Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 16:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
baa3df1efad2f7144d96533fbf6981db04264fb53ff97a26f878171a3956a89f.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
baa3df1efad2f7144d96533fbf6981db04264fb53ff97a26f878171a3956a89f.exe
-
Size
453KB
-
MD5
4a7c807614c9973ab3156b4538a13d2a
-
SHA1
d4b88b9d2a3146583e1c60642f3a09e82359cdd0
-
SHA256
baa3df1efad2f7144d96533fbf6981db04264fb53ff97a26f878171a3956a89f
-
SHA512
37fd621f2af3f4c6e6ac02cd413270e749dc0dd2925e04f1d3808515ebccc9ebd3fa0055611359e5d05e51147b4a06024e48dc6e9f34d813a03716f66561ffd9
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbep:q7Tc2NYHUrAwfMp3CDp
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 51 IoCs
resource yara_rule behavioral1/memory/1708-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-22-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-74-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2832-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/668-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1120-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1120-129-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2920-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/484-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1932-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1444-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/584-186-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2092-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2472-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1056-240-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/3008-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-356-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2764-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-366-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2612-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1484-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1484-394-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1140-402-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/496-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/496-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-430-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2020-437-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1052-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1512-469-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1344-516-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2456-530-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1344-537-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2100-545-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1836-553-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1784-568-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2492-586-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2768-635-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2632-659-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/992-681-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1984-695-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/576-702-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/448-761-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1648-810-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2680 pjvjv.exe 2488 5bbhth.exe 2216 vvpdp.exe 2808 rlfflrf.exe 2704 1httbh.exe 2732 1pjvj.exe 2832 dvjvd.exe 2888 7pjpv.exe 2652 7vjvp.exe 2284 bbtthh.exe 668 3vjjj.exe 1584 5hbbhh.exe 1120 1vjpd.exe 2920 7lxrxff.exe 484 pvdjj.exe 796 hhbhnt.exe 1932 ttnthn.exe 1444 jvvvd.exe 584 3htttb.exe 2092 vpdjv.exe 2128 fxrxllf.exe 628 jpjpv.exe 2472 7xrrflr.exe 1340 3dvvj.exe 1056 pjjpv.exe 816 rffxffl.exe 1804 tnhhtt.exe 1748 hbnbht.exe 844 tnhhbb.exe 888 lffflxf.exe 3008 bbhntt.exe 276 7flrxfl.exe 1600 thtthh.exe 2900 jddjd.exe 2496 lflrxxf.exe 2216 lfxlrfr.exe 2848 bthbhb.exe 2824 pjddj.exe 3004 vjjpd.exe 2476 xxlrxfr.exe 2956 rlflrrx.exe 2764 tnntbt.exe 2612 jdvdp.exe 2632 3lfrrxl.exe 2176 xrfrfrf.exe 1484 hhntbb.exe 1140 1jvdp.exe 496 xxrlxxf.exe 2908 7hbhbh.exe 636 nhnttt.exe 2912 ddjvj.exe 2020 7flrxxl.exe 1052 rrlflfx.exe 2016 nbhnnn.exe 1800 jpdvd.exe 2236 lfxflfr.exe 1156 xlxxlfl.exe 1512 hhthnt.exe 2324 dddpj.exe 2148 vjjpd.exe 2320 lrlrflx.exe 1132 nhbbnt.exe 1376 pdvpv.exe 1344 rlxfllx.exe -
resource yara_rule behavioral1/memory/1708-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/668-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1120-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/484-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1444-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1444-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/584-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/628-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/888-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-356-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2764-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1484-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1140-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/496-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/496-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1052-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1512-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-489-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-545-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1836-553-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1784-568-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2492-579-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/992-681-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-688-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1028-709-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-734-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-772-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-810-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/108-837-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/108-845-0x00000000003C0000-0x00000000003EA000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfrxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlfrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lxrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrxfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3frxflx.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1708 wrote to memory of 2680 1708 baa3df1efad2f7144d96533fbf6981db04264fb53ff97a26f878171a3956a89f.exe 30 PID 1708 wrote to memory of 2680 1708 baa3df1efad2f7144d96533fbf6981db04264fb53ff97a26f878171a3956a89f.exe 30 PID 1708 wrote to memory of 2680 1708 baa3df1efad2f7144d96533fbf6981db04264fb53ff97a26f878171a3956a89f.exe 30 PID 1708 wrote to memory of 2680 1708 baa3df1efad2f7144d96533fbf6981db04264fb53ff97a26f878171a3956a89f.exe 30 PID 2680 wrote to memory of 2488 2680 pjvjv.exe 31 PID 2680 wrote to memory of 2488 2680 pjvjv.exe 31 PID 2680 wrote to memory of 2488 2680 pjvjv.exe 31 PID 2680 wrote to memory of 2488 2680 pjvjv.exe 31 PID 2488 wrote to memory of 2216 2488 5bbhth.exe 32 PID 2488 wrote to memory of 2216 2488 5bbhth.exe 32 PID 2488 wrote to memory of 2216 2488 5bbhth.exe 32 PID 2488 wrote to memory of 2216 2488 5bbhth.exe 32 PID 2216 wrote to memory of 2808 2216 vvpdp.exe 33 PID 2216 wrote to memory of 2808 2216 vvpdp.exe 33 PID 2216 wrote to memory of 2808 2216 vvpdp.exe 33 PID 2216 wrote to memory of 2808 2216 vvpdp.exe 33 PID 2808 wrote to memory of 2704 2808 rlfflrf.exe 34 PID 2808 wrote to memory of 2704 2808 rlfflrf.exe 34 PID 2808 wrote to memory of 2704 2808 rlfflrf.exe 34 PID 2808 wrote to memory of 2704 2808 rlfflrf.exe 34 PID 2704 wrote to memory of 2732 2704 1httbh.exe 35 PID 2704 wrote to memory of 2732 2704 1httbh.exe 35 PID 2704 wrote to memory of 2732 2704 1httbh.exe 35 PID 2704 wrote to memory of 2732 2704 1httbh.exe 35 PID 2732 wrote to memory of 2832 2732 1pjvj.exe 36 PID 2732 wrote to memory of 2832 2732 1pjvj.exe 36 PID 2732 wrote to memory of 2832 2732 1pjvj.exe 36 PID 2732 wrote to memory of 2832 2732 1pjvj.exe 36 PID 2832 wrote to memory of 2888 2832 dvjvd.exe 37 PID 2832 wrote to memory of 2888 2832 dvjvd.exe 37 PID 2832 wrote to memory of 2888 2832 dvjvd.exe 37 PID 2832 wrote to memory of 2888 2832 dvjvd.exe 37 PID 2888 wrote to memory of 2652 2888 7pjpv.exe 38 PID 2888 wrote to memory of 2652 2888 7pjpv.exe 38 PID 2888 wrote to memory of 2652 2888 7pjpv.exe 38 PID 2888 wrote to memory of 2652 2888 7pjpv.exe 38 PID 2652 wrote to memory of 2284 2652 7vjvp.exe 39 PID 2652 wrote to memory of 2284 2652 7vjvp.exe 39 PID 2652 wrote to memory of 2284 2652 7vjvp.exe 39 PID 2652 wrote to memory of 2284 2652 7vjvp.exe 39 PID 2284 wrote to memory of 668 2284 bbtthh.exe 40 PID 2284 wrote to memory of 668 2284 bbtthh.exe 40 PID 2284 wrote to memory of 668 2284 bbtthh.exe 40 PID 2284 wrote to memory of 668 2284 bbtthh.exe 40 PID 668 wrote to memory of 1584 668 3vjjj.exe 41 PID 668 wrote to memory of 1584 668 3vjjj.exe 41 PID 668 wrote to memory of 1584 668 3vjjj.exe 41 PID 668 wrote to memory of 1584 668 3vjjj.exe 41 PID 1584 wrote to memory of 1120 1584 5hbbhh.exe 42 PID 1584 wrote to memory of 1120 1584 5hbbhh.exe 42 PID 1584 wrote to memory of 1120 1584 5hbbhh.exe 42 PID 1584 wrote to memory of 1120 1584 5hbbhh.exe 42 PID 1120 wrote to memory of 2920 1120 1vjpd.exe 43 PID 1120 wrote to memory of 2920 1120 1vjpd.exe 43 PID 1120 wrote to memory of 2920 1120 1vjpd.exe 43 PID 1120 wrote to memory of 2920 1120 1vjpd.exe 43 PID 2920 wrote to memory of 484 2920 7lxrxff.exe 44 PID 2920 wrote to memory of 484 2920 7lxrxff.exe 44 PID 2920 wrote to memory of 484 2920 7lxrxff.exe 44 PID 2920 wrote to memory of 484 2920 7lxrxff.exe 44 PID 484 wrote to memory of 796 484 pvdjj.exe 45 PID 484 wrote to memory of 796 484 pvdjj.exe 45 PID 484 wrote to memory of 796 484 pvdjj.exe 45 PID 484 wrote to memory of 796 484 pvdjj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\baa3df1efad2f7144d96533fbf6981db04264fb53ff97a26f878171a3956a89f.exe"C:\Users\Admin\AppData\Local\Temp\baa3df1efad2f7144d96533fbf6981db04264fb53ff97a26f878171a3956a89f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\pjvjv.exec:\pjvjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\5bbhth.exec:\5bbhth.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\vvpdp.exec:\vvpdp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\rlfflrf.exec:\rlfflrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\1httbh.exec:\1httbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\1pjvj.exec:\1pjvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\dvjvd.exec:\dvjvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\7pjpv.exec:\7pjpv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\7vjvp.exec:\7vjvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\bbtthh.exec:\bbtthh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\3vjjj.exec:\3vjjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:668 -
\??\c:\5hbbhh.exec:\5hbbhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\1vjpd.exec:\1vjpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
\??\c:\7lxrxff.exec:\7lxrxff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\pvdjj.exec:\pvdjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:484 -
\??\c:\hhbhnt.exec:\hhbhnt.exe17⤵
- Executes dropped EXE
PID:796 -
\??\c:\ttnthn.exec:\ttnthn.exe18⤵
- Executes dropped EXE
PID:1932 -
\??\c:\jvvvd.exec:\jvvvd.exe19⤵
- Executes dropped EXE
PID:1444 -
\??\c:\3htttb.exec:\3htttb.exe20⤵
- Executes dropped EXE
PID:584 -
\??\c:\vpdjv.exec:\vpdjv.exe21⤵
- Executes dropped EXE
PID:2092 -
\??\c:\fxrxllf.exec:\fxrxllf.exe22⤵
- Executes dropped EXE
PID:2128 -
\??\c:\jpjpv.exec:\jpjpv.exe23⤵
- Executes dropped EXE
PID:628 -
\??\c:\7xrrflr.exec:\7xrrflr.exe24⤵
- Executes dropped EXE
PID:2472 -
\??\c:\3dvvj.exec:\3dvvj.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1340 -
\??\c:\pjjpv.exec:\pjjpv.exe26⤵
- Executes dropped EXE
PID:1056 -
\??\c:\rffxffl.exec:\rffxffl.exe27⤵
- Executes dropped EXE
PID:816 -
\??\c:\tnhhtt.exec:\tnhhtt.exe28⤵
- Executes dropped EXE
PID:1804 -
\??\c:\hbnbht.exec:\hbnbht.exe29⤵
- Executes dropped EXE
PID:1748 -
\??\c:\tnhhbb.exec:\tnhhbb.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:844 -
\??\c:\lffflxf.exec:\lffflxf.exe31⤵
- Executes dropped EXE
PID:888 -
\??\c:\bbhntt.exec:\bbhntt.exe32⤵
- Executes dropped EXE
PID:3008 -
\??\c:\7flrxfl.exec:\7flrxfl.exe33⤵
- Executes dropped EXE
PID:276 -
\??\c:\thtthh.exec:\thtthh.exe34⤵
- Executes dropped EXE
PID:1600 -
\??\c:\jddjd.exec:\jddjd.exe35⤵
- Executes dropped EXE
PID:2900 -
\??\c:\lflrxxf.exec:\lflrxxf.exe36⤵
- Executes dropped EXE
PID:2496 -
\??\c:\lfxlrfr.exec:\lfxlrfr.exe37⤵
- Executes dropped EXE
PID:2216 -
\??\c:\bthbhb.exec:\bthbhb.exe38⤵
- Executes dropped EXE
PID:2848 -
\??\c:\pjddj.exec:\pjddj.exe39⤵
- Executes dropped EXE
PID:2824 -
\??\c:\vjjpd.exec:\vjjpd.exe40⤵
- Executes dropped EXE
PID:3004 -
\??\c:\xxlrxfr.exec:\xxlrxfr.exe41⤵
- Executes dropped EXE
PID:2476 -
\??\c:\rlflrrx.exec:\rlflrrx.exe42⤵
- Executes dropped EXE
PID:2956 -
\??\c:\tnntbt.exec:\tnntbt.exe43⤵
- Executes dropped EXE
PID:2764 -
\??\c:\jdvdp.exec:\jdvdp.exe44⤵
- Executes dropped EXE
PID:2612 -
\??\c:\3lfrrxl.exec:\3lfrrxl.exe45⤵
- Executes dropped EXE
PID:2632 -
\??\c:\xrfrfrf.exec:\xrfrfrf.exe46⤵
- Executes dropped EXE
PID:2176 -
\??\c:\hhntbb.exec:\hhntbb.exe47⤵
- Executes dropped EXE
PID:1484 -
\??\c:\1jvdp.exec:\1jvdp.exe48⤵
- Executes dropped EXE
PID:1140 -
\??\c:\xxrlxxf.exec:\xxrlxxf.exe49⤵
- Executes dropped EXE
PID:496 -
\??\c:\7hbhbh.exec:\7hbhbh.exe50⤵
- Executes dropped EXE
PID:2908 -
\??\c:\nhnttt.exec:\nhnttt.exe51⤵
- Executes dropped EXE
PID:636 -
\??\c:\ddjvj.exec:\ddjvj.exe52⤵
- Executes dropped EXE
PID:2912 -
\??\c:\7flrxxl.exec:\7flrxxl.exe53⤵
- Executes dropped EXE
PID:2020 -
\??\c:\rrlflfx.exec:\rrlflfx.exe54⤵
- Executes dropped EXE
PID:1052 -
\??\c:\nbhnnn.exec:\nbhnnn.exe55⤵
- Executes dropped EXE
PID:2016 -
\??\c:\jpdvd.exec:\jpdvd.exe56⤵
- Executes dropped EXE
PID:1800 -
\??\c:\lfxflfr.exec:\lfxflfr.exe57⤵
- Executes dropped EXE
PID:2236 -
\??\c:\xlxxlfl.exec:\xlxxlfl.exe58⤵
- Executes dropped EXE
PID:1156 -
\??\c:\hhthnt.exec:\hhthnt.exe59⤵
- Executes dropped EXE
PID:1512 -
\??\c:\dddpj.exec:\dddpj.exe60⤵
- Executes dropped EXE
PID:2324 -
\??\c:\vjjpd.exec:\vjjpd.exe61⤵
- Executes dropped EXE
PID:2148 -
\??\c:\lrlrflx.exec:\lrlrflx.exe62⤵
- Executes dropped EXE
PID:2320 -
\??\c:\nhbbnt.exec:\nhbbnt.exe63⤵
- Executes dropped EXE
PID:1132 -
\??\c:\pdvpv.exec:\pdvpv.exe64⤵
- Executes dropped EXE
PID:1376 -
\??\c:\rlxfllx.exec:\rlxfllx.exe65⤵
- Executes dropped EXE
PID:1344 -
\??\c:\fxxlllx.exec:\fxxlllx.exe66⤵PID:2976
-
\??\c:\7tnthh.exec:\7tnthh.exe67⤵PID:2456
-
\??\c:\vpppd.exec:\vpppd.exe68⤵PID:1648
-
\??\c:\pjjvd.exec:\pjjvd.exe69⤵
- System Location Discovery: System Language Discovery
PID:2100 -
\??\c:\rllxxfr.exec:\rllxxfr.exe70⤵PID:1836
-
\??\c:\hnbtbb.exec:\hnbtbb.exe71⤵PID:1508
-
\??\c:\djdpd.exec:\djdpd.exe72⤵PID:1244
-
\??\c:\lfxfxxf.exec:\lfxfxxf.exe73⤵PID:1784
-
\??\c:\3xrxrrx.exec:\3xrxrrx.exe74⤵PID:1596
-
\??\c:\tnnntb.exec:\tnnntb.exe75⤵PID:2492
-
\??\c:\5pdjv.exec:\5pdjv.exe76⤵PID:1808
-
\??\c:\ffflrfr.exec:\ffflrfr.exe77⤵PID:2744
-
\??\c:\7lffllx.exec:\7lffllx.exe78⤵PID:2876
-
\??\c:\tnbbhn.exec:\tnbbhn.exe79⤵PID:2192
-
\??\c:\3bhhhb.exec:\3bhhhb.exe80⤵PID:2756
-
\??\c:\pvjpv.exec:\pvjpv.exe81⤵PID:2704
-
\??\c:\rllrxxf.exec:\rllrxxf.exe82⤵PID:2628
-
\??\c:\hntbnt.exec:\hntbnt.exe83⤵PID:2768
-
\??\c:\nhtthn.exec:\nhtthn.exe84⤵PID:2956
-
\??\c:\7vvjp.exec:\7vvjp.exe85⤵PID:2676
-
\??\c:\lrlfrrf.exec:\lrlfrrf.exe86⤵
- System Location Discovery: System Language Discovery
PID:2612 -
\??\c:\fxxfxxl.exec:\fxxfxxl.exe87⤵PID:2632
-
\??\c:\nnbhth.exec:\nnbhth.exe88⤵PID:1084
-
\??\c:\jvvvd.exec:\jvvvd.exe89⤵PID:1984
-
\??\c:\dvpvj.exec:\dvpvj.exe90⤵PID:2960
-
\??\c:\rxfflfr.exec:\rxfflfr.exe91⤵PID:992
-
\??\c:\hthhtt.exec:\hthhtt.exe92⤵PID:2564
-
\??\c:\ppjpj.exec:\ppjpj.exe93⤵PID:576
-
\??\c:\rrlrfrf.exec:\rrlrfrf.exe94⤵PID:2948
-
\??\c:\tthttt.exec:\tthttt.exe95⤵PID:1028
-
\??\c:\1ntnbh.exec:\1ntnbh.exe96⤵PID:2188
-
\??\c:\jjdjv.exec:\jjdjv.exe97⤵PID:1932
-
\??\c:\lfxfrrx.exec:\lfxfrrx.exe98⤵PID:2172
-
\??\c:\5rfllrf.exec:\5rfllrf.exe99⤵PID:2116
-
\??\c:\9ntnbb.exec:\9ntnbb.exe100⤵PID:584
-
\??\c:\jjdvj.exec:\jjdvj.exe101⤵PID:2144
-
\??\c:\xrxrxfl.exec:\xrxrxfl.exe102⤵PID:3032
-
\??\c:\flllrxr.exec:\flllrxr.exe103⤵PID:448
-
\??\c:\7hthnt.exec:\7hthnt.exe104⤵PID:2568
-
\??\c:\pjdjv.exec:\pjdjv.exe105⤵PID:2472
-
\??\c:\frrlrfx.exec:\frrlrfx.exe106⤵PID:836
-
\??\c:\fxxrxfr.exec:\fxxrxfr.exe107⤵PID:908
-
\??\c:\hhbnhn.exec:\hhbnhn.exe108⤵PID:940
-
\??\c:\jdjdj.exec:\jdjdj.exe109⤵PID:1936
-
\??\c:\vvpdv.exec:\vvpdv.exe110⤵PID:856
-
\??\c:\fxlxrrf.exec:\fxlxrrf.exe111⤵PID:1648
-
\??\c:\llflxfl.exec:\llflxfl.exe112⤵PID:2100
-
\??\c:\nnhtht.exec:\nnhtht.exe113⤵PID:1836
-
\??\c:\jddjp.exec:\jddjp.exe114⤵PID:880
-
\??\c:\xxrxllx.exec:\xxrxllx.exe115⤵PID:108
-
\??\c:\xxrlflx.exec:\xxrlflx.exe116⤵PID:2484
-
\??\c:\thbhtb.exec:\thbhtb.exe117⤵PID:1596
-
\??\c:\9dddp.exec:\9dddp.exe118⤵PID:2468
-
\??\c:\rlxlxxl.exec:\rlxlxxl.exe119⤵PID:2488
-
\??\c:\7rrxrxr.exec:\7rrxrxr.exe120⤵PID:2744
-
\??\c:\nthbnt.exec:\nthbnt.exe121⤵PID:2876
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-