Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24-12-2024 00:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b0db86b53327b0bdb2003783bdd7ef8b7b4dcd5a112e1e44f8052b40c5625cf7.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
b0db86b53327b0bdb2003783bdd7ef8b7b4dcd5a112e1e44f8052b40c5625cf7.exe
-
Size
452KB
-
MD5
45115564f4bb5a0b7b752ba5b37bf35f
-
SHA1
c1df5882aca87af580cd84719e329d7dceb69186
-
SHA256
b0db86b53327b0bdb2003783bdd7ef8b7b4dcd5a112e1e44f8052b40c5625cf7
-
SHA512
1c09d280a778b947cb926aa725c8295cdcd1ccc2059cfb4128767f2b1a61812b598dd3be0fdb9bef3095fe35b2222d1913ff73e453b93b378a09c922c4c8b22f
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe8:q7Tc2NYHUrAwfMp3CD8
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/3036-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/860-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3056-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1748-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-73-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2148-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-124-0x0000000000280000-0x00000000002AA000-memory.dmp family_blackmoon behavioral1/memory/2392-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/680-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1736-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2208-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1572-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2180-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2428-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/324-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-411-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2164-412-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/264-461-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1640-499-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-543-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-563-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2856-632-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/556-668-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-699-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2392-719-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1536-882-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2696-913-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-932-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/3000-964-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 860 rxrfrxr.exe 3056 tbnbnb.exe 2796 dvvjv.exe 2900 5hbhtb.exe 2800 jddvj.exe 2584 llxffxf.exe 2564 9tthbn.exe 1748 vvvvv.exe 2976 jdvvj.exe 2396 9rllxfr.exe 3012 pppdv.exe 2148 hbhhnt.exe 2060 5vjvj.exe 2392 xfxfrxr.exe 1760 jdpvd.exe 1336 tttbtt.exe 1796 dvvpj.exe 680 vvvvp.exe 2924 xxrfrxr.exe 1736 jjdjv.exe 2208 xrlfxfr.exe 1572 lfxlrff.exe 2180 frlxlxl.exe 2548 ddjvp.exe 2428 rxxlrxr.exe 1348 ppdpj.exe 1712 rxxllrl.exe 324 ppjjp.exe 1720 fxffllx.exe 2360 vpjjd.exe 2104 lflxflf.exe 2532 9jvdv.exe 3036 fllxrxx.exe 2240 5pvdp.exe 1588 hhthbn.exe 2688 hntbth.exe 2760 pjdpd.exe 2832 jjppj.exe 2804 xxlrflf.exe 2816 jvdvv.exe 2672 lfxflfl.exe 2592 hnnhtb.exe 2616 jvvpp.exe 3068 vvvpv.exe 2576 1nnnhn.exe 2036 vdjdv.exe 1832 llflxfx.exe 2996 jppjd.exe 2164 xxrflfx.exe 1052 nnbnhn.exe 1244 1dvdp.exe 2112 xxxfxlf.exe 2620 7bthth.exe 1020 tbbnhn.exe 2000 vpdvp.exe 1276 lrxllxr.exe 264 7nhtnb.exe 2540 djjpv.exe 2456 jppvj.exe 2912 rrlrxxr.exe 1672 nhbhth.exe 1324 dpppv.exe 1640 lrrlxfl.exe 640 ffxfrxl.exe -
resource yara_rule behavioral1/memory/3036-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/860-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/860-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-90-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2148-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/680-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/680-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1572-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/324-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/264-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1640-499-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-543-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-551-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-593-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-592-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-632-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-647-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/556-661-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/556-668-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-699-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-719-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-842-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-913-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-914-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-927-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3djpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrfxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllrrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlfrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btntbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffrfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3036 wrote to memory of 860 3036 b0db86b53327b0bdb2003783bdd7ef8b7b4dcd5a112e1e44f8052b40c5625cf7.exe 30 PID 3036 wrote to memory of 860 3036 b0db86b53327b0bdb2003783bdd7ef8b7b4dcd5a112e1e44f8052b40c5625cf7.exe 30 PID 3036 wrote to memory of 860 3036 b0db86b53327b0bdb2003783bdd7ef8b7b4dcd5a112e1e44f8052b40c5625cf7.exe 30 PID 3036 wrote to memory of 860 3036 b0db86b53327b0bdb2003783bdd7ef8b7b4dcd5a112e1e44f8052b40c5625cf7.exe 30 PID 860 wrote to memory of 3056 860 rxrfrxr.exe 31 PID 860 wrote to memory of 3056 860 rxrfrxr.exe 31 PID 860 wrote to memory of 3056 860 rxrfrxr.exe 31 PID 860 wrote to memory of 3056 860 rxrfrxr.exe 31 PID 3056 wrote to memory of 2796 3056 tbnbnb.exe 32 PID 3056 wrote to memory of 2796 3056 tbnbnb.exe 32 PID 3056 wrote to memory of 2796 3056 tbnbnb.exe 32 PID 3056 wrote to memory of 2796 3056 tbnbnb.exe 32 PID 2796 wrote to memory of 2900 2796 dvvjv.exe 33 PID 2796 wrote to memory of 2900 2796 dvvjv.exe 33 PID 2796 wrote to memory of 2900 2796 dvvjv.exe 33 PID 2796 wrote to memory of 2900 2796 dvvjv.exe 33 PID 2900 wrote to memory of 2800 2900 5hbhtb.exe 34 PID 2900 wrote to memory of 2800 2900 5hbhtb.exe 34 PID 2900 wrote to memory of 2800 2900 5hbhtb.exe 34 PID 2900 wrote to memory of 2800 2900 5hbhtb.exe 34 PID 2800 wrote to memory of 2584 2800 jddvj.exe 35 PID 2800 wrote to memory of 2584 2800 jddvj.exe 35 PID 2800 wrote to memory of 2584 2800 jddvj.exe 35 PID 2800 wrote to memory of 2584 2800 jddvj.exe 35 PID 2584 wrote to memory of 2564 2584 llxffxf.exe 36 PID 2584 wrote to memory of 2564 2584 llxffxf.exe 36 PID 2584 wrote to memory of 2564 2584 llxffxf.exe 36 PID 2584 wrote to memory of 2564 2584 llxffxf.exe 36 PID 2564 wrote to memory of 1748 2564 9tthbn.exe 37 PID 2564 wrote to memory of 1748 2564 9tthbn.exe 37 PID 2564 wrote to memory of 1748 2564 9tthbn.exe 37 PID 2564 wrote to memory of 1748 2564 9tthbn.exe 37 PID 1748 wrote to memory of 2976 1748 vvvvv.exe 38 PID 1748 wrote to memory of 2976 1748 vvvvv.exe 38 PID 1748 wrote to memory of 2976 1748 vvvvv.exe 38 PID 1748 wrote to memory of 2976 1748 vvvvv.exe 38 PID 2976 wrote to memory of 2396 2976 jdvvj.exe 39 PID 2976 wrote to memory of 2396 2976 jdvvj.exe 39 PID 2976 wrote to memory of 2396 2976 jdvvj.exe 39 PID 2976 wrote to memory of 2396 2976 jdvvj.exe 39 PID 2396 wrote to memory of 3012 2396 9rllxfr.exe 40 PID 2396 wrote to memory of 3012 2396 9rllxfr.exe 40 PID 2396 wrote to memory of 3012 2396 9rllxfr.exe 40 PID 2396 wrote to memory of 3012 2396 9rllxfr.exe 40 PID 3012 wrote to memory of 2148 3012 pppdv.exe 41 PID 3012 wrote to memory of 2148 3012 pppdv.exe 41 PID 3012 wrote to memory of 2148 3012 pppdv.exe 41 PID 3012 wrote to memory of 2148 3012 pppdv.exe 41 PID 2148 wrote to memory of 2060 2148 hbhhnt.exe 42 PID 2148 wrote to memory of 2060 2148 hbhhnt.exe 42 PID 2148 wrote to memory of 2060 2148 hbhhnt.exe 42 PID 2148 wrote to memory of 2060 2148 hbhhnt.exe 42 PID 2060 wrote to memory of 2392 2060 5vjvj.exe 43 PID 2060 wrote to memory of 2392 2060 5vjvj.exe 43 PID 2060 wrote to memory of 2392 2060 5vjvj.exe 43 PID 2060 wrote to memory of 2392 2060 5vjvj.exe 43 PID 2392 wrote to memory of 1760 2392 xfxfrxr.exe 44 PID 2392 wrote to memory of 1760 2392 xfxfrxr.exe 44 PID 2392 wrote to memory of 1760 2392 xfxfrxr.exe 44 PID 2392 wrote to memory of 1760 2392 xfxfrxr.exe 44 PID 1760 wrote to memory of 1336 1760 jdpvd.exe 45 PID 1760 wrote to memory of 1336 1760 jdpvd.exe 45 PID 1760 wrote to memory of 1336 1760 jdpvd.exe 45 PID 1760 wrote to memory of 1336 1760 jdpvd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\b0db86b53327b0bdb2003783bdd7ef8b7b4dcd5a112e1e44f8052b40c5625cf7.exe"C:\Users\Admin\AppData\Local\Temp\b0db86b53327b0bdb2003783bdd7ef8b7b4dcd5a112e1e44f8052b40c5625cf7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\rxrfrxr.exec:\rxrfrxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
\??\c:\tbnbnb.exec:\tbnbnb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\dvvjv.exec:\dvvjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\5hbhtb.exec:\5hbhtb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\jddvj.exec:\jddvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\llxffxf.exec:\llxffxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\9tthbn.exec:\9tthbn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\vvvvv.exec:\vvvvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\jdvvj.exec:\jdvvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\9rllxfr.exec:\9rllxfr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\pppdv.exec:\pppdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\hbhhnt.exec:\hbhhnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\5vjvj.exec:\5vjvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\xfxfrxr.exec:\xfxfrxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\jdpvd.exec:\jdpvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
\??\c:\tttbtt.exec:\tttbtt.exe17⤵
- Executes dropped EXE
PID:1336 -
\??\c:\dvvpj.exec:\dvvpj.exe18⤵
- Executes dropped EXE
PID:1796 -
\??\c:\vvvvp.exec:\vvvvp.exe19⤵
- Executes dropped EXE
PID:680 -
\??\c:\xxrfrxr.exec:\xxrfrxr.exe20⤵
- Executes dropped EXE
PID:2924 -
\??\c:\jjdjv.exec:\jjdjv.exe21⤵
- Executes dropped EXE
PID:1736 -
\??\c:\xrlfxfr.exec:\xrlfxfr.exe22⤵
- Executes dropped EXE
PID:2208 -
\??\c:\lfxlrff.exec:\lfxlrff.exe23⤵
- Executes dropped EXE
PID:1572 -
\??\c:\frlxlxl.exec:\frlxlxl.exe24⤵
- Executes dropped EXE
PID:2180 -
\??\c:\ddjvp.exec:\ddjvp.exe25⤵
- Executes dropped EXE
PID:2548 -
\??\c:\rxxlrxr.exec:\rxxlrxr.exe26⤵
- Executes dropped EXE
PID:2428 -
\??\c:\ppdpj.exec:\ppdpj.exe27⤵
- Executes dropped EXE
PID:1348 -
\??\c:\rxxllrl.exec:\rxxllrl.exe28⤵
- Executes dropped EXE
PID:1712 -
\??\c:\ppjjp.exec:\ppjjp.exe29⤵
- Executes dropped EXE
PID:324 -
\??\c:\fxffllx.exec:\fxffllx.exe30⤵
- Executes dropped EXE
PID:1720 -
\??\c:\vpjjd.exec:\vpjjd.exe31⤵
- Executes dropped EXE
PID:2360 -
\??\c:\lflxflf.exec:\lflxflf.exe32⤵
- Executes dropped EXE
PID:2104 -
\??\c:\9jvdv.exec:\9jvdv.exe33⤵
- Executes dropped EXE
PID:2532 -
\??\c:\fllxrxx.exec:\fllxrxx.exe34⤵
- Executes dropped EXE
PID:3036 -
\??\c:\5pvdp.exec:\5pvdp.exe35⤵
- Executes dropped EXE
PID:2240 -
\??\c:\hhthbn.exec:\hhthbn.exe36⤵
- Executes dropped EXE
PID:1588 -
\??\c:\hntbth.exec:\hntbth.exe37⤵
- Executes dropped EXE
PID:2688 -
\??\c:\pjdpd.exec:\pjdpd.exe38⤵
- Executes dropped EXE
PID:2760 -
\??\c:\jjppj.exec:\jjppj.exe39⤵
- Executes dropped EXE
PID:2832 -
\??\c:\xxlrflf.exec:\xxlrflf.exe40⤵
- Executes dropped EXE
PID:2804 -
\??\c:\jvdvv.exec:\jvdvv.exe41⤵
- Executes dropped EXE
PID:2816 -
\??\c:\lfxflfl.exec:\lfxflfl.exe42⤵
- Executes dropped EXE
PID:2672 -
\??\c:\hnnhtb.exec:\hnnhtb.exe43⤵
- Executes dropped EXE
PID:2592 -
\??\c:\jvvpp.exec:\jvvpp.exe44⤵
- Executes dropped EXE
PID:2616 -
\??\c:\vvvpv.exec:\vvvpv.exe45⤵
- Executes dropped EXE
PID:3068 -
\??\c:\1nnnhn.exec:\1nnnhn.exe46⤵
- Executes dropped EXE
PID:2576 -
\??\c:\vdjdv.exec:\vdjdv.exe47⤵
- Executes dropped EXE
PID:2036 -
\??\c:\llflxfx.exec:\llflxfx.exe48⤵
- Executes dropped EXE
PID:1832 -
\??\c:\jppjd.exec:\jppjd.exe49⤵
- Executes dropped EXE
PID:2996 -
\??\c:\xxrflfx.exec:\xxrflfx.exe50⤵
- Executes dropped EXE
PID:2164 -
\??\c:\nnbnhn.exec:\nnbnhn.exe51⤵
- Executes dropped EXE
PID:1052 -
\??\c:\1dvdp.exec:\1dvdp.exe52⤵
- Executes dropped EXE
PID:1244 -
\??\c:\xxxfxlf.exec:\xxxfxlf.exe53⤵
- Executes dropped EXE
PID:2112 -
\??\c:\7bthth.exec:\7bthth.exe54⤵
- Executes dropped EXE
PID:2620 -
\??\c:\tbbnhn.exec:\tbbnhn.exe55⤵
- Executes dropped EXE
PID:1020 -
\??\c:\vpdvp.exec:\vpdvp.exe56⤵
- Executes dropped EXE
PID:2000 -
\??\c:\lrxllxr.exec:\lrxllxr.exe57⤵
- Executes dropped EXE
PID:1276 -
\??\c:\7nhtnb.exec:\7nhtnb.exe58⤵
- Executes dropped EXE
PID:264 -
\??\c:\djjpv.exec:\djjpv.exe59⤵
- Executes dropped EXE
PID:2540 -
\??\c:\jppvj.exec:\jppvj.exe60⤵
- Executes dropped EXE
PID:2456 -
\??\c:\rrlrxxr.exec:\rrlrxxr.exe61⤵
- Executes dropped EXE
PID:2912 -
\??\c:\nhbhth.exec:\nhbhth.exe62⤵
- Executes dropped EXE
PID:1672 -
\??\c:\dpppv.exec:\dpppv.exe63⤵
- Executes dropped EXE
PID:1324 -
\??\c:\lrrlxfl.exec:\lrrlxfl.exe64⤵
- Executes dropped EXE
PID:1640 -
\??\c:\ffxfrxl.exec:\ffxfrxl.exe65⤵
- Executes dropped EXE
PID:640 -
\??\c:\bhhnbh.exec:\bhhnbh.exe66⤵PID:1632
-
\??\c:\pvpvp.exec:\pvpvp.exe67⤵PID:1044
-
\??\c:\fxlrlrx.exec:\fxlrlrx.exe68⤵PID:1292
-
\??\c:\9bhhtt.exec:\9bhhtt.exe69⤵PID:1724
-
\??\c:\pdjvv.exec:\pdjvv.exe70⤵PID:1964
-
\??\c:\5ppdp.exec:\5ppdp.exe71⤵PID:1712
-
\??\c:\7rlrrfr.exec:\7rlrrfr.exe72⤵PID:984
-
\??\c:\bbbnhh.exec:\bbbnhh.exe73⤵PID:2160
-
\??\c:\5dvdj.exec:\5dvdj.exe74⤵PID:1488
-
\??\c:\lfxfxxl.exec:\lfxfxxl.exe75⤵PID:2936
-
\??\c:\hhnbtn.exec:\hhnbtn.exe76⤵PID:2104
-
\??\c:\9btbth.exec:\9btbth.exe77⤵PID:2532
-
\??\c:\9pppj.exec:\9pppj.exe78⤵PID:2888
-
\??\c:\fffrffx.exec:\fffrffx.exe79⤵PID:3060
-
\??\c:\xlflrxr.exec:\xlflrxr.exe80⤵PID:1620
-
\??\c:\nnnhtt.exec:\nnnhtt.exe81⤵PID:2756
-
\??\c:\jddjp.exec:\jddjp.exe82⤵PID:2760
-
\??\c:\5xfflrf.exec:\5xfflrf.exe83⤵PID:2432
-
\??\c:\xllrlfx.exec:\xllrlfx.exe84⤵PID:2856
-
\??\c:\tnhbtt.exec:\tnhbtt.exe85⤵PID:2800
-
\??\c:\3vjjd.exec:\3vjjd.exe86⤵PID:2600
-
\??\c:\3frxxlr.exec:\3frxxlr.exe87⤵PID:2624
-
\??\c:\hbbntt.exec:\hbbntt.exe88⤵PID:1748
-
\??\c:\bbbnbh.exec:\bbbnbh.exe89⤵PID:556
-
\??\c:\pppdv.exec:\pppdv.exe90⤵PID:2864
-
\??\c:\1llxllf.exec:\1llxllf.exe91⤵PID:3000
-
\??\c:\nnhbth.exec:\nnhbth.exe92⤵PID:2400
-
\??\c:\7jvdj.exec:\7jvdj.exe93⤵PID:2068
-
\??\c:\xfrrlfr.exec:\xfrrlfr.exe94⤵PID:2164
-
\??\c:\3bnhbt.exec:\3bnhbt.exe95⤵PID:2032
-
\??\c:\jjjdv.exec:\jjjdv.exe96⤵PID:2628
-
\??\c:\vvdjv.exec:\vvdjv.exe97⤵PID:2392
-
\??\c:\xxrfrxx.exec:\xxrfrxx.exe98⤵PID:1768
-
\??\c:\bhbtnt.exec:\bhbtnt.exe99⤵PID:532
-
\??\c:\jjvpv.exec:\jjvpv.exe100⤵PID:2000
-
\??\c:\1fxfllf.exec:\1fxfllf.exe101⤵PID:2884
-
\??\c:\llrrlxx.exec:\llrrlxx.exe102⤵PID:1628
-
\??\c:\5hntht.exec:\5hntht.exe103⤵PID:2544
-
\??\c:\jjjdp.exec:\jjjdp.exe104⤵PID:2456
-
\??\c:\5jdjv.exec:\5jdjv.exe105⤵PID:1096
-
\??\c:\3rxxxfx.exec:\3rxxxfx.exe106⤵PID:440
-
\??\c:\9nhnnn.exec:\9nhnnn.exe107⤵PID:1752
-
\??\c:\thhbnb.exec:\thhbnb.exe108⤵PID:1264
-
\??\c:\9xxrfrl.exec:\9xxrfrl.exe109⤵PID:2236
-
\??\c:\llrrlrl.exec:\llrrlrl.exe110⤵PID:2444
-
\??\c:\ttbnbb.exec:\ttbnbb.exe111⤵PID:2428
-
\??\c:\7ppvp.exec:\7ppvp.exe112⤵PID:1300
-
\??\c:\dvvpj.exec:\dvvpj.exe113⤵PID:744
-
\??\c:\fxrfxrx.exec:\fxrfxrx.exe114⤵
- System Location Discovery: System Language Discovery
PID:2480 -
\??\c:\hbtbth.exec:\hbtbth.exe115⤵PID:2072
-
\??\c:\djpjv.exec:\djpjv.exe116⤵PID:1560
-
\??\c:\flrrlxx.exec:\flrrlxx.exe117⤵PID:2044
-
\??\c:\lllxxfx.exec:\lllxxfx.exe118⤵PID:884
-
\??\c:\nnnnbb.exec:\nnnnbb.exe119⤵PID:2336
-
\??\c:\vvvdv.exec:\vvvdv.exe120⤵PID:2512
-
\??\c:\rrxrlxr.exec:\rrxrlxr.exe121⤵PID:2532
-
\??\c:\rlfxrfx.exec:\rlfxrfx.exe122⤵PID:1192
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-