe 840 jdjpj.exe 2120 fxrrlfl.exe 1616 1tthbh.exe 604 vvpdj.exe 848 lxrxffr.exe 2856 5rlrxxf.exe 2984 3thhhh.exe 3004 7jdjd.exe 2836 lxllrlr.exe 3048 xxflfrr.exe 1972 nnbhbn.exe 3036 jdpvv.exe 2756 pdpjp.exe 2404 lfflflr.exe 2216 9nhntb.exe 2044 vvjvj.exe 1112 xxlllfr.exe 952 xfrrxrl.exe 1788 btnnhb.exe 932 dpjvd.exe 1904 xrrxrxr.exe 1052 xfrxllr.exe 1920 hbthnt.exe -
resource yara_rule behavioral1/memory/2788-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/648-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1188-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1864-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/264-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/604-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1112-466-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-465-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1788-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1904-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1572-518-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/880-531-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-541-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-548-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-620-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-635-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1408-634-0x00000000001C0000-0x00000000001EA000-memory.dmp upx behavioral1/memory/2872-648-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-658-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2936-664-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-739-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-746-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/956-753-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2268-760-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-792-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrlrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ddvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfllxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lfxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nhttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2692 wrote to memory of 2788 2692 58e2533261b6535dc69d7826c2be86af65c7f03a8327837cec194bc9862bdab7.exe 31 PID 2692 wrote to memory of 2788 2692 58e2533261b6535dc69d7826c2be86af65c7f03a8327837cec194bc9862bdab7.exe 31 PID 2692 wrote to memory of 2788 2692 58e2533261b6535dc69d7826c2be86af65c7f03a8327837cec194bc9862bdab7.exe 31 PID 2692 wrote to memory of 2788 2692 58e2533261b6535dc69d7826c2be86af65c7f03a8327837cec194bc9862bdab7.exe 31 PID 2788 wrote to memory of 2552 2788 rlxfflr.exe 32 PID 2788 wrote to memory of 2552 2788 rlxfflr.exe 32 PID 2788 wrote to memory of 2552 2788 rlxfflr.exe 32 PID 2788 wrote to memory of 2552 2788 rlxfflr.exe 32 PID 2552 wrote to memory of 2736 2552 1vppd.exe 33 PID 2552 wrote to memory of 2736 2552 1vppd.exe 33 PID 2552 wrote to memory of 2736 2552 1vppd.exe 33 PID 2552 wrote to memory of 2736 2552 1vppd.exe 33 PID 2736 wrote to memory of 2680 2736 rlffrxl.exe 34 PID 2736 wrote to memory of 2680 2736 rlffrxl.exe 34 PID 2736 wrote to memory of 2680 2736 rlffrxl.exe 34 PID 2736 wrote to memory of 2680 2736 rlffrxl.exe 34 PID 2680 wrote to memory of 2540 2680 tthntt.exe 35 PID 2680 wrote to memory of 2540 2680 tthntt.exe 35 PID 2680 wrote to memory of 2540 2680 tthntt.exe 35 PID 2680 wrote to memory of 2540 2680 tthntt.exe 35 PID 2540 wrote to memory of 1724 2540 jdvvp.exe 36 PID 2540 wrote to memory of 1724 2540 jdvvp.exe 36 PID 2540 wrote to memory of 1724 2540 jdvvp.exe 36 PID 2540 wrote to memory of 1724 2540 jdvvp.exe 36 PID 1724 wrote to memory of 2816 1724 hhbbtt.exe 37 PID 1724 wrote to memory of 2816 1724 hhbbtt.exe 37 PID 1724 wrote to memory of 2816 1724 hhbbtt.exe 37 PID 1724 wrote to memory of 2816 1724 hhbbtt.exe 37 PID 2816 wrote to memory of 648 2816 jddjp.exe 38 PID 2816 wrote to memory of 648 2816 jddjp.exe 38 PID 2816 wrote to memory of 648 2816 jddjp.exe 38 PID 2816 wrote to memory of 648 2816 jddjp.exe 38 PID 648 wrote to memory of 2968 648 7fxxfxf.exe 39 PID 648 wrote to memory of 2968 648 7fxxfxf.exe 39 PID 648 wrote to memory of 2968 648 7fxxfxf.exe 39 PID 648 wrote to memory of 2968 648 7fxxfxf.exe 39 PID 2968 wrote to memory of 2640 2968 pppvv.exe 40 PID 2968 wrote to memory of 2640 2968 pppvv.exe 40 PID 2968 wrote to memory of 2640 2968 pppvv.exe 40 PID 2968 wrote to memory of 2640 2968 pppvv.exe 40 PID 2640 wrote to memory of 2992 2640 lflfrlr.exe 41 PID 2640 wrote to memory of 2992 2640 lflfrlr.exe 41 PID 2640 wrote to memory of 2992 2640 lflfrlr.exe 41 PID 2640 wrote to memory of 2992 2640 lflfrlr.exe 41 PID 2992 wrote to memory of 2748 2992 9lxfllx.exe 42 PID 2992 wrote to memory of 2748 2992 9lxfllx.exe 42 PID 2992 wrote to memory of 2748 2992 9lxfllx.exe 42 PID 2992 wrote to memory of 2748 2992 9lxfllx.exe 42 PID 2748 wrote to memory of 2864 2748 jjvdp.exe 43 PID 2748 wrote to memory of 2864 2748 jjvdp.exe 43 PID 2748 wrote to memory of 2864 2748 jjvdp.exe 43 PID 2748 wrote to memory of 2864 2748 jjvdp.exe 43 PID 2864 wrote to memory of 2876 2864 lfrxffr.exe 44 PID 2864 wrote to memory of 2876 2864 lfrxffr.exe 44 PID 2864 wrote to memory of 2876 2864 lfrxffr.exe 44 PID 2864 wrote to memory of 2876 2864 lfrxffr.exe 44 PID 2876 wrote to memory of 2956 2876 jdvjd.exe 45 PID 2876 wrote to memory of 2956 2876 jdvjd.exe 45 PID 2876 wrote to memory of 2956 2876 jdvjd.exe 45 PID 2876 wrote to memory of 2956 2876 jdvjd.exe 45 PID 2956 wrote to memory of 1584 2956 vpjpv.exe 46 PID 2956 wrote to memory of 1584 2956 vpjpv.exe 46 PID 2956 wrote to memory of 1584 2956 vpjpv.exe 46 PID 2956 wrote to memory of 1584 2956 vpjpv.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\58e2533261b6535dc69d7826c2be86af65c7f03a8327837cec194bc9862bdab7.exe"C:\Users\Admin\AppData\Local\Temp\58e2533261b6535dc69d7826c2be86af65c7f03a8327837cec194bc9862bdab7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\rlxfflr.exec:\rlxfflr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\1vppd.exec:\1vppd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\rlffrxl.exec:\rlffrxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\tthntt.exec:\tthntt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\jdvvp.exec:\jdvvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\hhbbtt.exec:\hhbbtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\jddjp.exec:\jddjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\7fxxfxf.exec:\7fxxfxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:648 -
\??\c:\pppvv.exec:\pppvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\lflfrlr.exec:\lflfrlr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\9lxfllx.exec:\9lxfllx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\jjvdp.exec:\jjvdp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\lfrxffr.exec:\lfrxffr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\jdvjd.exec:\jdvjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\vpjpv.exec:\vpjpv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\tnbbnt.exec:\tnbbnt.exe17⤵
- Executes dropped EXE
PID:1584 -
\??\c:\dpddp.exec:\dpddp.exe18⤵
- Executes dropped EXE
PID:2360 -
\??\c:\bbhttt.exec:\bbhttt.exe19⤵
- Executes dropped EXE
PID:2512 -
\??\c:\tthntt.exec:\tthntt.exe20⤵
- Executes dropped EXE
PID:1608 -
\??\c:\5rllxfl.exec:\5rllxfl.exe21⤵
- Executes dropped EXE
PID:2112 -
\??\c:\fxrrxxf.exec:\fxrrxxf.exe22⤵
- Executes dropped EXE
PID:2224 -
\??\c:\jdppp.exec:\jdppp.exe23⤵
- Executes dropped EXE
PID:1188 -
\??\c:\lxlxffl.exec:\lxlxffl.exe24⤵
- Executes dropped EXE
PID:1960 -
\??\c:\hththb.exec:\hththb.exe25⤵
- Executes dropped EXE
PID:1864 -
\??\c:\dpjvv.exec:\dpjvv.exe26⤵
- Executes dropped EXE
PID:756 -
\??\c:\9xlrxxr.exec:\9xlrxxr.exe27⤵
- Executes dropped EXE
PID:3060 -
\??\c:\7hbhnb.exec:\7hbhnb.exe28⤵
- Executes dropped EXE
PID:1980 -
\??\c:\xxxfrrx.exec:\xxxfrrx.exe29⤵
- Executes dropped EXE
PID:2192 -
\??\c:\hbntth.exec:\hbntth.exe30⤵
- Executes dropped EXE
PID:1432 -
\??\c:\lflffff.exec:\lflffff.exe31⤵
- Executes dropped EXE
PID:264 -
\??\c:\fxlrxrx.exec:\fxlrxrx.exe32⤵
- Executes dropped EXE
PID:2768 -
\??\c:\5vppd.exec:\5vppd.exe33⤵
- Executes dropped EXE
PID:2788 -
\??\c:\xlfxfxr.exec:\xlfxfxr.exe34⤵
- Executes dropped EXE
PID:2552 -
\??\c:\bbbnth.exec:\bbbnth.exe35⤵
- Executes dropped EXE
PID:2780 -
\??\c:\jdpvd.exec:\jdpvd.exe36⤵
- Executes dropped EXE
PID:2600 -
\??\c:\9rfffff.exec:\9rfffff.exe37⤵
- Executes dropped EXE
PID:2708 -
\??\c:\nbntbh.exec:\nbntbh.exe38⤵
- Executes dropped EXE
PID:2272 -
\??\c:\dvpvd.exec:\dvpvd.exe39⤵
- Executes dropped EXE
PID:2248 -
\??\c:\7fllflf.exec:\7fllflf.exe40⤵
- Executes dropped EXE
PID:2604 -
\??\c:\7htnhh.exec:\7htnhh.exe41⤵
- Executes dropped EXE
PID:1664 -
\??\c:\nbntbb.exec:\nbntbb.exe42⤵
- Executes dropped EXE
PID:648 -
\??\c:\jdjpj.exec:\jdjpj.exe43⤵
- Executes dropped EXE
PID:840 -
\??\c:\fxrrlfl.exec:\fxrrlfl.exe44⤵
- Executes dropped EXE
PID:2120 -
\??\c:\1tthbh.exec:\1tthbh.exe45⤵
- Executes dropped EXE
PID:1616 -
\??\c:\vvpdj.exec:\vvpdj.exe46⤵
- Executes dropped EXE
PID:604 -
\??\c:\lxrxffr.exec:\lxrxffr.exe47⤵
- Executes dropped EXE
PID:848 -
\??\c:\5rlrxxf.exec:\5rlrxxf.exe48⤵
- Executes dropped EXE
PID:2856 -
\??\c:\3thhhh.exec:\3thhhh.exe49⤵
- Executes dropped EXE
PID:2984 -
\??\c:\7jdjd.exec:\7jdjd.exe50⤵
- Executes dropped EXE
PID:3004 -
\??\c:\lxllrlr.exec:\lxllrlr.exe51⤵
- Executes dropped EXE
PID:2836 -
\??\c:\xxflfrr.exec:\xxflfrr.exe52⤵
- Executes dropped EXE
PID:3048 -
\??\c:\nnbhbn.exec:\nnbhbn.exe53⤵
- Executes dropped EXE
PID:1972 -
\??\c:\jdpvv.exec:\jdpvv.exe54⤵
- Executes dropped EXE
PID:3036 -
\??\c:\pdpjp.exec:\pdpjp.exe55⤵
- Executes dropped EXE
PID:2756 -
\??\c:\lfflflr.exec:\lfflflr.exe56⤵
- Executes dropped EXE
PID:2404 -
\??\c:\9nhntb.exec:\9nhntb.exe57⤵
- Executes dropped EXE
PID:2216 -
\??\c:\vvjvj.exec:\vvjvj.exe58⤵
- Executes dropped EXE
PID:2044 -
\??\c:\xxlllfr.exec:\xxlllfr.exe59⤵
- Executes dropped EXE
PID:1112 -
\??\c:\xfrrxrl.exec:\xfrrxrl.exe60⤵
- Executes dropped EXE
PID:952 -
\??\c:\btnnhb.exec:\btnnhb.exe61⤵
- Executes dropped EXE
PID:1788 -
\??\c:\dpjvd.exec:\dpjvd.exe62⤵
- Executes dropped EXE
PID:932 -
\??\c:\xrrxrxr.exec:\xrrxrxr.exe63⤵
- Executes dropped EXE
PID:1904 -
\??\c:\xfrxllr.exec:\xfrxllr.exe64⤵
- Executes dropped EXE
PID:1052 -
\??\c:\hbthnt.exec:\hbthnt.exe65⤵
- Executes dropped EXE
PID:1920 -
\??\c:\jdjpp.exec:\jdjpp.exe66⤵PID:688
-
\??\c:\dvppd.exec:\dvppd.exe67⤵PID:1572
-
\??\c:\rllrxfl.exec:\rllrxfl.exe68⤵PID:880
-
\??\c:\tnbhhn.exec:\tnbhhn.exe69⤵PID:3020
-
\??\c:\jjvdj.exec:\jjvdj.exe70⤵PID:2828
-
\??\c:\fxxxffr.exec:\fxxxffr.exe71⤵PID:2804
-
\??\c:\rrffrfr.exec:\rrffrfr.exe72⤵PID:1528
-
\??\c:\9thhnh.exec:\9thhnh.exe73⤵PID:2788
-
\??\c:\hbnttt.exec:\hbnttt.exe74⤵PID:1740
-
\??\c:\vvpdp.exec:\vvpdp.exe75⤵PID:2736
-
\??\c:\5fxrffl.exec:\5fxrffl.exe76⤵PID:2548
-
\??\c:\fxlxflf.exec:\fxlxflf.exe77⤵PID:2544
-
\??\c:\hhbtbb.exec:\hhbtbb.exe78⤵PID:2540
-
\??\c:\dvjpp.exec:\dvjpp.exe79⤵PID:1260
-
\??\c:\vpdjv.exec:\vpdjv.exe80⤵PID:1612
-
\??\c:\rfrrxxf.exec:\rfrrxxf.exe81⤵PID:1408
-
\??\c:\tntbnn.exec:\tntbnn.exe82⤵PID:2148
-
\??\c:\jdpvv.exec:\jdpvv.exe83⤵PID:1356
-
\??\c:\pdvvj.exec:\pdvvj.exe84⤵PID:2640
-
\??\c:\xlffxfl.exec:\xlffxfl.exe85⤵PID:2724
-
\??\c:\ttntbh.exec:\ttntbh.exe86⤵PID:2940
-
\??\c:\pvjjv.exec:\pvjjv.exe87⤵PID:2872
-
\??\c:\5jdpv.exec:\5jdpv.exe88⤵PID:2912
-
\??\c:\rlxrrrf.exec:\rlxrrrf.exe89⤵PID:2936
-
\??\c:\tnhnth.exec:\tnhnth.exe90⤵PID:2720
-
\??\c:\ppjpv.exec:\ppjpv.exe91⤵PID:1840
-
\??\c:\5jvvd.exec:\5jvvd.exe92⤵PID:3048
-
\??\c:\rrrlrxl.exec:\rrrlrxl.exe93⤵PID:1972
-
\??\c:\hhhbtb.exec:\hhhbtb.exe94⤵PID:2232
-
\??\c:\nnnntb.exec:\nnnntb.exe95⤵PID:2056
-
\??\c:\3vvpv.exec:\3vvpv.exe96⤵PID:2088
-
\??\c:\xrrlffl.exec:\xrrlffl.exe97⤵PID:2400
-
\??\c:\rlxflrl.exec:\rlxflrl.exe98⤵PID:1196
-
\??\c:\nbttbh.exec:\nbttbh.exe99⤵PID:988
-
\??\c:\ddjpj.exec:\ddjpj.exe100⤵PID:1932
-
\??\c:\xrrrxfl.exec:\xrrrxfl.exe101⤵PID:2000
-
\??\c:\llrfrrf.exec:\llrfrrf.exe102⤵PID:956
-
\??\c:\tntbnn.exec:\tntbnn.exe103⤵PID:1468
-
\??\c:\vpddj.exec:\vpddj.exe104⤵PID:2268
-
\??\c:\lfllxfl.exec:\lfllxfl.exe105⤵
- System Location Discovery: System Language Discovery
PID:1716 -
\??\c:\llflxxl.exec:\llflxxl.exe106⤵PID:2244
-
\??\c:\nhbbnt.exec:\nhbbnt.exe107⤵PID:2128
-
\??\c:\5vjpd.exec:\5vjpd.exe108⤵PID:2072
-
\??\c:\7dvvd.exec:\7dvvd.exe109⤵PID:2744
-
\??\c:\3lxxfll.exec:\3lxxfll.exe110⤵PID:1532
-
\??\c:\hhhhht.exec:\hhhhht.exe111⤵PID:2804
-
\??\c:\pjdjj.exec:\pjdjj.exe112⤵PID:2580
-
\??\c:\rlxflrf.exec:\rlxflrf.exe113⤵PID:2704
-
\??\c:\rfxrxxl.exec:\rfxrxxl.exe114⤵PID:2632
-
\??\c:\nttttt.exec:\nttttt.exe115⤵PID:2780
-
\??\c:\thtbnh.exec:\thtbnh.exe116⤵PID:2588
-
\??\c:\7pdjp.exec:\7pdjp.exe117⤵PID:2740
-
\??\c:\rlfxrrf.exec:\rlfxrrf.exe118⤵PID:1724
-
\??\c:\ttnnbb.exec:\ttnnbb.exe119⤵PID:1556
-
\??\c:\ddpvj.exec:\ddpvj.exe120⤵PID:2980
-
\??\c:\rlrrffl.exec:\rlrrffl.exe121⤵PID:2252
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-