Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24-12-2024 20:35
Behavioral task
behavioral1
Sample
27cf05b1a0bf65f6442d06626eafea5f2c7f6a03c93c06d097cfc31d71d313d1.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
27cf05b1a0bf65f6442d06626eafea5f2c7f6a03c93c06d097cfc31d71d313d1.exe
-
Size
345KB
-
MD5
5fd24bf7237b11b6cc5a166b728c4172
-
SHA1
1595a6df35c02dc4a6d5f14429e3fc730c33513f
-
SHA256
27cf05b1a0bf65f6442d06626eafea5f2c7f6a03c93c06d097cfc31d71d313d1
-
SHA512
55d7c24f0904175a1c1f94cc4f10430bcac3ba96c48963975acb80a4357c02f3f62ab14804dab6e94d5c8e44897679c117d588f387eede255a71990a98a91f64
-
SSDEEP
6144:Lcm4FmowdHoSEYW5fNZWB5hFfci3Add4kGYApp:R4wFHoS3WXZshJX2VGdpp
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/3000-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3068-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3068-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2676-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2880-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2732-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2952-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2620-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2636-86-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/2636-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2624-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2300-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1036-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1036-118-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2408-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2016-135-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1844-143-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/568-152-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/568-154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1012-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1988-183-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/1988-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1712-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/844-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1912-251-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/980-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/768-260-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2436-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2100-272-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1516-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2428-317-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2864-350-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2000-381-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2500-404-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3016-410-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/568-426-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1908-432-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2916-438-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/824-444-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1988-450-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2140-503-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2908-954-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2176-2033-0x00000000773F0000-0x000000007750F000-memory.dmp family_blackmoon behavioral1/memory/2176-6282-0x00000000773F0000-0x000000007750F000-memory.dmp family_blackmoon behavioral1/memory/2176-14619-0x00000000772F0000-0x00000000773EA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3068 djddd.exe 2524 7hnbht.exe 2676 fxxxrxr.exe 2880 rrlxlrf.exe 2732 jdvvj.exe 2836 frrfxlf.exe 2828 1pdjp.exe 2952 3jdjp.exe 2620 tbbbnn.exe 2636 dvpdd.exe 2624 rllxlrf.exe 2300 djdvp.exe 2120 lfxxxfx.exe 1036 bbbthb.exe 2408 pppdv.exe 2016 fffrlrl.exe 1844 dvpjv.exe 568 5lxxxrx.exe 1012 ttnhtb.exe 2632 pppvp.exe 2892 3tnthb.exe 1988 1hhhbh.exe 2528 llflflx.exe 2144 nnbbhn.exe 1764 vvpdp.exe 1784 lrxfxfx.exe 1712 pjdjd.exe 1788 xxrrrxl.exe 844 jddvj.exe 980 xxflxll.exe 1912 hbntbh.exe 768 ttttnb.exe 2436 rrrflrf.exe 2100 hbnbhh.exe 940 jpppv.exe 3060 xflffxx.exe 1516 9nhhbh.exe 1732 1thhnn.exe 2360 dvjpv.exe 2180 fxrxllx.exe 2844 rrrrrff.exe 2428 5nhnnt.exe 2452 dvvdp.exe 2816 7vvdj.exe 2696 3lfffxf.exe 2724 ttnnbh.exe 2216 bhhtnt.exe 2864 3vjpv.exe 2764 frlfflf.exe 2604 ttntbh.exe 2812 5bbntb.exe 3036 vpdjd.exe 1668 lxxlrrf.exe 2000 5xffrlr.exe 2692 tbbttt.exe 1036 hbttnn.exe 1948 pdpvd.exe 2500 llflxxr.exe 3016 3btbth.exe 236 tnttbb.exe 1212 pdjvv.exe 568 xlxfffr.exe 1908 fxxfrrr.exe 2916 tnhntn.exe -
resource yara_rule behavioral1/memory/3000-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3000-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3068-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000d0000000122e4-9.dat upx behavioral1/files/0x0008000000016d58-17.dat upx behavioral1/memory/3068-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016db5-24.dat upx behavioral1/memory/2676-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016dd0-31.dat upx behavioral1/memory/2880-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2732-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016de4-39.dat upx behavioral1/files/0x0009000000016de8-48.dat upx behavioral1/memory/2732-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000016eb8-56.dat upx behavioral1/files/0x0006000000018697-63.dat upx behavioral1/memory/2952-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000187a2-70.dat upx behavioral1/memory/2620-79-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018c34-78.dat upx behavioral1/files/0x0006000000018c44-88.dat upx behavioral1/memory/2636-87-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018f65-95.dat upx behavioral1/memory/2624-96-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001904c-103.dat upx behavioral1/memory/2300-104-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000190e1-111.dat upx behavioral1/memory/1036-119-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000191d2-120.dat upx behavioral1/memory/2408-127-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000191f6-128.dat upx behavioral1/files/0x0005000000019217-136.dat upx behavioral1/memory/568-145-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000016d36-144.dat upx behavioral1/memory/1844-143-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019240-153.dat upx behavioral1/memory/568-154-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1012-162-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019259-161.dat upx behavioral1/files/0x0005000000019268-169.dat upx behavioral1/files/0x000500000001926c-176.dat upx behavioral1/files/0x0005000000019275-184.dat upx behavioral1/memory/1988-185-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019278-192.dat upx behavioral1/files/0x000500000001929a-199.dat upx behavioral1/memory/1764-200-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019319-207.dat upx behavioral1/files/0x0005000000019365-214.dat upx behavioral1/files/0x0005000000019377-222.dat upx behavioral1/memory/1712-221-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019387-229.dat upx behavioral1/memory/844-237-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193a4-236.dat upx behavioral1/files/0x00050000000193b3-244.dat upx behavioral1/files/0x00050000000193c1-252.dat upx behavioral1/memory/1912-251-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/980-257-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/768-260-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2436-266-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2100-272-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/940-273-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1516-289-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2864-350-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2000-381-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhtbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntthht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxllfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlllfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3000 wrote to memory of 3068 3000 27cf05b1a0bf65f6442d06626eafea5f2c7f6a03c93c06d097cfc31d71d313d1.exe 30 PID 3000 wrote to memory of 3068 3000 27cf05b1a0bf65f6442d06626eafea5f2c7f6a03c93c06d097cfc31d71d313d1.exe 30 PID 3000 wrote to memory of 3068 3000 27cf05b1a0bf65f6442d06626eafea5f2c7f6a03c93c06d097cfc31d71d313d1.exe 30 PID 3000 wrote to memory of 3068 3000 27cf05b1a0bf65f6442d06626eafea5f2c7f6a03c93c06d097cfc31d71d313d1.exe 30 PID 3068 wrote to memory of 2524 3068 djddd.exe 31 PID 3068 wrote to memory of 2524 3068 djddd.exe 31 PID 3068 wrote to memory of 2524 3068 djddd.exe 31 PID 3068 wrote to memory of 2524 3068 djddd.exe 31 PID 2524 wrote to memory of 2676 2524 7hnbht.exe 32 PID 2524 wrote to memory of 2676 2524 7hnbht.exe 32 PID 2524 wrote to memory of 2676 2524 7hnbht.exe 32 PID 2524 wrote to memory of 2676 2524 7hnbht.exe 32 PID 2676 wrote to memory of 2880 2676 fxxxrxr.exe 33 PID 2676 wrote to memory of 2880 2676 fxxxrxr.exe 33 PID 2676 wrote to memory of 2880 2676 fxxxrxr.exe 33 PID 2676 wrote to memory of 2880 2676 fxxxrxr.exe 33 PID 2880 wrote to memory of 2732 2880 rrlxlrf.exe 34 PID 2880 wrote to memory of 2732 2880 rrlxlrf.exe 34 PID 2880 wrote to memory of 2732 2880 rrlxlrf.exe 34 PID 2880 wrote to memory of 2732 2880 rrlxlrf.exe 34 PID 2732 wrote to memory of 2836 2732 jdvvj.exe 35 PID 2732 wrote to memory of 2836 2732 jdvvj.exe 35 PID 2732 wrote to memory of 2836 2732 jdvvj.exe 35 PID 2732 wrote to memory of 2836 2732 jdvvj.exe 35 PID 2836 wrote to memory of 2828 2836 frrfxlf.exe 36 PID 2836 wrote to memory of 2828 2836 frrfxlf.exe 36 PID 2836 wrote to memory of 2828 2836 frrfxlf.exe 36 PID 2836 wrote to memory of 2828 2836 frrfxlf.exe 36 PID 2828 wrote to memory of 2952 2828 1pdjp.exe 37 PID 2828 wrote to memory of 2952 2828 1pdjp.exe 37 PID 2828 wrote to memory of 2952 2828 1pdjp.exe 37 PID 2828 wrote to memory of 2952 2828 1pdjp.exe 37 PID 2952 wrote to memory of 2620 2952 3jdjp.exe 38 PID 2952 wrote to memory of 2620 2952 3jdjp.exe 38 PID 2952 wrote to memory of 2620 2952 3jdjp.exe 38 PID 2952 wrote to memory of 2620 2952 3jdjp.exe 38 PID 2620 wrote to memory of 2636 2620 tbbbnn.exe 39 PID 2620 wrote to memory of 2636 2620 tbbbnn.exe 39 PID 2620 wrote to memory of 2636 2620 tbbbnn.exe 39 PID 2620 wrote to memory of 2636 2620 tbbbnn.exe 39 PID 2636 wrote to memory of 2624 2636 dvpdd.exe 40 PID 2636 wrote to memory of 2624 2636 dvpdd.exe 40 PID 2636 wrote to memory of 2624 2636 dvpdd.exe 40 PID 2636 wrote to memory of 2624 2636 dvpdd.exe 40 PID 2624 wrote to memory of 2300 2624 rllxlrf.exe 41 PID 2624 wrote to memory of 2300 2624 rllxlrf.exe 41 PID 2624 wrote to memory of 2300 2624 rllxlrf.exe 41 PID 2624 wrote to memory of 2300 2624 rllxlrf.exe 41 PID 2300 wrote to memory of 2120 2300 djdvp.exe 42 PID 2300 wrote to memory of 2120 2300 djdvp.exe 42 PID 2300 wrote to memory of 2120 2300 djdvp.exe 42 PID 2300 wrote to memory of 2120 2300 djdvp.exe 42 PID 2120 wrote to memory of 1036 2120 lfxxxfx.exe 43 PID 2120 wrote to memory of 1036 2120 lfxxxfx.exe 43 PID 2120 wrote to memory of 1036 2120 lfxxxfx.exe 43 PID 2120 wrote to memory of 1036 2120 lfxxxfx.exe 43 PID 1036 wrote to memory of 2408 1036 bbbthb.exe 44 PID 1036 wrote to memory of 2408 1036 bbbthb.exe 44 PID 1036 wrote to memory of 2408 1036 bbbthb.exe 44 PID 1036 wrote to memory of 2408 1036 bbbthb.exe 44 PID 2408 wrote to memory of 2016 2408 pppdv.exe 45 PID 2408 wrote to memory of 2016 2408 pppdv.exe 45 PID 2408 wrote to memory of 2016 2408 pppdv.exe 45 PID 2408 wrote to memory of 2016 2408 pppdv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\27cf05b1a0bf65f6442d06626eafea5f2c7f6a03c93c06d097cfc31d71d313d1.exe"C:\Users\Admin\AppData\Local\Temp\27cf05b1a0bf65f6442d06626eafea5f2c7f6a03c93c06d097cfc31d71d313d1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\djddd.exec:\djddd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\7hnbht.exec:\7hnbht.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\fxxxrxr.exec:\fxxxrxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\rrlxlrf.exec:\rrlxlrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\jdvvj.exec:\jdvvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\frrfxlf.exec:\frrfxlf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\1pdjp.exec:\1pdjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\3jdjp.exec:\3jdjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\tbbbnn.exec:\tbbbnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\dvpdd.exec:\dvpdd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\rllxlrf.exec:\rllxlrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\djdvp.exec:\djdvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\lfxxxfx.exec:\lfxxxfx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\bbbthb.exec:\bbbthb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
\??\c:\pppdv.exec:\pppdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\fffrlrl.exec:\fffrlrl.exe17⤵
- Executes dropped EXE
PID:2016 -
\??\c:\dvpjv.exec:\dvpjv.exe18⤵
- Executes dropped EXE
PID:1844 -
\??\c:\5lxxxrx.exec:\5lxxxrx.exe19⤵
- Executes dropped EXE
PID:568 -
\??\c:\ttnhtb.exec:\ttnhtb.exe20⤵
- Executes dropped EXE
PID:1012 -
\??\c:\pppvp.exec:\pppvp.exe21⤵
- Executes dropped EXE
PID:2632 -
\??\c:\3tnthb.exec:\3tnthb.exe22⤵
- Executes dropped EXE
PID:2892 -
\??\c:\1hhhbh.exec:\1hhhbh.exe23⤵
- Executes dropped EXE
PID:1988 -
\??\c:\llflflx.exec:\llflflx.exe24⤵
- Executes dropped EXE
PID:2528 -
\??\c:\nnbbhn.exec:\nnbbhn.exe25⤵
- Executes dropped EXE
PID:2144 -
\??\c:\vvpdp.exec:\vvpdp.exe26⤵
- Executes dropped EXE
PID:1764 -
\??\c:\lrxfxfx.exec:\lrxfxfx.exe27⤵
- Executes dropped EXE
PID:1784 -
\??\c:\pjdjd.exec:\pjdjd.exe28⤵
- Executes dropped EXE
PID:1712 -
\??\c:\xxrrrxl.exec:\xxrrrxl.exe29⤵
- Executes dropped EXE
PID:1788 -
\??\c:\jddvj.exec:\jddvj.exe30⤵
- Executes dropped EXE
PID:844 -
\??\c:\xxflxll.exec:\xxflxll.exe31⤵
- Executes dropped EXE
PID:980 -
\??\c:\hbntbh.exec:\hbntbh.exe32⤵
- Executes dropped EXE
PID:1912 -
\??\c:\ttttnb.exec:\ttttnb.exe33⤵
- Executes dropped EXE
PID:768 -
\??\c:\rrrflrf.exec:\rrrflrf.exe34⤵
- Executes dropped EXE
PID:2436 -
\??\c:\hbnbhh.exec:\hbnbhh.exe35⤵
- Executes dropped EXE
PID:2100 -
\??\c:\jpppv.exec:\jpppv.exe36⤵
- Executes dropped EXE
PID:940 -
\??\c:\xflffxx.exec:\xflffxx.exe37⤵
- Executes dropped EXE
PID:3060 -
\??\c:\9nhhbh.exec:\9nhhbh.exe38⤵
- Executes dropped EXE
PID:1516 -
\??\c:\1thhnn.exec:\1thhnn.exe39⤵
- Executes dropped EXE
PID:1732 -
\??\c:\dvjpv.exec:\dvjpv.exe40⤵
- Executes dropped EXE
PID:2360 -
\??\c:\fxrxllx.exec:\fxrxllx.exe41⤵
- Executes dropped EXE
PID:2180 -
\??\c:\rrrrrff.exec:\rrrrrff.exe42⤵
- Executes dropped EXE
PID:2844 -
\??\c:\5nhnnt.exec:\5nhnnt.exe43⤵
- Executes dropped EXE
PID:2428 -
\??\c:\dvvdp.exec:\dvvdp.exe44⤵
- Executes dropped EXE
PID:2452 -
\??\c:\7vvdj.exec:\7vvdj.exe45⤵
- Executes dropped EXE
PID:2816 -
\??\c:\3lfffxf.exec:\3lfffxf.exe46⤵
- Executes dropped EXE
PID:2696 -
\??\c:\ttnnbh.exec:\ttnnbh.exe47⤵
- Executes dropped EXE
PID:2724 -
\??\c:\bhhtnt.exec:\bhhtnt.exe48⤵
- Executes dropped EXE
PID:2216 -
\??\c:\3vjpv.exec:\3vjpv.exe49⤵
- Executes dropped EXE
PID:2864 -
\??\c:\frlfflf.exec:\frlfflf.exe50⤵
- Executes dropped EXE
PID:2764 -
\??\c:\ttntbh.exec:\ttntbh.exe51⤵
- Executes dropped EXE
PID:2604 -
\??\c:\5bbntb.exec:\5bbntb.exe52⤵
- Executes dropped EXE
PID:2812 -
\??\c:\vpdjd.exec:\vpdjd.exe53⤵
- Executes dropped EXE
PID:3036 -
\??\c:\lxxlrrf.exec:\lxxlrrf.exe54⤵
- Executes dropped EXE
PID:1668 -
\??\c:\5xffrlr.exec:\5xffrlr.exe55⤵
- Executes dropped EXE
PID:2000 -
\??\c:\tbbttt.exec:\tbbttt.exe56⤵
- Executes dropped EXE
PID:2692 -
\??\c:\hbttnn.exec:\hbttnn.exe57⤵
- Executes dropped EXE
PID:1036 -
\??\c:\pdpvd.exec:\pdpvd.exe58⤵
- Executes dropped EXE
PID:1948 -
\??\c:\llflxxr.exec:\llflxxr.exe59⤵
- Executes dropped EXE
PID:2500 -
\??\c:\3btbth.exec:\3btbth.exe60⤵
- Executes dropped EXE
PID:3016 -
\??\c:\tnttbb.exec:\tnttbb.exe61⤵
- Executes dropped EXE
PID:236 -
\??\c:\pdjvv.exec:\pdjvv.exe62⤵
- Executes dropped EXE
PID:1212 -
\??\c:\xlxfffr.exec:\xlxfffr.exe63⤵
- Executes dropped EXE
PID:568 -
\??\c:\fxxfrrr.exec:\fxxfrrr.exe64⤵
- Executes dropped EXE
PID:1908 -
\??\c:\tnhntn.exec:\tnhntn.exe65⤵
- Executes dropped EXE
PID:2916 -
\??\c:\vjdvp.exec:\vjdvp.exe66⤵PID:824
-
\??\c:\5rrllff.exec:\5rrllff.exe67⤵PID:2200
-
\??\c:\hhbbnt.exec:\hhbbnt.exe68⤵PID:1988
-
\??\c:\tthbtn.exec:\tthbtn.exe69⤵PID:2276
-
\??\c:\vvjpd.exec:\vvjpd.exe70⤵PID:3028
-
\??\c:\jjjdp.exec:\jjjdp.exe71⤵PID:1164
-
\??\c:\flfxrlf.exec:\flfxrlf.exe72⤵PID:340
-
\??\c:\hhbnnt.exec:\hhbnnt.exe73⤵PID:1916
-
\??\c:\nnntnb.exec:\nnntnb.exe74⤵PID:2020
-
\??\c:\3vpdp.exec:\3vpdp.exe75⤵PID:896
-
\??\c:\xxxxrll.exec:\xxxxrll.exe76⤵PID:1788
-
\??\c:\rxxrlfx.exec:\rxxrlfx.exe77⤵PID:2140
-
\??\c:\hnhtbh.exec:\hnhtbh.exe78⤵PID:2544
-
\??\c:\nnbtnb.exec:\nnbtnb.exe79⤵PID:2512
-
\??\c:\jjjpd.exec:\jjjpd.exe80⤵PID:2988
-
\??\c:\9rrlxlf.exec:\9rrlxlf.exe81⤵PID:1544
-
\??\c:\xrxfrfr.exec:\xrxfrfr.exe82⤵PID:2992
-
\??\c:\5bbbht.exec:\5bbbht.exe83⤵PID:1568
-
\??\c:\3dppj.exec:\3dppj.exe84⤵PID:1968
-
\??\c:\vvvpv.exec:\vvvpv.exe85⤵PID:832
-
\??\c:\5lflxfl.exec:\5lflxfl.exe86⤵PID:3064
-
\??\c:\bthhnn.exec:\bthhnn.exe87⤵PID:1976
-
\??\c:\9hbttb.exec:\9hbttb.exe88⤵PID:1732
-
\??\c:\1ppvd.exec:\1ppvd.exe89⤵PID:2464
-
\??\c:\ffxrxxl.exec:\ffxrxxl.exe90⤵PID:2296
-
\??\c:\fxxrrfr.exec:\fxxrrfr.exe91⤵PID:2672
-
\??\c:\tthtbh.exec:\tthtbh.exe92⤵PID:2428
-
\??\c:\tbthtb.exec:\tbthtb.exe93⤵PID:2880
-
\??\c:\vpjjp.exec:\vpjjp.exe94⤵PID:2744
-
\??\c:\xxlrflr.exec:\xxlrflr.exe95⤵PID:2836
-
\??\c:\3xrrxrf.exec:\3xrrxrf.exe96⤵PID:2860
-
\??\c:\9nhhnn.exec:\9nhhnn.exe97⤵PID:2920
-
\??\c:\7jvvd.exec:\7jvvd.exe98⤵PID:1652
-
\??\c:\5vjpp.exec:\5vjpp.exe99⤵PID:2704
-
\??\c:\rlxrflx.exec:\rlxrflx.exe100⤵PID:2612
-
\??\c:\bbtbnb.exec:\bbtbnb.exe101⤵PID:3040
-
\??\c:\bhtttn.exec:\bhtttn.exe102⤵PID:2640
-
\??\c:\7vvjv.exec:\7vvjv.exe103⤵PID:1720
-
\??\c:\9dvjv.exec:\9dvjv.exe104⤵PID:2120
-
\??\c:\9rffxlr.exec:\9rffxlr.exe105⤵PID:2000
-
\??\c:\tnbbbh.exec:\tnbbbh.exe106⤵PID:1992
-
\??\c:\hhtbhn.exec:\hhtbhn.exe107⤵PID:1036
-
\??\c:\3vvvv.exec:\3vvvv.exe108⤵PID:584
-
\??\c:\9lfrfrf.exec:\9lfrfrf.exe109⤵PID:1552
-
\??\c:\rrlrxlx.exec:\rrlrxlx.exe110⤵PID:620
-
\??\c:\bbbtht.exec:\bbbtht.exe111⤵PID:1428
-
\??\c:\djdjd.exec:\djdjd.exe112⤵PID:1584
-
\??\c:\9ddpj.exec:\9ddpj.exe113⤵PID:568
-
\??\c:\lfxlllx.exec:\lfxlllx.exe114⤵PID:2908
-
\??\c:\rrrfxxr.exec:\rrrfxxr.exe115⤵PID:2876
-
\??\c:\3bnttt.exec:\3bnttt.exe116⤵PID:2284
-
\??\c:\nbnthn.exec:\nbnthn.exe117⤵PID:2516
-
\??\c:\ppdvj.exec:\ppdvj.exe118⤵PID:2688
-
\??\c:\rlxfflx.exec:\rlxfflx.exe119⤵PID:1736
-
\??\c:\lxrxflr.exec:\lxrxflr.exe120⤵PID:2196
-
\??\c:\nthntn.exec:\nthntn.exe121⤵PID:2484
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-