Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 14:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
14ca581a5e6d1b596c66717e9926f30c1e2d16f1be2531cf28abe2741c7a4ae0.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
14ca581a5e6d1b596c66717e9926f30c1e2d16f1be2531cf28abe2741c7a4ae0.exe
-
Size
454KB
-
MD5
008682d2ad891bf5af097b90fbff0eec
-
SHA1
e0b8b45795c0e967859e1eb8216d38904e67aa61
-
SHA256
14ca581a5e6d1b596c66717e9926f30c1e2d16f1be2531cf28abe2741c7a4ae0
-
SHA512
1b078251953945835151797773440fa83f4ed7f616372827b56e20a9d797a2657f241dd0ad0cf5ab171a46eae3fe45a90882e56e69dc1f42c9c67a857db1026d
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeV:q7Tc2NYHUrAwfMp3CDV
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/2448-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1224-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1732-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3060-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2160-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2296-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/748-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2084-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2132-174-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2092-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1868-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1168-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/696-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1664-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1096-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-332-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2828-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2296-421-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-454-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/624-482-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/624-480-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2576-489-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/332-496-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/648-501-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1296-518-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/332-517-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1792-521-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1792-526-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-610-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-631-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2588-669-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-674-0x0000000001C60000-0x0000000001C8A000-memory.dmp family_blackmoon behavioral1/memory/3064-677-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1264-702-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2012-727-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2924-735-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2336-749-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1824-758-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2576-775-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1792-807-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1224 hbhhtt.exe 2376 fxrxrff.exe 1732 frfrllx.exe 3060 djvjv.exe 2696 82446.exe 2900 6082002.exe 2872 o828680.exe 2908 s2624.exe 2728 jjpvj.exe 2612 6462884.exe 2160 046284.exe 2296 5ddvd.exe 1588 04846.exe 748 48624.exe 1408 frxrxff.exe 2688 xfrfrlx.exe 2084 lrlrllr.exe 2132 i228624.exe 2092 vjpdd.exe 1868 jdjjp.exe 3004 w00202.exe 1168 48020.exe 952 u660420.exe 696 268800.exe 1780 hthnhh.exe 1664 fxrfrrf.exe 2400 vpjvp.exe 1872 nhthhn.exe 3032 20840.exe 1096 48248.exe 1608 tttntn.exe 1592 04288.exe 2488 8626624.exe 1736 m2022.exe 2516 w86200.exe 2552 rfrxxfr.exe 2684 nhtttn.exe 2064 btbntt.exe 2876 dpjvj.exe 2748 thtbnt.exe 2828 ddjpj.exe 2720 htbhth.exe 2812 pvvdj.exe 2932 44024.exe 2604 220606.exe 2360 k42440.exe 3068 0424628.exe 1192 dpdjv.exe 2296 hnnhth.exe 1564 tnbbbb.exe 2496 xxllrxl.exe 2012 826864.exe 2924 vvdpp.exe 2344 48624.exe 2116 048028.exe 2412 420222.exe 1636 488462.exe 624 bhbhnt.exe 2576 5fxrlrf.exe 332 dvvpp.exe 648 886202.exe 948 w20622.exe 1296 820066.exe 1792 lrrxlrl.exe -
resource yara_rule behavioral1/memory/2448-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1224-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/748-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1868-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1168-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/696-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/696-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1096-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1564-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/624-482-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-489-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-526-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1668-527-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1640-583-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-610-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-611-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-669-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-677-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1588-703-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-727-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2336-742-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1824-758-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2576-775-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/648-782-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlxfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lxfrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0684848.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6422468.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tbthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxrlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4862064.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 060486.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26224.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8684668.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2448 wrote to memory of 1224 2448 14ca581a5e6d1b596c66717e9926f30c1e2d16f1be2531cf28abe2741c7a4ae0.exe 30 PID 2448 wrote to memory of 1224 2448 14ca581a5e6d1b596c66717e9926f30c1e2d16f1be2531cf28abe2741c7a4ae0.exe 30 PID 2448 wrote to memory of 1224 2448 14ca581a5e6d1b596c66717e9926f30c1e2d16f1be2531cf28abe2741c7a4ae0.exe 30 PID 2448 wrote to memory of 1224 2448 14ca581a5e6d1b596c66717e9926f30c1e2d16f1be2531cf28abe2741c7a4ae0.exe 30 PID 1224 wrote to memory of 2376 1224 hbhhtt.exe 31 PID 1224 wrote to memory of 2376 1224 hbhhtt.exe 31 PID 1224 wrote to memory of 2376 1224 hbhhtt.exe 31 PID 1224 wrote to memory of 2376 1224 hbhhtt.exe 31 PID 2376 wrote to memory of 1732 2376 fxrxrff.exe 32 PID 2376 wrote to memory of 1732 2376 fxrxrff.exe 32 PID 2376 wrote to memory of 1732 2376 fxrxrff.exe 32 PID 2376 wrote to memory of 1732 2376 fxrxrff.exe 32 PID 1732 wrote to memory of 3060 1732 frfrllx.exe 33 PID 1732 wrote to memory of 3060 1732 frfrllx.exe 33 PID 1732 wrote to memory of 3060 1732 frfrllx.exe 33 PID 1732 wrote to memory of 3060 1732 frfrllx.exe 33 PID 3060 wrote to memory of 2696 3060 djvjv.exe 34 PID 3060 wrote to memory of 2696 3060 djvjv.exe 34 PID 3060 wrote to memory of 2696 3060 djvjv.exe 34 PID 3060 wrote to memory of 2696 3060 djvjv.exe 34 PID 2696 wrote to memory of 2900 2696 82446.exe 35 PID 2696 wrote to memory of 2900 2696 82446.exe 35 PID 2696 wrote to memory of 2900 2696 82446.exe 35 PID 2696 wrote to memory of 2900 2696 82446.exe 35 PID 2900 wrote to memory of 2872 2900 6082002.exe 36 PID 2900 wrote to memory of 2872 2900 6082002.exe 36 PID 2900 wrote to memory of 2872 2900 6082002.exe 36 PID 2900 wrote to memory of 2872 2900 6082002.exe 36 PID 2872 wrote to memory of 2908 2872 o828680.exe 37 PID 2872 wrote to memory of 2908 2872 o828680.exe 37 PID 2872 wrote to memory of 2908 2872 o828680.exe 37 PID 2872 wrote to memory of 2908 2872 o828680.exe 37 PID 2908 wrote to memory of 2728 2908 s2624.exe 38 PID 2908 wrote to memory of 2728 2908 s2624.exe 38 PID 2908 wrote to memory of 2728 2908 s2624.exe 38 PID 2908 wrote to memory of 2728 2908 s2624.exe 38 PID 2728 wrote to memory of 2612 2728 jjpvj.exe 39 PID 2728 wrote to memory of 2612 2728 jjpvj.exe 39 PID 2728 wrote to memory of 2612 2728 jjpvj.exe 39 PID 2728 wrote to memory of 2612 2728 jjpvj.exe 39 PID 2612 wrote to memory of 2160 2612 6462884.exe 40 PID 2612 wrote to memory of 2160 2612 6462884.exe 40 PID 2612 wrote to memory of 2160 2612 6462884.exe 40 PID 2612 wrote to memory of 2160 2612 6462884.exe 40 PID 2160 wrote to memory of 2296 2160 046284.exe 41 PID 2160 wrote to memory of 2296 2160 046284.exe 41 PID 2160 wrote to memory of 2296 2160 046284.exe 41 PID 2160 wrote to memory of 2296 2160 046284.exe 41 PID 2296 wrote to memory of 1588 2296 5ddvd.exe 42 PID 2296 wrote to memory of 1588 2296 5ddvd.exe 42 PID 2296 wrote to memory of 1588 2296 5ddvd.exe 42 PID 2296 wrote to memory of 1588 2296 5ddvd.exe 42 PID 1588 wrote to memory of 748 1588 04846.exe 43 PID 1588 wrote to memory of 748 1588 04846.exe 43 PID 1588 wrote to memory of 748 1588 04846.exe 43 PID 1588 wrote to memory of 748 1588 04846.exe 43 PID 748 wrote to memory of 1408 748 48624.exe 44 PID 748 wrote to memory of 1408 748 48624.exe 44 PID 748 wrote to memory of 1408 748 48624.exe 44 PID 748 wrote to memory of 1408 748 48624.exe 44 PID 1408 wrote to memory of 2688 1408 frxrxff.exe 45 PID 1408 wrote to memory of 2688 1408 frxrxff.exe 45 PID 1408 wrote to memory of 2688 1408 frxrxff.exe 45 PID 1408 wrote to memory of 2688 1408 frxrxff.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\14ca581a5e6d1b596c66717e9926f30c1e2d16f1be2531cf28abe2741c7a4ae0.exe"C:\Users\Admin\AppData\Local\Temp\14ca581a5e6d1b596c66717e9926f30c1e2d16f1be2531cf28abe2741c7a4ae0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\hbhhtt.exec:\hbhhtt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
\??\c:\fxrxrff.exec:\fxrxrff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\frfrllx.exec:\frfrllx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\djvjv.exec:\djvjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\82446.exec:\82446.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\6082002.exec:\6082002.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\o828680.exec:\o828680.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\s2624.exec:\s2624.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\jjpvj.exec:\jjpvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\6462884.exec:\6462884.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\046284.exec:\046284.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\5ddvd.exec:\5ddvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\04846.exec:\04846.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\48624.exec:\48624.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
\??\c:\frxrxff.exec:\frxrxff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
\??\c:\xfrfrlx.exec:\xfrfrlx.exe17⤵
- Executes dropped EXE
PID:2688 -
\??\c:\lrlrllr.exec:\lrlrllr.exe18⤵
- Executes dropped EXE
PID:2084 -
\??\c:\i228624.exec:\i228624.exe19⤵
- Executes dropped EXE
PID:2132 -
\??\c:\vjpdd.exec:\vjpdd.exe20⤵
- Executes dropped EXE
PID:2092 -
\??\c:\jdjjp.exec:\jdjjp.exe21⤵
- Executes dropped EXE
PID:1868 -
\??\c:\w00202.exec:\w00202.exe22⤵
- Executes dropped EXE
PID:3004 -
\??\c:\48020.exec:\48020.exe23⤵
- Executes dropped EXE
PID:1168 -
\??\c:\u660420.exec:\u660420.exe24⤵
- Executes dropped EXE
PID:952 -
\??\c:\268800.exec:\268800.exe25⤵
- Executes dropped EXE
PID:696 -
\??\c:\hthnhh.exec:\hthnhh.exe26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1780 -
\??\c:\fxrfrrf.exec:\fxrfrrf.exe27⤵
- Executes dropped EXE
PID:1664 -
\??\c:\vpjvp.exec:\vpjvp.exe28⤵
- Executes dropped EXE
PID:2400 -
\??\c:\nhthhn.exec:\nhthhn.exe29⤵
- Executes dropped EXE
PID:1872 -
\??\c:\20840.exec:\20840.exe30⤵
- Executes dropped EXE
PID:3032 -
\??\c:\48248.exec:\48248.exe31⤵
- Executes dropped EXE
PID:1096 -
\??\c:\tttntn.exec:\tttntn.exe32⤵
- Executes dropped EXE
PID:1608 -
\??\c:\04288.exec:\04288.exe33⤵
- Executes dropped EXE
PID:1592 -
\??\c:\8626624.exec:\8626624.exe34⤵
- Executes dropped EXE
PID:2488 -
\??\c:\m2022.exec:\m2022.exe35⤵
- Executes dropped EXE
PID:1736 -
\??\c:\w86200.exec:\w86200.exe36⤵
- Executes dropped EXE
PID:2516 -
\??\c:\rfrxxfr.exec:\rfrxxfr.exe37⤵
- Executes dropped EXE
PID:2552 -
\??\c:\nhtttn.exec:\nhtttn.exe38⤵
- Executes dropped EXE
PID:2684 -
\??\c:\btbntt.exec:\btbntt.exe39⤵
- Executes dropped EXE
PID:2064 -
\??\c:\dpjvj.exec:\dpjvj.exe40⤵
- Executes dropped EXE
PID:2876 -
\??\c:\thtbnt.exec:\thtbnt.exe41⤵
- Executes dropped EXE
PID:2748 -
\??\c:\ddjpj.exec:\ddjpj.exe42⤵
- Executes dropped EXE
PID:2828 -
\??\c:\htbhth.exec:\htbhth.exe43⤵
- Executes dropped EXE
PID:2720 -
\??\c:\pvvdj.exec:\pvvdj.exe44⤵
- Executes dropped EXE
PID:2812 -
\??\c:\44024.exec:\44024.exe45⤵
- Executes dropped EXE
PID:2932 -
\??\c:\220606.exec:\220606.exe46⤵
- Executes dropped EXE
PID:2604 -
\??\c:\k42440.exec:\k42440.exe47⤵
- Executes dropped EXE
PID:2360 -
\??\c:\0424628.exec:\0424628.exe48⤵
- Executes dropped EXE
PID:3068 -
\??\c:\dpdjv.exec:\dpdjv.exe49⤵
- Executes dropped EXE
PID:1192 -
\??\c:\hnnhth.exec:\hnnhth.exe50⤵
- Executes dropped EXE
PID:2296 -
\??\c:\tnbbbb.exec:\tnbbbb.exe51⤵
- Executes dropped EXE
PID:1564 -
\??\c:\xxllrxl.exec:\xxllrxl.exe52⤵
- Executes dropped EXE
PID:2496 -
\??\c:\826864.exec:\826864.exe53⤵
- Executes dropped EXE
PID:2012 -
\??\c:\vvdpp.exec:\vvdpp.exe54⤵
- Executes dropped EXE
PID:2924 -
\??\c:\48624.exec:\48624.exe55⤵
- Executes dropped EXE
PID:2344 -
\??\c:\048028.exec:\048028.exe56⤵
- Executes dropped EXE
PID:2116 -
\??\c:\420222.exec:\420222.exe57⤵
- Executes dropped EXE
PID:2412 -
\??\c:\488462.exec:\488462.exe58⤵
- Executes dropped EXE
PID:1636 -
\??\c:\bhbhnt.exec:\bhbhnt.exe59⤵
- Executes dropped EXE
PID:624 -
\??\c:\5fxrlrf.exec:\5fxrlrf.exe60⤵
- Executes dropped EXE
PID:2576 -
\??\c:\dvvpp.exec:\dvvpp.exe61⤵
- Executes dropped EXE
PID:332 -
\??\c:\886202.exec:\886202.exe62⤵
- Executes dropped EXE
PID:648 -
\??\c:\w20622.exec:\w20622.exe63⤵
- Executes dropped EXE
PID:948 -
\??\c:\820066.exec:\820066.exe64⤵
- Executes dropped EXE
PID:1296 -
\??\c:\lrrxlrl.exec:\lrrxlrl.exe65⤵
- Executes dropped EXE
PID:1792 -
\??\c:\lrxlxll.exec:\lrxlxll.exe66⤵PID:1668
-
\??\c:\tnbnbb.exec:\tnbnbb.exe67⤵PID:1724
-
\??\c:\48624.exec:\48624.exe68⤵PID:2268
-
\??\c:\68006.exec:\68006.exe69⤵PID:3024
-
\??\c:\o088664.exec:\o088664.exe70⤵PID:2824
-
\??\c:\u866880.exec:\u866880.exe71⤵PID:1924
-
\??\c:\tnhnbb.exec:\tnhnbb.exe72⤵PID:2560
-
\??\c:\6204820.exec:\6204820.exe73⤵PID:3040
-
\??\c:\vppjv.exec:\vppjv.exe74⤵PID:1508
-
\??\c:\m4240.exec:\m4240.exe75⤵PID:1640
-
\??\c:\4866800.exec:\4866800.exe76⤵PID:2388
-
\??\c:\86046.exec:\86046.exe77⤵PID:2184
-
\??\c:\dvjjp.exec:\dvjjp.exe78⤵PID:2404
-
\??\c:\c084668.exec:\c084668.exe79⤵PID:1732
-
\??\c:\bththn.exec:\bththn.exe80⤵PID:2736
-
\??\c:\dpvdv.exec:\dpvdv.exe81⤵PID:2880
-
\??\c:\bbbnht.exec:\bbbnht.exe82⤵PID:2744
-
\??\c:\s0868.exec:\s0868.exe83⤵PID:2452
-
\??\c:\dvjdd.exec:\dvjdd.exe84⤵PID:2752
-
\??\c:\nbthth.exec:\nbthth.exe85⤵PID:2692
-
\??\c:\dvvpj.exec:\dvvpj.exe86⤵PID:1756
-
\??\c:\0040220.exec:\0040220.exe87⤵PID:2588
-
\??\c:\820688.exec:\820688.exe88⤵PID:2712
-
\??\c:\444646.exec:\444646.exe89⤵PID:3064
-
\??\c:\ffrxrxf.exec:\ffrxrxf.exe90⤵PID:2820
-
\??\c:\7bhhhh.exec:\7bhhhh.exe91⤵PID:2272
-
\??\c:\5bnbht.exec:\5bnbht.exe92⤵PID:1264
-
\??\c:\084400.exec:\084400.exe93⤵PID:1588
-
\??\c:\rrrfrfr.exec:\rrrfrfr.exe94⤵PID:1940
-
\??\c:\xrxfllx.exec:\xrxfllx.exe95⤵PID:2948
-
\??\c:\bhbbbb.exec:\bhbbbb.exe96⤵
- System Location Discovery: System Language Discovery
PID:2012 -
\??\c:\pjdvp.exec:\pjdvp.exe97⤵PID:2924
-
\??\c:\s6024.exec:\s6024.exe98⤵PID:2180
-
\??\c:\5xxlllr.exec:\5xxlllr.exe99⤵PID:2336
-
\??\c:\fffrfxr.exec:\fffrfxr.exe100⤵PID:320
-
\??\c:\bthtbh.exec:\bthtbh.exe101⤵PID:1824
-
\??\c:\m0462.exec:\m0462.exe102⤵PID:820
-
\??\c:\a0468.exec:\a0468.exe103⤵PID:2576
-
\??\c:\ntnthh.exec:\ntnthh.exe104⤵PID:1308
-
\??\c:\200684.exec:\200684.exe105⤵PID:648
-
\??\c:\k62402.exec:\k62402.exe106⤵PID:2152
-
\??\c:\bbbbtb.exec:\bbbbtb.exe107⤵PID:1672
-
\??\c:\e48462.exec:\e48462.exe108⤵PID:1792
-
\??\c:\20846.exec:\20846.exe109⤵PID:1780
-
\??\c:\6022008.exec:\6022008.exe110⤵PID:1028
-
\??\c:\i266880.exec:\i266880.exe111⤵PID:1964
-
\??\c:\3bhnbh.exec:\3bhnbh.exe112⤵PID:1580
-
\??\c:\5vjpv.exec:\5vjpv.exe113⤵PID:684
-
\??\c:\bbtbnt.exec:\bbtbnt.exe114⤵PID:1444
-
\??\c:\1rlrlrx.exec:\1rlrlrx.exe115⤵PID:2340
-
\??\c:\9llfxxl.exec:\9llfxxl.exe116⤵PID:2448
-
\??\c:\606228.exec:\606228.exe117⤵PID:2484
-
\??\c:\fxlrlrf.exec:\fxlrlrf.exe118⤵
- System Location Discovery: System Language Discovery
PID:1640 -
\??\c:\9fxflrf.exec:\9fxflrf.exe119⤵PID:2044
-
\??\c:\btnthh.exec:\btnthh.exe120⤵PID:1812
-
\??\c:\xxllxfl.exec:\xxllxfl.exe121⤵PID:2212
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-