Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 21:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
317a1e13863470f415deb8f3e9764244325844a645548da51bcbcf757cc32532N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
317a1e13863470f415deb8f3e9764244325844a645548da51bcbcf757cc32532N.exe
-
Size
456KB
-
MD5
3a1faea2e629bd25ee9f1e53d3f69dc0
-
SHA1
8f936dcbe7b843782d05703cb9b918d9704b880f
-
SHA256
317a1e13863470f415deb8f3e9764244325844a645548da51bcbcf757cc32532
-
SHA512
84f5493a6e83b23d07541b4c80a10abebd8f598e53a6b11996ede44f3d0328b9e3ac470d268baa42ca6511bb0541c10a5b121eea5bd305101d7eebf273c003b5
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRU:q7Tc2NYHUrAwfMp3CDRU
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2196-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1364-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2160-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2280-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2388-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1964-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1132-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-115-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2864-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-190-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/796-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1876-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2144-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1932-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1932-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-354-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2876-376-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2384-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2064-390-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-289-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2316-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-403-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/568-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1520-437-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2312-464-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2244-479-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1048-513-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1720-558-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-603-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2388-659-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1716-672-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-849-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1364 lxllrxf.exe 2160 hbhhtt.exe 2760 xlllxxf.exe 2280 hbntht.exe 2792 vjvdj.exe 2668 nnbhnn.exe 2620 9tthtb.exe 276 vjppp.exe 2388 ttntnt.exe 2892 jvjvj.exe 3000 3hnnbh.exe 1188 ppdvd.exe 1536 lrflxfl.exe 1964 9rrlrfr.exe 1132 vpddp.exe 2864 rrllffx.exe 2032 bthnhh.exe 2188 9dvvd.exe 2164 hhnnbb.exe 1948 jjdjv.exe 796 rlffrrx.exe 1876 hthntb.exe 1904 ddvjj.exe 268 lfxxxfx.exe 1636 hbbbnn.exe 2144 1vjjp.exe 2316 lfrxlxf.exe 552 ddvjv.exe 2432 xrxlllr.exe 2988 btnbhn.exe 1932 ppddp.exe 1608 lfrxflx.exe 2696 9lxfrxl.exe 2120 pjvdp.exe 2672 3xrxllr.exe 2856 5nntbh.exe 2832 vjvpd.exe 2184 vvdpd.exe 2612 5ffllrf.exe 2568 thtntb.exe 2384 hhhthn.exe 2876 jdpjp.exe 2916 dvdpv.exe 2064 fxxxlfr.exe 1716 thhthn.exe 2616 vvjjp.exe 2104 1xrrflr.exe 568 9bthtt.exe 3068 jjvdp.exe 468 hthhnh.exe 1520 3bttnn.exe 2624 vpddp.exe 2236 lxlrrrx.exe 2188 nbnhnh.exe 2312 vpddv.exe 876 tnbhnn.exe 2272 vppdv.exe 2244 xrfflll.exe 1876 7frlrrx.exe 1512 jdpvv.exe 2024 fllxflx.exe 1048 nnbtbb.exe 2844 jjdjd.exe 324 7xrxxll.exe -
resource yara_rule behavioral1/memory/2196-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1364-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1364-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-105-0x00000000002A0000-0x00000000002CA000-memory.dmp upx behavioral1/memory/3000-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1132-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/796-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1876-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/268-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/568-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-418-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-464-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-479-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1048-513-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-558-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/812-565-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-603-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-659-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-672-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1888-673-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-686-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-700-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/876-738-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-764-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-823-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxrlxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflfllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ddvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frflfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlxrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbntnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tbhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ththhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frflxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfxrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrxxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfllfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2196 wrote to memory of 1364 2196 317a1e13863470f415deb8f3e9764244325844a645548da51bcbcf757cc32532N.exe 31 PID 2196 wrote to memory of 1364 2196 317a1e13863470f415deb8f3e9764244325844a645548da51bcbcf757cc32532N.exe 31 PID 2196 wrote to memory of 1364 2196 317a1e13863470f415deb8f3e9764244325844a645548da51bcbcf757cc32532N.exe 31 PID 2196 wrote to memory of 1364 2196 317a1e13863470f415deb8f3e9764244325844a645548da51bcbcf757cc32532N.exe 31 PID 1364 wrote to memory of 2160 1364 lxllrxf.exe 32 PID 1364 wrote to memory of 2160 1364 lxllrxf.exe 32 PID 1364 wrote to memory of 2160 1364 lxllrxf.exe 32 PID 1364 wrote to memory of 2160 1364 lxllrxf.exe 32 PID 2160 wrote to memory of 2760 2160 hbhhtt.exe 33 PID 2160 wrote to memory of 2760 2160 hbhhtt.exe 33 PID 2160 wrote to memory of 2760 2160 hbhhtt.exe 33 PID 2160 wrote to memory of 2760 2160 hbhhtt.exe 33 PID 2760 wrote to memory of 2280 2760 xlllxxf.exe 34 PID 2760 wrote to memory of 2280 2760 xlllxxf.exe 34 PID 2760 wrote to memory of 2280 2760 xlllxxf.exe 34 PID 2760 wrote to memory of 2280 2760 xlllxxf.exe 34 PID 2280 wrote to memory of 2792 2280 hbntht.exe 35 PID 2280 wrote to memory of 2792 2280 hbntht.exe 35 PID 2280 wrote to memory of 2792 2280 hbntht.exe 35 PID 2280 wrote to memory of 2792 2280 hbntht.exe 35 PID 2792 wrote to memory of 2668 2792 vjvdj.exe 36 PID 2792 wrote to memory of 2668 2792 vjvdj.exe 36 PID 2792 wrote to memory of 2668 2792 vjvdj.exe 36 PID 2792 wrote to memory of 2668 2792 vjvdj.exe 36 PID 2668 wrote to memory of 2620 2668 nnbhnn.exe 37 PID 2668 wrote to memory of 2620 2668 nnbhnn.exe 37 PID 2668 wrote to memory of 2620 2668 nnbhnn.exe 37 PID 2668 wrote to memory of 2620 2668 nnbhnn.exe 37 PID 2620 wrote to memory of 276 2620 9tthtb.exe 38 PID 2620 wrote to memory of 276 2620 9tthtb.exe 38 PID 2620 wrote to memory of 276 2620 9tthtb.exe 38 PID 2620 wrote to memory of 276 2620 9tthtb.exe 38 PID 276 wrote to memory of 2388 276 vjppp.exe 39 PID 276 wrote to memory of 2388 276 vjppp.exe 39 PID 276 wrote to memory of 2388 276 vjppp.exe 39 PID 276 wrote to memory of 2388 276 vjppp.exe 39 PID 2388 wrote to memory of 2892 2388 ttntnt.exe 40 PID 2388 wrote to memory of 2892 2388 ttntnt.exe 40 PID 2388 wrote to memory of 2892 2388 ttntnt.exe 40 PID 2388 wrote to memory of 2892 2388 ttntnt.exe 40 PID 2892 wrote to memory of 3000 2892 jvjvj.exe 41 PID 2892 wrote to memory of 3000 2892 jvjvj.exe 41 PID 2892 wrote to memory of 3000 2892 jvjvj.exe 41 PID 2892 wrote to memory of 3000 2892 jvjvj.exe 41 PID 3000 wrote to memory of 1188 3000 3hnnbh.exe 42 PID 3000 wrote to memory of 1188 3000 3hnnbh.exe 42 PID 3000 wrote to memory of 1188 3000 3hnnbh.exe 42 PID 3000 wrote to memory of 1188 3000 3hnnbh.exe 42 PID 1188 wrote to memory of 1536 1188 ppdvd.exe 43 PID 1188 wrote to memory of 1536 1188 ppdvd.exe 43 PID 1188 wrote to memory of 1536 1188 ppdvd.exe 43 PID 1188 wrote to memory of 1536 1188 ppdvd.exe 43 PID 1536 wrote to memory of 1964 1536 lrflxfl.exe 44 PID 1536 wrote to memory of 1964 1536 lrflxfl.exe 44 PID 1536 wrote to memory of 1964 1536 lrflxfl.exe 44 PID 1536 wrote to memory of 1964 1536 lrflxfl.exe 44 PID 1964 wrote to memory of 1132 1964 9rrlrfr.exe 45 PID 1964 wrote to memory of 1132 1964 9rrlrfr.exe 45 PID 1964 wrote to memory of 1132 1964 9rrlrfr.exe 45 PID 1964 wrote to memory of 1132 1964 9rrlrfr.exe 45 PID 1132 wrote to memory of 2864 1132 vpddp.exe 46 PID 1132 wrote to memory of 2864 1132 vpddp.exe 46 PID 1132 wrote to memory of 2864 1132 vpddp.exe 46 PID 1132 wrote to memory of 2864 1132 vpddp.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\317a1e13863470f415deb8f3e9764244325844a645548da51bcbcf757cc32532N.exe"C:\Users\Admin\AppData\Local\Temp\317a1e13863470f415deb8f3e9764244325844a645548da51bcbcf757cc32532N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\lxllrxf.exec:\lxllrxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
\??\c:\hbhhtt.exec:\hbhhtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\xlllxxf.exec:\xlllxxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\hbntht.exec:\hbntht.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\vjvdj.exec:\vjvdj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\nnbhnn.exec:\nnbhnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\9tthtb.exec:\9tthtb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\vjppp.exec:\vjppp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:276 -
\??\c:\ttntnt.exec:\ttntnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\jvjvj.exec:\jvjvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\3hnnbh.exec:\3hnnbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\ppdvd.exec:\ppdvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
\??\c:\lrflxfl.exec:\lrflxfl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\9rrlrfr.exec:\9rrlrfr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\vpddp.exec:\vpddp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
\??\c:\rrllffx.exec:\rrllffx.exe17⤵
- Executes dropped EXE
PID:2864 -
\??\c:\bthnhh.exec:\bthnhh.exe18⤵
- Executes dropped EXE
PID:2032 -
\??\c:\9dvvd.exec:\9dvvd.exe19⤵
- Executes dropped EXE
PID:2188 -
\??\c:\hhnnbb.exec:\hhnnbb.exe20⤵
- Executes dropped EXE
PID:2164 -
\??\c:\jjdjv.exec:\jjdjv.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1948 -
\??\c:\rlffrrx.exec:\rlffrrx.exe22⤵
- Executes dropped EXE
PID:796 -
\??\c:\hthntb.exec:\hthntb.exe23⤵
- Executes dropped EXE
PID:1876 -
\??\c:\ddvjj.exec:\ddvjj.exe24⤵
- Executes dropped EXE
PID:1904 -
\??\c:\lfxxxfx.exec:\lfxxxfx.exe25⤵
- Executes dropped EXE
PID:268 -
\??\c:\hbbbnn.exec:\hbbbnn.exe26⤵
- Executes dropped EXE
PID:1636 -
\??\c:\1vjjp.exec:\1vjjp.exe27⤵
- Executes dropped EXE
PID:2144 -
\??\c:\lfrxlxf.exec:\lfrxlxf.exe28⤵
- Executes dropped EXE
PID:2316 -
\??\c:\ddvjv.exec:\ddvjv.exe29⤵
- Executes dropped EXE
PID:552 -
\??\c:\xrxlllr.exec:\xrxlllr.exe30⤵
- Executes dropped EXE
PID:2432 -
\??\c:\btnbhn.exec:\btnbhn.exe31⤵
- Executes dropped EXE
PID:2988 -
\??\c:\ppddp.exec:\ppddp.exe32⤵
- Executes dropped EXE
PID:1932 -
\??\c:\lfrxflx.exec:\lfrxflx.exe33⤵
- Executes dropped EXE
PID:1608 -
\??\c:\9lxfrxl.exec:\9lxfrxl.exe34⤵
- Executes dropped EXE
PID:2696 -
\??\c:\pjvdp.exec:\pjvdp.exe35⤵
- Executes dropped EXE
PID:2120 -
\??\c:\3xrxllr.exec:\3xrxllr.exe36⤵
- Executes dropped EXE
PID:2672 -
\??\c:\5nntbh.exec:\5nntbh.exe37⤵
- Executes dropped EXE
PID:2856 -
\??\c:\vjvpd.exec:\vjvpd.exe38⤵
- Executes dropped EXE
PID:2832 -
\??\c:\vvdpd.exec:\vvdpd.exe39⤵
- Executes dropped EXE
PID:2184 -
\??\c:\5ffllrf.exec:\5ffllrf.exe40⤵
- Executes dropped EXE
PID:2612 -
\??\c:\thtntb.exec:\thtntb.exe41⤵
- Executes dropped EXE
PID:2568 -
\??\c:\hhhthn.exec:\hhhthn.exe42⤵
- Executes dropped EXE
PID:2384 -
\??\c:\jdpjp.exec:\jdpjp.exe43⤵
- Executes dropped EXE
PID:2876 -
\??\c:\dvdpv.exec:\dvdpv.exe44⤵
- Executes dropped EXE
PID:2916 -
\??\c:\fxxxlfr.exec:\fxxxlfr.exe45⤵
- Executes dropped EXE
PID:2064 -
\??\c:\thhthn.exec:\thhthn.exe46⤵
- Executes dropped EXE
PID:1716 -
\??\c:\vvjjp.exec:\vvjjp.exe47⤵
- Executes dropped EXE
PID:2616 -
\??\c:\1xrrflr.exec:\1xrrflr.exe48⤵
- Executes dropped EXE
PID:2104 -
\??\c:\9bthtt.exec:\9bthtt.exe49⤵
- Executes dropped EXE
PID:568 -
\??\c:\jjvdp.exec:\jjvdp.exe50⤵
- Executes dropped EXE
PID:3068 -
\??\c:\hthhnh.exec:\hthhnh.exe51⤵
- Executes dropped EXE
PID:468 -
\??\c:\3bttnn.exec:\3bttnn.exe52⤵
- Executes dropped EXE
PID:1520 -
\??\c:\vpddp.exec:\vpddp.exe53⤵
- Executes dropped EXE
PID:2624 -
\??\c:\lxlrrrx.exec:\lxlrrrx.exe54⤵
- Executes dropped EXE
PID:2236 -
\??\c:\nbnhnh.exec:\nbnhnh.exe55⤵
- Executes dropped EXE
PID:2188 -
\??\c:\vpddv.exec:\vpddv.exe56⤵
- Executes dropped EXE
PID:2312 -
\??\c:\tnbhnn.exec:\tnbhnn.exe57⤵
- Executes dropped EXE
PID:876 -
\??\c:\vppdv.exec:\vppdv.exe58⤵
- Executes dropped EXE
PID:2272 -
\??\c:\xrfflll.exec:\xrfflll.exe59⤵
- Executes dropped EXE
PID:2244 -
\??\c:\7frlrrx.exec:\7frlrrx.exe60⤵
- Executes dropped EXE
PID:1876 -
\??\c:\jdpvv.exec:\jdpvv.exe61⤵
- Executes dropped EXE
PID:1512 -
\??\c:\fllxflx.exec:\fllxflx.exe62⤵
- Executes dropped EXE
PID:2024 -
\??\c:\nnbtbb.exec:\nnbtbb.exe63⤵
- Executes dropped EXE
PID:1048 -
\??\c:\jjdjd.exec:\jjdjd.exe64⤵
- Executes dropped EXE
PID:2844 -
\??\c:\7xrxxll.exec:\7xrxxll.exe65⤵
- Executes dropped EXE
PID:324 -
\??\c:\nbttbb.exec:\nbttbb.exe66⤵PID:1664
-
\??\c:\nhttnt.exec:\nhttnt.exe67⤵PID:2924
-
\??\c:\vpddv.exec:\vpddv.exe68⤵PID:1840
-
\??\c:\rrrrxxf.exec:\rrrrxxf.exe69⤵
- System Location Discovery: System Language Discovery
PID:2956 -
\??\c:\xlrfrlr.exec:\xlrfrlr.exe70⤵PID:1720
-
\??\c:\hnbhth.exec:\hnbhth.exe71⤵PID:2660
-
\??\c:\vpdvv.exec:\vpdvv.exe72⤵PID:812
-
\??\c:\fxllrrr.exec:\fxllrrr.exe73⤵PID:1608
-
\??\c:\lfrfrll.exec:\lfrfrll.exe74⤵PID:2760
-
\??\c:\tnntbt.exec:\tnntbt.exe75⤵PID:2784
-
\??\c:\djdvj.exec:\djdvj.exe76⤵PID:2280
-
\??\c:\frllffr.exec:\frllffr.exe77⤵PID:2692
-
\??\c:\bthnnt.exec:\bthnnt.exe78⤵PID:2856
-
\??\c:\vpjpd.exec:\vpjpd.exe79⤵PID:2592
-
\??\c:\3vdpj.exec:\3vdpj.exe80⤵PID:2184
-
\??\c:\lfrxrrx.exec:\lfrxrrx.exe81⤵PID:2668
-
\??\c:\bhbbnh.exec:\bhbbnh.exe82⤵PID:2568
-
\??\c:\dpvdd.exec:\dpvdd.exe83⤵PID:2656
-
\??\c:\pdjpd.exec:\pdjpd.exe84⤵PID:2676
-
\??\c:\xxrrlrx.exec:\xxrrlrx.exe85⤵PID:2892
-
\??\c:\3htttb.exec:\3htttb.exe86⤵PID:2388
-
\??\c:\hbnnbb.exec:\hbnnbb.exe87⤵PID:1956
-
\??\c:\vpvdj.exec:\vpvdj.exe88⤵PID:1716
-
\??\c:\lfrfrfr.exec:\lfrfrfr.exe89⤵PID:1888
-
\??\c:\lrlrrlr.exec:\lrlrrlr.exe90⤵PID:2104
-
\??\c:\nhthtb.exec:\nhthtb.exe91⤵PID:1964
-
\??\c:\dvvpv.exec:\dvvpv.exe92⤵PID:1196
-
\??\c:\dpdjp.exec:\dpdjp.exe93⤵PID:2260
-
\??\c:\lfrxxrx.exec:\lfrxxrx.exe94⤵
- System Location Discovery: System Language Discovery
PID:2392 -
\??\c:\1htbnn.exec:\1htbnn.exe95⤵PID:2624
-
\??\c:\1bttbb.exec:\1bttbb.exe96⤵PID:2236
-
\??\c:\vvdvv.exec:\vvdvv.exe97⤵PID:1600
-
\??\c:\9xrrrrx.exec:\9xrrrrx.exe98⤵PID:1828
-
\??\c:\7bnntt.exec:\7bnntt.exe99⤵PID:876
-
\??\c:\tttbnn.exec:\tttbnn.exe100⤵PID:1948
-
\??\c:\3pvvv.exec:\3pvvv.exe101⤵PID:1540
-
\??\c:\rrllrxr.exec:\rrllrxr.exe102⤵PID:1328
-
\??\c:\3thhnn.exec:\3thhnn.exe103⤵PID:1652
-
\??\c:\3nbbnn.exec:\3nbbnn.exe104⤵PID:1148
-
\??\c:\vvjdd.exec:\vvjdd.exe105⤵PID:1880
-
\??\c:\flfflrx.exec:\flfflrx.exe106⤵PID:572
-
\??\c:\hbnntt.exec:\hbnntt.exe107⤵PID:2508
-
\??\c:\tnbhtn.exec:\tnbhtn.exe108⤵PID:2996
-
\??\c:\jdvvd.exec:\jdvvd.exe109⤵PID:1256
-
\??\c:\7xfllff.exec:\7xfllff.exe110⤵PID:2168
-
\??\c:\httbhn.exec:\httbhn.exe111⤵PID:2432
-
\??\c:\nhbtbt.exec:\nhbtbt.exe112⤵PID:2768
-
\??\c:\3jppv.exec:\3jppv.exe113⤵PID:2780
-
\??\c:\fxrxrxl.exec:\fxrxrxl.exe114⤵PID:2764
-
\??\c:\nhbhnn.exec:\nhbhnn.exe115⤵PID:2828
-
\??\c:\hbtbbh.exec:\hbtbbh.exe116⤵PID:1528
-
\??\c:\3dppp.exec:\3dppp.exe117⤵PID:2752
-
\??\c:\xrlrxxl.exec:\xrlrxxl.exe118⤵PID:2932
-
\??\c:\7htttb.exec:\7htttb.exe119⤵PID:2564
-
\??\c:\5bnnnn.exec:\5bnnnn.exe120⤵PID:2632
-
\??\c:\pjdvd.exec:\pjdvd.exe121⤵PID:2744
-
\??\c:\fxffrxr.exec:\fxffrxr.exe122⤵PID:2600
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-