Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 15:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d98c43cbd709152f41b1875199f921814b22f77f13e2cfbfa7012a319bcd424e.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
d98c43cbd709152f41b1875199f921814b22f77f13e2cfbfa7012a319bcd424e.exe
-
Size
454KB
-
MD5
8e20e60a640e12c24ebbd12f1af7dcef
-
SHA1
bdfa5ba3f44d81bde4ca89d270e538cbf63f9485
-
SHA256
d98c43cbd709152f41b1875199f921814b22f77f13e2cfbfa7012a319bcd424e
-
SHA512
97290083b3e40a43d3a15517d62349f3b704bbd64aa35e0c7d3c21597ff2cf02d0c38ce0b072f4e21f55814f07bf7a97772952df65743e9ab20c4daf268ef20a
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeR:q7Tc2NYHUrAwfMp3CDR
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/2012-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2072-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2084-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1964-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-104-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2664-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1536-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-133-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1252-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/832-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/344-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1064-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1928-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1840-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1584-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-325-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2796-338-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2500-345-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2880-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-382-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2892-408-0x0000000001C50000-0x0000000001C7A000-memory.dmp family_blackmoon behavioral1/memory/1736-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-422-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-429-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2712-442-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2208-480-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-605-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-618-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2200-649-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2328-657-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2232-861-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-892-0x00000000001C0000-0x00000000001EA000-memory.dmp family_blackmoon behavioral1/memory/2928-899-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2648-980-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2648-1001-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3004-1033-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-1130-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2852-1138-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2072 dpdjd.exe 2692 hhtthh.exe 2084 3lxflrf.exe 1964 5bbbnn.exe 2808 vjpjp.exe 2740 xlrlrlr.exe 2728 vjvvd.exe 2632 fxlflfl.exe 2668 bthhnn.exe 2664 vjvpv.exe 2060 5httnh.exe 1536 thnhnn.exe 2952 7rrrrlf.exe 1252 1pppv.exe 1468 flxxxrx.exe 2712 nhbntt.exe 832 3xlflll.exe 1904 1nthbt.exe 2156 dpddv.exe 1044 llxlrxl.exe 344 thbbhh.exe 780 pjddv.exe 1064 hthhhb.exe 2800 9bnnhh.exe 1148 ffrlxfr.exe 2396 5bnttb.exe 564 fxfxxll.exe 1928 bhnntt.exe 1840 vjvvv.exe 3048 rxrrrxr.exe 1584 hbhbbt.exe 2044 pvppv.exe 2404 bnbbhh.exe 2796 dpdjp.exe 2500 dpddv.exe 264 xrfxfxf.exe 2764 7bnntt.exe 2868 nbnntt.exe 2880 7jjdv.exe 2936 xrflxxl.exe 2928 bthnnn.exe 1424 thbhtb.exe 2732 9pjpv.exe 2688 5rllfff.exe 1600 hnnntn.exe 2900 vjpjv.exe 2892 vjdjj.exe 1736 rflflff.exe 2360 nhnnnt.exe 2896 vdvpj.exe 1572 pjpjd.exe 2712 rxlflxf.exe 1908 thnhhb.exe 3064 nthtnn.exe 3068 7jppv.exe 2100 rfrxfrf.exe 1848 nbnntt.exe 2208 tbnttb.exe 2140 djdpv.exe 780 5frxrlf.exe 3004 tnbhnn.exe 948 7bhhbt.exe 1764 3dppp.exe 2976 3lrlrlx.exe -
resource yara_rule behavioral1/memory/2012-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1536-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1252-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/832-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/832-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/344-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1064-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1928-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1840-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1424-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-382-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1600-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-408-0x0000000001C50000-0x0000000001C7A000-memory.dmp upx behavioral1/memory/1736-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-480-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-519-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-592-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-605-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-649-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-650-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-709-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2232-861-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-899-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2956-943-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-980-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2552-1006-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-1033-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-1118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-1140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-1173-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfxrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxllxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrrxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nnbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9flfxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxflfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9htnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrlrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2012 wrote to memory of 2072 2012 d98c43cbd709152f41b1875199f921814b22f77f13e2cfbfa7012a319bcd424e.exe 30 PID 2012 wrote to memory of 2072 2012 d98c43cbd709152f41b1875199f921814b22f77f13e2cfbfa7012a319bcd424e.exe 30 PID 2012 wrote to memory of 2072 2012 d98c43cbd709152f41b1875199f921814b22f77f13e2cfbfa7012a319bcd424e.exe 30 PID 2012 wrote to memory of 2072 2012 d98c43cbd709152f41b1875199f921814b22f77f13e2cfbfa7012a319bcd424e.exe 30 PID 2072 wrote to memory of 2692 2072 dpdjd.exe 31 PID 2072 wrote to memory of 2692 2072 dpdjd.exe 31 PID 2072 wrote to memory of 2692 2072 dpdjd.exe 31 PID 2072 wrote to memory of 2692 2072 dpdjd.exe 31 PID 2692 wrote to memory of 2084 2692 hhtthh.exe 32 PID 2692 wrote to memory of 2084 2692 hhtthh.exe 32 PID 2692 wrote to memory of 2084 2692 hhtthh.exe 32 PID 2692 wrote to memory of 2084 2692 hhtthh.exe 32 PID 2084 wrote to memory of 1964 2084 3lxflrf.exe 33 PID 2084 wrote to memory of 1964 2084 3lxflrf.exe 33 PID 2084 wrote to memory of 1964 2084 3lxflrf.exe 33 PID 2084 wrote to memory of 1964 2084 3lxflrf.exe 33 PID 1964 wrote to memory of 2808 1964 5bbbnn.exe 34 PID 1964 wrote to memory of 2808 1964 5bbbnn.exe 34 PID 1964 wrote to memory of 2808 1964 5bbbnn.exe 34 PID 1964 wrote to memory of 2808 1964 5bbbnn.exe 34 PID 2808 wrote to memory of 2740 2808 vjpjp.exe 35 PID 2808 wrote to memory of 2740 2808 vjpjp.exe 35 PID 2808 wrote to memory of 2740 2808 vjpjp.exe 35 PID 2808 wrote to memory of 2740 2808 vjpjp.exe 35 PID 2740 wrote to memory of 2728 2740 xlrlrlr.exe 36 PID 2740 wrote to memory of 2728 2740 xlrlrlr.exe 36 PID 2740 wrote to memory of 2728 2740 xlrlrlr.exe 36 PID 2740 wrote to memory of 2728 2740 xlrlrlr.exe 36 PID 2728 wrote to memory of 2632 2728 vjvvd.exe 37 PID 2728 wrote to memory of 2632 2728 vjvvd.exe 37 PID 2728 wrote to memory of 2632 2728 vjvvd.exe 37 PID 2728 wrote to memory of 2632 2728 vjvvd.exe 37 PID 2632 wrote to memory of 2668 2632 fxlflfl.exe 38 PID 2632 wrote to memory of 2668 2632 fxlflfl.exe 38 PID 2632 wrote to memory of 2668 2632 fxlflfl.exe 38 PID 2632 wrote to memory of 2668 2632 fxlflfl.exe 38 PID 2668 wrote to memory of 2664 2668 bthhnn.exe 39 PID 2668 wrote to memory of 2664 2668 bthhnn.exe 39 PID 2668 wrote to memory of 2664 2668 bthhnn.exe 39 PID 2668 wrote to memory of 2664 2668 bthhnn.exe 39 PID 2664 wrote to memory of 2060 2664 vjvpv.exe 40 PID 2664 wrote to memory of 2060 2664 vjvpv.exe 40 PID 2664 wrote to memory of 2060 2664 vjvpv.exe 40 PID 2664 wrote to memory of 2060 2664 vjvpv.exe 40 PID 2060 wrote to memory of 1536 2060 5httnh.exe 41 PID 2060 wrote to memory of 1536 2060 5httnh.exe 41 PID 2060 wrote to memory of 1536 2060 5httnh.exe 41 PID 2060 wrote to memory of 1536 2060 5httnh.exe 41 PID 1536 wrote to memory of 2952 1536 thnhnn.exe 42 PID 1536 wrote to memory of 2952 1536 thnhnn.exe 42 PID 1536 wrote to memory of 2952 1536 thnhnn.exe 42 PID 1536 wrote to memory of 2952 1536 thnhnn.exe 42 PID 2952 wrote to memory of 1252 2952 7rrrrlf.exe 43 PID 2952 wrote to memory of 1252 2952 7rrrrlf.exe 43 PID 2952 wrote to memory of 1252 2952 7rrrrlf.exe 43 PID 2952 wrote to memory of 1252 2952 7rrrrlf.exe 43 PID 1252 wrote to memory of 1468 1252 1pppv.exe 44 PID 1252 wrote to memory of 1468 1252 1pppv.exe 44 PID 1252 wrote to memory of 1468 1252 1pppv.exe 44 PID 1252 wrote to memory of 1468 1252 1pppv.exe 44 PID 1468 wrote to memory of 2712 1468 flxxxrx.exe 45 PID 1468 wrote to memory of 2712 1468 flxxxrx.exe 45 PID 1468 wrote to memory of 2712 1468 flxxxrx.exe 45 PID 1468 wrote to memory of 2712 1468 flxxxrx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\d98c43cbd709152f41b1875199f921814b22f77f13e2cfbfa7012a319bcd424e.exe"C:\Users\Admin\AppData\Local\Temp\d98c43cbd709152f41b1875199f921814b22f77f13e2cfbfa7012a319bcd424e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\dpdjd.exec:\dpdjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\hhtthh.exec:\hhtthh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\3lxflrf.exec:\3lxflrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\5bbbnn.exec:\5bbbnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\vjpjp.exec:\vjpjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\xlrlrlr.exec:\xlrlrlr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\vjvvd.exec:\vjvvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\fxlflfl.exec:\fxlflfl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\bthhnn.exec:\bthhnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\vjvpv.exec:\vjvpv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\5httnh.exec:\5httnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\thnhnn.exec:\thnhnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\7rrrrlf.exec:\7rrrrlf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\1pppv.exec:\1pppv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\flxxxrx.exec:\flxxxrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
\??\c:\nhbntt.exec:\nhbntt.exe17⤵
- Executes dropped EXE
PID:2712 -
\??\c:\3xlflll.exec:\3xlflll.exe18⤵
- Executes dropped EXE
PID:832 -
\??\c:\1nthbt.exec:\1nthbt.exe19⤵
- Executes dropped EXE
PID:1904 -
\??\c:\dpddv.exec:\dpddv.exe20⤵
- Executes dropped EXE
PID:2156 -
\??\c:\llxlrxl.exec:\llxlrxl.exe21⤵
- Executes dropped EXE
PID:1044 -
\??\c:\thbbhh.exec:\thbbhh.exe22⤵
- Executes dropped EXE
PID:344 -
\??\c:\pjddv.exec:\pjddv.exe23⤵
- Executes dropped EXE
PID:780 -
\??\c:\hthhhb.exec:\hthhhb.exe24⤵
- Executes dropped EXE
PID:1064 -
\??\c:\9bnnhh.exec:\9bnnhh.exe25⤵
- Executes dropped EXE
PID:2800 -
\??\c:\ffrlxfr.exec:\ffrlxfr.exe26⤵
- Executes dropped EXE
PID:1148 -
\??\c:\5bnttb.exec:\5bnttb.exe27⤵
- Executes dropped EXE
PID:2396 -
\??\c:\fxfxxll.exec:\fxfxxll.exe28⤵
- Executes dropped EXE
PID:564 -
\??\c:\bhnntt.exec:\bhnntt.exe29⤵
- Executes dropped EXE
PID:1928 -
\??\c:\vjvvv.exec:\vjvvv.exe30⤵
- Executes dropped EXE
PID:1840 -
\??\c:\rxrrrxr.exec:\rxrrrxr.exe31⤵
- Executes dropped EXE
PID:3048 -
\??\c:\hbhbbt.exec:\hbhbbt.exe32⤵
- Executes dropped EXE
PID:1584 -
\??\c:\pvppv.exec:\pvppv.exe33⤵
- Executes dropped EXE
PID:2044 -
\??\c:\bnbbhh.exec:\bnbbhh.exe34⤵
- Executes dropped EXE
PID:2404 -
\??\c:\dpdjp.exec:\dpdjp.exe35⤵
- Executes dropped EXE
PID:2796 -
\??\c:\dpddv.exec:\dpddv.exe36⤵
- Executes dropped EXE
PID:2500 -
\??\c:\xrfxfxf.exec:\xrfxfxf.exe37⤵
- Executes dropped EXE
PID:264 -
\??\c:\7bnntt.exec:\7bnntt.exe38⤵
- Executes dropped EXE
PID:2764 -
\??\c:\nbnntt.exec:\nbnntt.exe39⤵
- Executes dropped EXE
PID:2868 -
\??\c:\7jjdv.exec:\7jjdv.exe40⤵
- Executes dropped EXE
PID:2880 -
\??\c:\xrflxxl.exec:\xrflxxl.exe41⤵
- Executes dropped EXE
PID:2936 -
\??\c:\bthnnn.exec:\bthnnn.exe42⤵
- Executes dropped EXE
PID:2928 -
\??\c:\thbhtb.exec:\thbhtb.exe43⤵
- Executes dropped EXE
PID:1424 -
\??\c:\9pjpv.exec:\9pjpv.exe44⤵
- Executes dropped EXE
PID:2732 -
\??\c:\5rllfff.exec:\5rllfff.exe45⤵
- Executes dropped EXE
PID:2688 -
\??\c:\hnnntn.exec:\hnnntn.exe46⤵
- Executes dropped EXE
PID:1600 -
\??\c:\vjpjv.exec:\vjpjv.exe47⤵
- Executes dropped EXE
PID:2900 -
\??\c:\vjdjj.exec:\vjdjj.exe48⤵
- Executes dropped EXE
PID:2892 -
\??\c:\rflflff.exec:\rflflff.exe49⤵
- Executes dropped EXE
PID:1736 -
\??\c:\nhnnnt.exec:\nhnnnt.exe50⤵
- Executes dropped EXE
PID:2360 -
\??\c:\vdvpj.exec:\vdvpj.exe51⤵
- Executes dropped EXE
PID:2896 -
\??\c:\pjpjd.exec:\pjpjd.exe52⤵
- Executes dropped EXE
PID:1572 -
\??\c:\rxlflxf.exec:\rxlflxf.exe53⤵
- Executes dropped EXE
PID:2712 -
\??\c:\thnhhb.exec:\thnhhb.exe54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1908 -
\??\c:\nthtnn.exec:\nthtnn.exe55⤵
- Executes dropped EXE
PID:3064 -
\??\c:\7jppv.exec:\7jppv.exe56⤵
- Executes dropped EXE
PID:3068 -
\??\c:\rfrxfrf.exec:\rfrxfrf.exe57⤵
- Executes dropped EXE
PID:2100 -
\??\c:\nbnntt.exec:\nbnntt.exe58⤵
- Executes dropped EXE
PID:1848 -
\??\c:\tbnttb.exec:\tbnttb.exe59⤵
- Executes dropped EXE
PID:2208 -
\??\c:\djdpv.exec:\djdpv.exe60⤵
- Executes dropped EXE
PID:2140 -
\??\c:\5frxrlf.exec:\5frxrlf.exe61⤵
- Executes dropped EXE
PID:780 -
\??\c:\tnbhnn.exec:\tnbhnn.exe62⤵
- Executes dropped EXE
PID:3004 -
\??\c:\7bhhbt.exec:\7bhhbt.exe63⤵
- Executes dropped EXE
PID:948 -
\??\c:\3dppp.exec:\3dppp.exe64⤵
- Executes dropped EXE
PID:1764 -
\??\c:\3lrlrlx.exec:\3lrlrlx.exe65⤵
- Executes dropped EXE
PID:2976 -
\??\c:\rfllllf.exec:\rfllllf.exe66⤵PID:2032
-
\??\c:\hbbtnn.exec:\hbbtnn.exe67⤵PID:2380
-
\??\c:\vdjjd.exec:\vdjjd.exe68⤵PID:1272
-
\??\c:\jddvp.exec:\jddvp.exe69⤵PID:876
-
\??\c:\rllflxx.exec:\rllflxx.exe70⤵PID:1840
-
\??\c:\btbnhh.exec:\btbnhh.exe71⤵PID:2408
-
\??\c:\nthtbt.exec:\nthtbt.exe72⤵PID:2132
-
\??\c:\pdjvd.exec:\pdjvd.exe73⤵PID:1584
-
\??\c:\vjvdp.exec:\vjvdp.exe74⤵PID:2356
-
\??\c:\lxfxlff.exec:\lxfxlff.exe75⤵PID:1680
-
\??\c:\thnhnh.exec:\thnhnh.exe76⤵PID:1960
-
\??\c:\3hnnbt.exec:\3hnnbt.exe77⤵PID:2256
-
\??\c:\vjvvv.exec:\vjvvv.exe78⤵PID:2824
-
\??\c:\xlrrxrr.exec:\xlrrxrr.exe79⤵PID:2808
-
\??\c:\bnbhhb.exec:\bnbhhb.exe80⤵PID:2812
-
\??\c:\hbnhtn.exec:\hbnhtn.exe81⤵PID:2804
-
\??\c:\dpddd.exec:\dpddd.exe82⤵PID:2840
-
\??\c:\frxxrrf.exec:\frxxrrf.exe83⤵PID:316
-
\??\c:\5thhhh.exec:\5thhhh.exe84⤵PID:2632
-
\??\c:\nbhbhb.exec:\nbhbhb.exe85⤵PID:2184
-
\??\c:\jvdpp.exec:\jvdpp.exe86⤵PID:2200
-
\??\c:\lxxlfrx.exec:\lxxlfrx.exe87⤵PID:2328
-
\??\c:\5xrrxrx.exec:\5xrrxrx.exe88⤵PID:1948
-
\??\c:\3htnnn.exec:\3htnnn.exe89⤵PID:672
-
\??\c:\vpvpv.exec:\vpvpv.exe90⤵PID:1080
-
\??\c:\rfllfxx.exec:\rfllfxx.exe91⤵PID:1328
-
\??\c:\rlfllfl.exec:\rlfllfl.exe92⤵PID:1072
-
\??\c:\bnttnn.exec:\bnttnn.exe93⤵PID:2596
-
\??\c:\bntnnh.exec:\bntnnh.exe94⤵PID:1592
-
\??\c:\vvjjp.exec:\vvjjp.exe95⤵PID:1652
-
\??\c:\flxxxxf.exec:\flxxxxf.exe96⤵PID:1620
-
\??\c:\fxllrrx.exec:\fxllrrx.exe97⤵PID:3056
-
\??\c:\htnhhb.exec:\htnhhb.exe98⤵PID:2128
-
\??\c:\vjpdv.exec:\vjpdv.exe99⤵PID:2268
-
\??\c:\fxlfllr.exec:\fxlfllr.exe100⤵PID:2100
-
\??\c:\rlxxxrr.exec:\rlxxxrr.exe101⤵PID:344
-
\??\c:\7tbbnn.exec:\7tbbnn.exe102⤵PID:444
-
\??\c:\9dpjd.exec:\9dpjd.exe103⤵PID:2140
-
\??\c:\9jjdv.exec:\9jjdv.exe104⤵PID:780
-
\??\c:\lxfxfxf.exec:\lxfxfxf.exe105⤵PID:2244
-
\??\c:\thnnhh.exec:\thnnhh.exe106⤵PID:948
-
\??\c:\3hnnnh.exec:\3hnnnh.exe107⤵PID:2280
-
\??\c:\pjdjv.exec:\pjdjv.exe108⤵PID:2976
-
\??\c:\pdpjp.exec:\pdpjp.exe109⤵PID:564
-
\??\c:\9xxfxrr.exec:\9xxfxrr.exe110⤵PID:1796
-
\??\c:\bntnnn.exec:\bntnnn.exe111⤵
- System Location Discovery: System Language Discovery
PID:1708 -
\??\c:\5htnnn.exec:\5htnnn.exe112⤵PID:2296
-
\??\c:\dvppv.exec:\dvppv.exe113⤵PID:1840
-
\??\c:\5jvpp.exec:\5jvpp.exe114⤵PID:1720
-
\??\c:\xrrfxrr.exec:\xrrfxrr.exe115⤵PID:2132
-
\??\c:\htbttn.exec:\htbttn.exe116⤵PID:2972
-
\??\c:\bnbnnh.exec:\bnbnnh.exe117⤵PID:2356
-
\??\c:\3jvvd.exec:\3jvvd.exe118⤵PID:2692
-
\??\c:\lxfxxrr.exec:\lxfxxrr.exe119⤵PID:1960
-
\??\c:\lfrfrff.exec:\lfrfrff.exe120⤵PID:2232
-
\??\c:\nbbbhb.exec:\nbbbhb.exe121⤵PID:2824
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-