Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 21:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8d34f298beebc72b97198e4bde422aced4328d8d53442266dc5019ffce8948ea.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
8d34f298beebc72b97198e4bde422aced4328d8d53442266dc5019ffce8948ea.exe
-
Size
456KB
-
MD5
a6e086eeea2c5c8625757c4ec7f5b755
-
SHA1
8de4d498e1bd91331ce320c31821191dae114b8f
-
SHA256
8d34f298beebc72b97198e4bde422aced4328d8d53442266dc5019ffce8948ea
-
SHA512
625313061f18eac70ccd0b4cef9e98e92a21740c3b3919f83e6df7215cb1c380a18ee40a70cff5a985ae0a35b8fb7560b38ad163411aacf1d11daa0c8d4a4aa0
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeR2:q7Tc2NYHUrAwfMp3CDR2
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 50 IoCs
resource yara_rule behavioral1/memory/2056-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2528-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2232-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1972-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1156-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1096-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/788-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2492-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2472-253-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2472-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/992-271-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2172-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2244-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-373-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2028-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1844-412-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1844-413-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1708-433-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2460-477-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/600-484-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1392-528-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1592-574-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-592-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2632-666-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2464-731-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/668-754-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2232-852-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-884-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2392-944-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2404-961-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1420-968-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2656-993-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2460-1032-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1820-1035-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2336-1096-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-1140-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2540-1158-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2868-1160-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2592-1238-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2056 vpdpv.exe 2232 xrrllrr.exe 2528 thnntt.exe 2708 ppvvj.exe 2764 fxlfxxf.exe 2556 pdvpv.exe 2936 tnttbb.exe 2788 3vjdv.exe 2668 1hbtbb.exe 2660 jpjpv.exe 1804 rfrlrrf.exe 352 hhhnnb.exe 1712 vpvpv.exe 1972 xlffrrf.exe 1156 dvjpd.exe 1700 fxfxllr.exe 1296 hbnntt.exe 1096 fxllfff.exe 2492 vpdjj.exe 788 7bhtbb.exe 2684 7jdpj.exe 940 3flrlrf.exe 2016 3tnntt.exe 2020 pjvjd.exe 2588 nhhnbb.exe 976 1pjvd.exe 2472 3rflxfr.exe 2964 5hhtth.exe 992 lfrrllr.exe 1208 7xxfrlx.exe 2172 bbtbhh.exe 2236 1dvdv.exe 2356 nnhthn.exe 2244 llrxfll.exe 2552 tnhbtt.exe 2068 pjdjv.exe 2820 ddvpd.exe 2708 ffflxfr.exe 2896 nhhthn.exe 2756 nhtbbh.exe 2704 ddvjd.exe 2884 9rffrxf.exe 2616 bthhnn.exe 2688 nnhhhn.exe 584 pjdvp.exe 3056 llfxxfr.exe 868 bhbnhn.exe 2028 btnntt.exe 1844 vdvjv.exe 1684 1lxlxfl.exe 2000 bntbbh.exe 1708 htthnn.exe 1948 ppjvj.exe 1744 xxlrxlr.exe 2716 7nntbn.exe 3052 nnhnnt.exe 2924 djdpv.exe 1620 5rfrlfl.exe 2460 xlllrll.exe 600 1bttbb.exe 1548 jpjjp.exe 2980 rrlrxxf.exe 1776 xrlrffr.exe 2400 btttbh.exe -
resource yara_rule behavioral1/memory/2056-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1972-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1156-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1096-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/788-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-221-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2588-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1844-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-477-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-529-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1392-528-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-548-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-574-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-666-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1316-700-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/668-754-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-852-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-884-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2884-909-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1108-929-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-961-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1440-1002-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-1032-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/1776-1046-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-1096-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-1206-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tnbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bhtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxllxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxlrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxxlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2236 wrote to memory of 2056 2236 8d34f298beebc72b97198e4bde422aced4328d8d53442266dc5019ffce8948ea.exe 30 PID 2236 wrote to memory of 2056 2236 8d34f298beebc72b97198e4bde422aced4328d8d53442266dc5019ffce8948ea.exe 30 PID 2236 wrote to memory of 2056 2236 8d34f298beebc72b97198e4bde422aced4328d8d53442266dc5019ffce8948ea.exe 30 PID 2236 wrote to memory of 2056 2236 8d34f298beebc72b97198e4bde422aced4328d8d53442266dc5019ffce8948ea.exe 30 PID 2056 wrote to memory of 2232 2056 vpdpv.exe 31 PID 2056 wrote to memory of 2232 2056 vpdpv.exe 31 PID 2056 wrote to memory of 2232 2056 vpdpv.exe 31 PID 2056 wrote to memory of 2232 2056 vpdpv.exe 31 PID 2232 wrote to memory of 2528 2232 xrrllrr.exe 32 PID 2232 wrote to memory of 2528 2232 xrrllrr.exe 32 PID 2232 wrote to memory of 2528 2232 xrrllrr.exe 32 PID 2232 wrote to memory of 2528 2232 xrrllrr.exe 32 PID 2528 wrote to memory of 2708 2528 thnntt.exe 33 PID 2528 wrote to memory of 2708 2528 thnntt.exe 33 PID 2528 wrote to memory of 2708 2528 thnntt.exe 33 PID 2528 wrote to memory of 2708 2528 thnntt.exe 33 PID 2708 wrote to memory of 2764 2708 ppvvj.exe 34 PID 2708 wrote to memory of 2764 2708 ppvvj.exe 34 PID 2708 wrote to memory of 2764 2708 ppvvj.exe 34 PID 2708 wrote to memory of 2764 2708 ppvvj.exe 34 PID 2764 wrote to memory of 2556 2764 fxlfxxf.exe 36 PID 2764 wrote to memory of 2556 2764 fxlfxxf.exe 36 PID 2764 wrote to memory of 2556 2764 fxlfxxf.exe 36 PID 2764 wrote to memory of 2556 2764 fxlfxxf.exe 36 PID 2556 wrote to memory of 2936 2556 pdvpv.exe 37 PID 2556 wrote to memory of 2936 2556 pdvpv.exe 37 PID 2556 wrote to memory of 2936 2556 pdvpv.exe 37 PID 2556 wrote to memory of 2936 2556 pdvpv.exe 37 PID 2936 wrote to memory of 2788 2936 tnttbb.exe 38 PID 2936 wrote to memory of 2788 2936 tnttbb.exe 38 PID 2936 wrote to memory of 2788 2936 tnttbb.exe 38 PID 2936 wrote to memory of 2788 2936 tnttbb.exe 38 PID 2788 wrote to memory of 2668 2788 3vjdv.exe 39 PID 2788 wrote to memory of 2668 2788 3vjdv.exe 39 PID 2788 wrote to memory of 2668 2788 3vjdv.exe 39 PID 2788 wrote to memory of 2668 2788 3vjdv.exe 39 PID 2668 wrote to memory of 2660 2668 1hbtbb.exe 40 PID 2668 wrote to memory of 2660 2668 1hbtbb.exe 40 PID 2668 wrote to memory of 2660 2668 1hbtbb.exe 40 PID 2668 wrote to memory of 2660 2668 1hbtbb.exe 40 PID 2660 wrote to memory of 1804 2660 jpjpv.exe 41 PID 2660 wrote to memory of 1804 2660 jpjpv.exe 41 PID 2660 wrote to memory of 1804 2660 jpjpv.exe 41 PID 2660 wrote to memory of 1804 2660 jpjpv.exe 41 PID 1804 wrote to memory of 352 1804 rfrlrrf.exe 42 PID 1804 wrote to memory of 352 1804 rfrlrrf.exe 42 PID 1804 wrote to memory of 352 1804 rfrlrrf.exe 42 PID 1804 wrote to memory of 352 1804 rfrlrrf.exe 42 PID 352 wrote to memory of 1712 352 hhhnnb.exe 43 PID 352 wrote to memory of 1712 352 hhhnnb.exe 43 PID 352 wrote to memory of 1712 352 hhhnnb.exe 43 PID 352 wrote to memory of 1712 352 hhhnnb.exe 43 PID 1712 wrote to memory of 1972 1712 vpvpv.exe 44 PID 1712 wrote to memory of 1972 1712 vpvpv.exe 44 PID 1712 wrote to memory of 1972 1712 vpvpv.exe 44 PID 1712 wrote to memory of 1972 1712 vpvpv.exe 44 PID 1972 wrote to memory of 1156 1972 xlffrrf.exe 45 PID 1972 wrote to memory of 1156 1972 xlffrrf.exe 45 PID 1972 wrote to memory of 1156 1972 xlffrrf.exe 45 PID 1972 wrote to memory of 1156 1972 xlffrrf.exe 45 PID 1156 wrote to memory of 1700 1156 dvjpd.exe 46 PID 1156 wrote to memory of 1700 1156 dvjpd.exe 46 PID 1156 wrote to memory of 1700 1156 dvjpd.exe 46 PID 1156 wrote to memory of 1700 1156 dvjpd.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d34f298beebc72b97198e4bde422aced4328d8d53442266dc5019ffce8948ea.exe"C:\Users\Admin\AppData\Local\Temp\8d34f298beebc72b97198e4bde422aced4328d8d53442266dc5019ffce8948ea.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\vpdpv.exec:\vpdpv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\xrrllrr.exec:\xrrllrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\thnntt.exec:\thnntt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\ppvvj.exec:\ppvvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\fxlfxxf.exec:\fxlfxxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\pdvpv.exec:\pdvpv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\tnttbb.exec:\tnttbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\3vjdv.exec:\3vjdv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\1hbtbb.exec:\1hbtbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\jpjpv.exec:\jpjpv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\rfrlrrf.exec:\rfrlrrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\hhhnnb.exec:\hhhnnb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:352 -
\??\c:\vpvpv.exec:\vpvpv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\xlffrrf.exec:\xlffrrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\dvjpd.exec:\dvjpd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
\??\c:\fxfxllr.exec:\fxfxllr.exe17⤵
- Executes dropped EXE
PID:1700 -
\??\c:\hbnntt.exec:\hbnntt.exe18⤵
- Executes dropped EXE
PID:1296 -
\??\c:\fxllfff.exec:\fxllfff.exe19⤵
- Executes dropped EXE
PID:1096 -
\??\c:\vpdjj.exec:\vpdjj.exe20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2492 -
\??\c:\7bhtbb.exec:\7bhtbb.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:788 -
\??\c:\7jdpj.exec:\7jdpj.exe22⤵
- Executes dropped EXE
PID:2684 -
\??\c:\3flrlrf.exec:\3flrlrf.exe23⤵
- Executes dropped EXE
PID:940 -
\??\c:\3tnntt.exec:\3tnntt.exe24⤵
- Executes dropped EXE
PID:2016 -
\??\c:\pjvjd.exec:\pjvjd.exe25⤵
- Executes dropped EXE
PID:2020 -
\??\c:\nhhnbb.exec:\nhhnbb.exe26⤵
- Executes dropped EXE
PID:2588 -
\??\c:\1pjvd.exec:\1pjvd.exe27⤵
- Executes dropped EXE
PID:976 -
\??\c:\3rflxfr.exec:\3rflxfr.exe28⤵
- Executes dropped EXE
PID:2472 -
\??\c:\5hhtth.exec:\5hhtth.exe29⤵
- Executes dropped EXE
PID:2964 -
\??\c:\lfrrllr.exec:\lfrrllr.exe30⤵
- Executes dropped EXE
PID:992 -
\??\c:\7xxfrlx.exec:\7xxfrlx.exe31⤵
- Executes dropped EXE
PID:1208 -
\??\c:\bbtbhh.exec:\bbtbhh.exe32⤵
- Executes dropped EXE
PID:2172 -
\??\c:\1dvdv.exec:\1dvdv.exe33⤵
- Executes dropped EXE
PID:2236 -
\??\c:\nnhthn.exec:\nnhthn.exe34⤵
- Executes dropped EXE
PID:2356 -
\??\c:\llrxfll.exec:\llrxfll.exe35⤵
- Executes dropped EXE
PID:2244 -
\??\c:\tnhbtt.exec:\tnhbtt.exe36⤵
- Executes dropped EXE
PID:2552 -
\??\c:\pjdjv.exec:\pjdjv.exe37⤵
- Executes dropped EXE
PID:2068 -
\??\c:\ddvpd.exec:\ddvpd.exe38⤵
- Executes dropped EXE
PID:2820 -
\??\c:\ffflxfr.exec:\ffflxfr.exe39⤵
- Executes dropped EXE
PID:2708 -
\??\c:\nhhthn.exec:\nhhthn.exe40⤵
- Executes dropped EXE
PID:2896 -
\??\c:\nhtbbh.exec:\nhtbbh.exe41⤵
- Executes dropped EXE
PID:2756 -
\??\c:\ddvjd.exec:\ddvjd.exe42⤵
- Executes dropped EXE
PID:2704 -
\??\c:\9rffrxf.exec:\9rffrxf.exe43⤵
- Executes dropped EXE
PID:2884 -
\??\c:\bthhnn.exec:\bthhnn.exe44⤵
- Executes dropped EXE
PID:2616 -
\??\c:\nnhhhn.exec:\nnhhhn.exe45⤵
- Executes dropped EXE
PID:2688 -
\??\c:\pjdvp.exec:\pjdvp.exe46⤵
- Executes dropped EXE
PID:584 -
\??\c:\llfxxfr.exec:\llfxxfr.exe47⤵
- Executes dropped EXE
PID:3056 -
\??\c:\bhbnhn.exec:\bhbnhn.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:868 -
\??\c:\btnntt.exec:\btnntt.exe49⤵
- Executes dropped EXE
PID:2028 -
\??\c:\vdvjv.exec:\vdvjv.exe50⤵
- Executes dropped EXE
PID:1844 -
\??\c:\1lxlxfl.exec:\1lxlxfl.exe51⤵
- Executes dropped EXE
PID:1684 -
\??\c:\bntbbh.exec:\bntbbh.exe52⤵
- Executes dropped EXE
PID:2000 -
\??\c:\htthnn.exec:\htthnn.exe53⤵
- Executes dropped EXE
PID:1708 -
\??\c:\ppjvj.exec:\ppjvj.exe54⤵
- Executes dropped EXE
PID:1948 -
\??\c:\xxlrxlr.exec:\xxlrxlr.exe55⤵
- Executes dropped EXE
PID:1744 -
\??\c:\7nntbn.exec:\7nntbn.exe56⤵
- Executes dropped EXE
PID:2716 -
\??\c:\nnhnnt.exec:\nnhnnt.exe57⤵
- Executes dropped EXE
PID:3052 -
\??\c:\djdpv.exec:\djdpv.exe58⤵
- Executes dropped EXE
PID:2924 -
\??\c:\5rfrlfl.exec:\5rfrlfl.exe59⤵
- Executes dropped EXE
PID:1620 -
\??\c:\xlllrll.exec:\xlllrll.exe60⤵
- Executes dropped EXE
PID:2460 -
\??\c:\1bttbb.exec:\1bttbb.exe61⤵
- Executes dropped EXE
PID:600 -
\??\c:\jpjjp.exec:\jpjjp.exe62⤵
- Executes dropped EXE
PID:1548 -
\??\c:\rrlrxxf.exec:\rrlrxxf.exe63⤵
- Executes dropped EXE
PID:2980 -
\??\c:\xrlrffr.exec:\xrlrffr.exe64⤵
- Executes dropped EXE
PID:1776 -
\??\c:\btttbh.exec:\btttbh.exe65⤵
- Executes dropped EXE
PID:2400 -
\??\c:\jjdjv.exec:\jjdjv.exe66⤵PID:1780
-
\??\c:\xrrrxfr.exec:\xrrrxfr.exe67⤵PID:772
-
\??\c:\lfxxlfl.exec:\lfxxlfl.exe68⤵PID:1392
-
\??\c:\thbbbh.exec:\thbbbh.exe69⤵PID:1664
-
\??\c:\5bnnnn.exec:\5bnnnn.exe70⤵PID:2308
-
\??\c:\vpjjd.exec:\vpjjd.exe71⤵PID:2280
-
\??\c:\xlffllr.exec:\xlffllr.exe72⤵PID:2076
-
\??\c:\tnhhtt.exec:\tnhhtt.exe73⤵PID:348
-
\??\c:\btnbhn.exec:\btnbhn.exe74⤵PID:1200
-
\??\c:\pjdjp.exec:\pjdjp.exe75⤵PID:1592
-
\??\c:\rfrxfxf.exec:\rfrxfxf.exe76⤵PID:2380
-
\??\c:\bthtbb.exec:\bthtbb.exe77⤵PID:2356
-
\??\c:\nhtntb.exec:\nhtntb.exe78⤵PID:2540
-
\??\c:\3vpvv.exec:\3vpvv.exe79⤵PID:1916
-
\??\c:\7lxxfxf.exec:\7lxxfxf.exe80⤵PID:1852
-
\??\c:\hhhhnh.exec:\hhhhnh.exe81⤵PID:2868
-
\??\c:\htnbbb.exec:\htnbbb.exe82⤵PID:2708
-
\??\c:\ddpvv.exec:\ddpvv.exe83⤵PID:2896
-
\??\c:\xfflxxl.exec:\xfflxxl.exe84⤵PID:2756
-
\??\c:\xlrffxf.exec:\xlrffxf.exe85⤵PID:2264
-
\??\c:\5hbbnt.exec:\5hbbnt.exe86⤵PID:2408
-
\??\c:\dpjjj.exec:\dpjjj.exe87⤵PID:2636
-
\??\c:\9rxfffr.exec:\9rxfffr.exe88⤵PID:2680
-
\??\c:\fllrxlx.exec:\fllrxlx.exe89⤵PID:536
-
\??\c:\tttthh.exec:\tttthh.exe90⤵PID:2632
-
\??\c:\dvpdp.exec:\dvpdp.exe91⤵PID:1020
-
\??\c:\ffrxlrr.exec:\ffrxlrr.exe92⤵PID:1624
-
\??\c:\lrrfllr.exec:\lrrfllr.exe93⤵PID:1316
-
\??\c:\bnttnt.exec:\bnttnt.exe94⤵PID:2032
-
\??\c:\dddpd.exec:\dddpd.exe95⤵PID:1940
-
\??\c:\ddppj.exec:\ddppj.exe96⤵PID:1224
-
\??\c:\fxlflrx.exec:\fxlflrx.exe97⤵PID:1760
-
\??\c:\1nhntt.exec:\1nhntt.exe98⤵PID:2584
-
\??\c:\nnhhhn.exec:\nnhhhn.exe99⤵PID:1932
-
\??\c:\dpjvv.exec:\dpjvv.exe100⤵PID:3048
-
\??\c:\1rxflrl.exec:\1rxflrl.exe101⤵PID:2464
-
\??\c:\rlrfllr.exec:\rlrfllr.exe102⤵PID:2492
-
\??\c:\nbttbb.exec:\nbttbb.exe103⤵PID:1672
-
\??\c:\jjdpv.exec:\jjdpv.exe104⤵PID:668
-
\??\c:\pjdjv.exec:\pjdjv.exe105⤵PID:1604
-
\??\c:\9lxfflx.exec:\9lxfflx.exe106⤵PID:2008
-
\??\c:\tnhnnn.exec:\tnhnnn.exe107⤵PID:2052
-
\??\c:\pddjv.exec:\pddjv.exe108⤵PID:1816
-
\??\c:\jjjpv.exec:\jjjpv.exe109⤵PID:1528
-
\??\c:\rlfxllr.exec:\rlfxllr.exe110⤵PID:2852
-
\??\c:\9bbbhn.exec:\9bbbhn.exe111⤵PID:2512
-
\??\c:\7pdvj.exec:\7pdvj.exe112⤵PID:2288
-
\??\c:\vpjjp.exec:\vpjjp.exe113⤵PID:688
-
\??\c:\lfxxlrf.exec:\lfxxlrf.exe114⤵PID:2964
-
\??\c:\5tnbhn.exec:\5tnbhn.exe115⤵
- System Location Discovery: System Language Discovery
PID:336 -
\??\c:\5ttntt.exec:\5ttntt.exe116⤵PID:1724
-
\??\c:\pjvvd.exec:\pjvvd.exe117⤵PID:2696
-
\??\c:\frllrrx.exec:\frllrrx.exe118⤵PID:1588
-
\??\c:\btbbhb.exec:\btbbhb.exe119⤵PID:2236
-
\??\c:\nbtntt.exec:\nbtntt.exe120⤵PID:1696
-
\??\c:\vdvjv.exec:\vdvjv.exe121⤵PID:2232
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-