Analysis
-
max time kernel
120s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 19:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
df5723e1c7644fc99bc41286bd1cafb89a6b34f964b1c54948928fa498bacb2b.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
df5723e1c7644fc99bc41286bd1cafb89a6b34f964b1c54948928fa498bacb2b.exe
-
Size
346KB
-
MD5
0718da64b1efc2978471ad77f81d59b3
-
SHA1
30786507d1451ed793afb07311e9ed2503018220
-
SHA256
df5723e1c7644fc99bc41286bd1cafb89a6b34f964b1c54948928fa498bacb2b
-
SHA512
6e38409431bd2ccb491d90fbc2a742885b3bff99038ebd785040500bf7d58a512f0cff300b04687e261b5c0fd9557780940f913e55569bdd8021064231a2c098
-
SSDEEP
6144:Xcm7ImGddXgYW5fNZWB5hFfci3Add4kGYAO:l7TcbWXZshJX2VGdO
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral1/memory/2528-7-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1888-12-0x00000000003C0000-0x00000000003E8000-memory.dmp family_blackmoon behavioral1/memory/2796-36-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/624-26-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2796-31-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1888-17-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2716-45-0x00000000002B0000-0x00000000002D8000-memory.dmp family_blackmoon behavioral1/memory/2716-46-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2876-55-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2992-60-0x00000000002A0000-0x00000000002C8000-memory.dmp family_blackmoon behavioral1/memory/2992-65-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2636-76-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2652-92-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2228-102-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1628-113-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2956-129-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2956-131-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1556-141-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1432-150-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1432-152-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2924-163-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2924-161-0x00000000001B0000-0x00000000001D8000-memory.dmp family_blackmoon behavioral1/memory/2972-172-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1760-177-0x00000000003A0000-0x00000000003C8000-memory.dmp family_blackmoon behavioral1/memory/3064-191-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2188-196-0x0000000000430000-0x0000000000458000-memory.dmp family_blackmoon behavioral1/memory/2188-201-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2152-211-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2076-216-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1304-234-0x00000000002C0000-0x00000000002E8000-memory.dmp family_blackmoon behavioral1/memory/1436-241-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2232-258-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1616-320-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2844-327-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2716-340-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2616-346-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2828-354-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2992-362-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2340-472-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2340-473-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2348-480-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1996-514-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2692-547-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/3044-566-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/340-610-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/820-677-0x00000000003C0000-0x00000000003E8000-memory.dmp family_blackmoon behavioral1/memory/2340-750-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2076-775-0x00000000001B0000-0x00000000001D8000-memory.dmp family_blackmoon behavioral1/memory/1304-790-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1304-789-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1304-788-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1620-853-0x00000000003C0000-0x00000000003E8000-memory.dmp family_blackmoon behavioral1/memory/2216-878-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2120-929-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1964-991-0x00000000002B0000-0x00000000002D8000-memory.dmp family_blackmoon behavioral1/memory/2300-1004-0x0000000000230000-0x0000000000258000-memory.dmp family_blackmoon behavioral1/memory/2288-1030-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/324-1080-0x00000000003C0000-0x00000000003E8000-memory.dmp family_blackmoon behavioral1/memory/2220-1283-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1952-1282-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2220-1280-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/3004-1307-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1888 vpdvd.exe 624 5fffllf.exe 2796 hbhhnb.exe 2716 vpdpv.exe 2876 5nnnhh.exe 2992 pdjpj.exe 2636 1lffrrf.exe 2724 5djjj.exe 2652 rllfrfx.exe 2228 pvpdv.exe 1628 rffrxrf.exe 1112 jpjvp.exe 2956 ffrffrl.exe 1556 nnhnhn.exe 1432 jvvpj.exe 2924 ttnhhn.exe 2972 ffxlxrl.exe 1760 3hbhtt.exe 3064 pppjv.exe 2188 bhbtnt.exe 2152 nnttnn.exe 2076 7rrfxfr.exe 2460 1hnbbn.exe 1304 rfxlfrf.exe 1436 fxllxfr.exe 2232 ddvpj.exe 1364 7lxflxl.exe 2692 9btntt.exe 876 dppdv.exe 872 1nhnnt.exe 2528 nhhnbn.exe 2540 rxrxllx.exe 1912 3thhtb.exe 1616 ppvjj.exe 2844 3vppp.exe 540 xrllxxl.exe 2716 nhthth.exe 2616 1nnbht.exe 2828 jvppp.exe 2992 xrxrffr.exe 2880 xxlxlxf.exe 2676 7btbnn.exe 2612 vvpvp.exe 2640 5dvdv.exe 1808 lfxlffl.exe 820 lfrfrrf.exe 2960 bbnbnb.exe 748 ddpvp.exe 744 vvpjp.exe 1340 rrlxlfr.exe 2364 3tnhth.exe 2680 hhbhtb.exe 1084 pjdvd.exe 1220 5vjdj.exe 1488 xxxlxlr.exe 2348 tththh.exe 2112 1tbhht.exe 2340 pjdvv.exe 2136 1pjjj.exe 2108 rlffxlf.exe 2328 3httth.exe 1152 vvppd.exe 1848 jddpj.exe 1996 llfffrx.exe -
resource yara_rule behavioral1/memory/2528-7-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2796-36-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/624-26-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1888-17-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2716-46-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2876-55-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2992-65-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2636-70-0x0000000000230000-0x0000000000258000-memory.dmp upx behavioral1/memory/2724-77-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2636-76-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2228-102-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1628-104-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1628-113-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1556-132-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2956-131-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1556-141-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2924-153-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1432-152-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2924-163-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1760-173-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2972-172-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2188-192-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/3064-191-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2188-201-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2076-212-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2152-211-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2076-216-0x0000000000220000-0x0000000000248000-memory.dmp upx behavioral1/memory/1304-230-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1436-241-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2232-249-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2232-258-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1616-313-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1616-320-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2844-327-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2716-340-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2828-354-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2992-362-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2340-473-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2328-494-0x00000000003A0000-0x00000000003C8000-memory.dmp upx behavioral1/memory/2036-533-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2692-547-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/3044-566-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/340-610-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2340-750-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1304-790-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1632-834-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2816-891-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2120-929-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/324-1080-0x00000000003C0000-0x00000000003E8000-memory.dmp upx behavioral1/memory/1364-1087-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2900-1242-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2244-1270-0x0000000000220000-0x0000000000248000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnntnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3fxxxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxllllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrffrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2528 wrote to memory of 1888 2528 df5723e1c7644fc99bc41286bd1cafb89a6b34f964b1c54948928fa498bacb2b.exe 30 PID 2528 wrote to memory of 1888 2528 df5723e1c7644fc99bc41286bd1cafb89a6b34f964b1c54948928fa498bacb2b.exe 30 PID 2528 wrote to memory of 1888 2528 df5723e1c7644fc99bc41286bd1cafb89a6b34f964b1c54948928fa498bacb2b.exe 30 PID 2528 wrote to memory of 1888 2528 df5723e1c7644fc99bc41286bd1cafb89a6b34f964b1c54948928fa498bacb2b.exe 30 PID 1888 wrote to memory of 624 1888 vpdvd.exe 31 PID 1888 wrote to memory of 624 1888 vpdvd.exe 31 PID 1888 wrote to memory of 624 1888 vpdvd.exe 31 PID 1888 wrote to memory of 624 1888 vpdvd.exe 31 PID 624 wrote to memory of 2796 624 5fffllf.exe 32 PID 624 wrote to memory of 2796 624 5fffllf.exe 32 PID 624 wrote to memory of 2796 624 5fffllf.exe 32 PID 624 wrote to memory of 2796 624 5fffllf.exe 32 PID 2796 wrote to memory of 2716 2796 hbhhnb.exe 33 PID 2796 wrote to memory of 2716 2796 hbhhnb.exe 33 PID 2796 wrote to memory of 2716 2796 hbhhnb.exe 33 PID 2796 wrote to memory of 2716 2796 hbhhnb.exe 33 PID 2716 wrote to memory of 2876 2716 vpdpv.exe 34 PID 2716 wrote to memory of 2876 2716 vpdpv.exe 34 PID 2716 wrote to memory of 2876 2716 vpdpv.exe 34 PID 2716 wrote to memory of 2876 2716 vpdpv.exe 34 PID 2876 wrote to memory of 2992 2876 5nnnhh.exe 35 PID 2876 wrote to memory of 2992 2876 5nnnhh.exe 35 PID 2876 wrote to memory of 2992 2876 5nnnhh.exe 35 PID 2876 wrote to memory of 2992 2876 5nnnhh.exe 35 PID 2992 wrote to memory of 2636 2992 pdjpj.exe 36 PID 2992 wrote to memory of 2636 2992 pdjpj.exe 36 PID 2992 wrote to memory of 2636 2992 pdjpj.exe 36 PID 2992 wrote to memory of 2636 2992 pdjpj.exe 36 PID 2636 wrote to memory of 2724 2636 1lffrrf.exe 37 PID 2636 wrote to memory of 2724 2636 1lffrrf.exe 37 PID 2636 wrote to memory of 2724 2636 1lffrrf.exe 37 PID 2636 wrote to memory of 2724 2636 1lffrrf.exe 37 PID 2724 wrote to memory of 2652 2724 5djjj.exe 38 PID 2724 wrote to memory of 2652 2724 5djjj.exe 38 PID 2724 wrote to memory of 2652 2724 5djjj.exe 38 PID 2724 wrote to memory of 2652 2724 5djjj.exe 38 PID 2652 wrote to memory of 2228 2652 rllfrfx.exe 39 PID 2652 wrote to memory of 2228 2652 rllfrfx.exe 39 PID 2652 wrote to memory of 2228 2652 rllfrfx.exe 39 PID 2652 wrote to memory of 2228 2652 rllfrfx.exe 39 PID 2228 wrote to memory of 1628 2228 pvpdv.exe 40 PID 2228 wrote to memory of 1628 2228 pvpdv.exe 40 PID 2228 wrote to memory of 1628 2228 pvpdv.exe 40 PID 2228 wrote to memory of 1628 2228 pvpdv.exe 40 PID 1628 wrote to memory of 1112 1628 rffrxrf.exe 41 PID 1628 wrote to memory of 1112 1628 rffrxrf.exe 41 PID 1628 wrote to memory of 1112 1628 rffrxrf.exe 41 PID 1628 wrote to memory of 1112 1628 rffrxrf.exe 41 PID 1112 wrote to memory of 2956 1112 jpjvp.exe 42 PID 1112 wrote to memory of 2956 1112 jpjvp.exe 42 PID 1112 wrote to memory of 2956 1112 jpjvp.exe 42 PID 1112 wrote to memory of 2956 1112 jpjvp.exe 42 PID 2956 wrote to memory of 1556 2956 ffrffrl.exe 43 PID 2956 wrote to memory of 1556 2956 ffrffrl.exe 43 PID 2956 wrote to memory of 1556 2956 ffrffrl.exe 43 PID 2956 wrote to memory of 1556 2956 ffrffrl.exe 43 PID 1556 wrote to memory of 1432 1556 nnhnhn.exe 44 PID 1556 wrote to memory of 1432 1556 nnhnhn.exe 44 PID 1556 wrote to memory of 1432 1556 nnhnhn.exe 44 PID 1556 wrote to memory of 1432 1556 nnhnhn.exe 44 PID 1432 wrote to memory of 2924 1432 jvvpj.exe 45 PID 1432 wrote to memory of 2924 1432 jvvpj.exe 45 PID 1432 wrote to memory of 2924 1432 jvvpj.exe 45 PID 1432 wrote to memory of 2924 1432 jvvpj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\df5723e1c7644fc99bc41286bd1cafb89a6b34f964b1c54948928fa498bacb2b.exe"C:\Users\Admin\AppData\Local\Temp\df5723e1c7644fc99bc41286bd1cafb89a6b34f964b1c54948928fa498bacb2b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\vpdvd.exec:\vpdvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
\??\c:\5fffllf.exec:\5fffllf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\hbhhnb.exec:\hbhhnb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\vpdpv.exec:\vpdpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\5nnnhh.exec:\5nnnhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\pdjpj.exec:\pdjpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\1lffrrf.exec:\1lffrrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\5djjj.exec:\5djjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\rllfrfx.exec:\rllfrfx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\pvpdv.exec:\pvpdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\rffrxrf.exec:\rffrxrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\jpjvp.exec:\jpjvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
\??\c:\ffrffrl.exec:\ffrffrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\nnhnhn.exec:\nnhnhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
\??\c:\jvvpj.exec:\jvvpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\ttnhhn.exec:\ttnhhn.exe17⤵
- Executes dropped EXE
PID:2924 -
\??\c:\ffxlxrl.exec:\ffxlxrl.exe18⤵
- Executes dropped EXE
PID:2972 -
\??\c:\3hbhtt.exec:\3hbhtt.exe19⤵
- Executes dropped EXE
PID:1760 -
\??\c:\pppjv.exec:\pppjv.exe20⤵
- Executes dropped EXE
PID:3064 -
\??\c:\bhbtnt.exec:\bhbtnt.exe21⤵
- Executes dropped EXE
PID:2188 -
\??\c:\nnttnn.exec:\nnttnn.exe22⤵
- Executes dropped EXE
PID:2152 -
\??\c:\7rrfxfr.exec:\7rrfxfr.exe23⤵
- Executes dropped EXE
PID:2076 -
\??\c:\1hnbbn.exec:\1hnbbn.exe24⤵
- Executes dropped EXE
PID:2460 -
\??\c:\rfxlfrf.exec:\rfxlfrf.exe25⤵
- Executes dropped EXE
PID:1304 -
\??\c:\fxllxfr.exec:\fxllxfr.exe26⤵
- Executes dropped EXE
PID:1436 -
\??\c:\ddvpj.exec:\ddvpj.exe27⤵
- Executes dropped EXE
PID:2232 -
\??\c:\7lxflxl.exec:\7lxflxl.exe28⤵
- Executes dropped EXE
PID:1364 -
\??\c:\9btntt.exec:\9btntt.exe29⤵
- Executes dropped EXE
PID:2692 -
\??\c:\dppdv.exec:\dppdv.exe30⤵
- Executes dropped EXE
PID:876 -
\??\c:\1nhnnt.exec:\1nhnnt.exe31⤵
- Executes dropped EXE
PID:872 -
\??\c:\nhhnbn.exec:\nhhnbn.exe32⤵
- Executes dropped EXE
PID:2528 -
\??\c:\rxrxllx.exec:\rxrxllx.exe33⤵
- Executes dropped EXE
PID:2540 -
\??\c:\3thhtb.exec:\3thhtb.exe34⤵
- Executes dropped EXE
PID:1912 -
\??\c:\ppvjj.exec:\ppvjj.exe35⤵
- Executes dropped EXE
PID:1616 -
\??\c:\3vppp.exec:\3vppp.exe36⤵
- Executes dropped EXE
PID:2844 -
\??\c:\xrllxxl.exec:\xrllxxl.exe37⤵
- Executes dropped EXE
PID:540 -
\??\c:\nhthth.exec:\nhthth.exe38⤵
- Executes dropped EXE
PID:2716 -
\??\c:\1nnbht.exec:\1nnbht.exe39⤵
- Executes dropped EXE
PID:2616 -
\??\c:\jvppp.exec:\jvppp.exe40⤵
- Executes dropped EXE
PID:2828 -
\??\c:\xrxrffr.exec:\xrxrffr.exe41⤵
- Executes dropped EXE
PID:2992 -
\??\c:\xxlxlxf.exec:\xxlxlxf.exe42⤵
- Executes dropped EXE
PID:2880 -
\??\c:\7btbnn.exec:\7btbnn.exe43⤵
- Executes dropped EXE
PID:2676 -
\??\c:\vvpvp.exec:\vvpvp.exe44⤵
- Executes dropped EXE
PID:2612 -
\??\c:\5dvdv.exec:\5dvdv.exe45⤵
- Executes dropped EXE
PID:2640 -
\??\c:\lfxlffl.exec:\lfxlffl.exe46⤵
- Executes dropped EXE
PID:1808 -
\??\c:\lfrfrrf.exec:\lfrfrrf.exe47⤵
- Executes dropped EXE
PID:820 -
\??\c:\bbnbnb.exec:\bbnbnb.exe48⤵
- Executes dropped EXE
PID:2960 -
\??\c:\ddpvp.exec:\ddpvp.exe49⤵
- Executes dropped EXE
PID:748 -
\??\c:\vvpjp.exec:\vvpjp.exe50⤵
- Executes dropped EXE
PID:744 -
\??\c:\rrlxlfr.exec:\rrlxlfr.exe51⤵
- Executes dropped EXE
PID:1340 -
\??\c:\3tnhth.exec:\3tnhth.exe52⤵
- Executes dropped EXE
PID:2364 -
\??\c:\hhbhtb.exec:\hhbhtb.exe53⤵
- Executes dropped EXE
PID:2680 -
\??\c:\pjdvd.exec:\pjdvd.exe54⤵
- Executes dropped EXE
PID:1084 -
\??\c:\5vjdj.exec:\5vjdj.exe55⤵
- Executes dropped EXE
PID:1220 -
\??\c:\xxxlxlr.exec:\xxxlxlr.exe56⤵
- Executes dropped EXE
PID:1488 -
\??\c:\tththh.exec:\tththh.exe57⤵
- Executes dropped EXE
PID:2348 -
\??\c:\1tbhht.exec:\1tbhht.exe58⤵
- Executes dropped EXE
PID:2112 -
\??\c:\pjdvv.exec:\pjdvv.exe59⤵
- Executes dropped EXE
PID:2340 -
\??\c:\1pjjj.exec:\1pjjj.exe60⤵
- Executes dropped EXE
PID:2136 -
\??\c:\rlffxlf.exec:\rlffxlf.exe61⤵
- Executes dropped EXE
PID:2108 -
\??\c:\3httth.exec:\3httth.exe62⤵
- Executes dropped EXE
PID:2328 -
\??\c:\vvppd.exec:\vvppd.exe63⤵
- Executes dropped EXE
PID:1152 -
\??\c:\jddpj.exec:\jddpj.exe64⤵
- Executes dropped EXE
PID:1848 -
\??\c:\llfffrx.exec:\llfffrx.exe65⤵
- Executes dropped EXE
PID:1996 -
\??\c:\5btnhh.exec:\5btnhh.exe66⤵PID:1812
-
\??\c:\ddpvv.exec:\ddpvv.exe67⤵PID:324
-
\??\c:\pvvjv.exec:\pvvjv.exe68⤵PID:1452
-
\??\c:\flfrxfr.exec:\flfrxfr.exe69⤵PID:2036
-
\??\c:\ffflfrx.exec:\ffflfrx.exe70⤵PID:1364
-
\??\c:\ttntnt.exec:\ttntnt.exe71⤵PID:2692
-
\??\c:\hbthbh.exec:\hbthbh.exe72⤵PID:2548
-
\??\c:\dddjv.exec:\dddjv.exe73⤵PID:3044
-
\??\c:\xfxrfll.exec:\xfxrfll.exe74⤵PID:1076
-
\??\c:\nhtbnt.exec:\nhtbnt.exe75⤵PID:2160
-
\??\c:\1nnhnn.exec:\1nnhnn.exe76⤵PID:2452
-
\??\c:\jddvp.exec:\jddvp.exe77⤵PID:2464
-
\??\c:\vvpvj.exec:\vvpvj.exe78⤵PID:2760
-
\??\c:\1rflxll.exec:\1rflxll.exe79⤵PID:2840
-
\??\c:\ttntht.exec:\ttntht.exe80⤵PID:340
-
\??\c:\btbhht.exec:\btbhht.exe81⤵PID:2768
-
\??\c:\pvpjd.exec:\pvpjd.exe82⤵PID:2644
-
\??\c:\rlxxfxr.exec:\rlxxfxr.exe83⤵PID:2788
-
\??\c:\ffrflxf.exec:\ffrflxf.exe84⤵PID:2824
-
\??\c:\bthnhn.exec:\bthnhn.exe85⤵PID:2636
-
\??\c:\9bttnt.exec:\9bttnt.exe86⤵PID:2880
-
\??\c:\pjdpd.exec:\pjdpd.exe87⤵PID:2676
-
\??\c:\fxrxffr.exec:\fxrxffr.exe88⤵PID:2612
-
\??\c:\9ffxrxf.exec:\9ffxrxf.exe89⤵PID:1972
-
\??\c:\bthntb.exec:\bthntb.exe90⤵PID:1808
-
\??\c:\5jpvd.exec:\5jpvd.exe91⤵PID:820
-
\??\c:\vpdjp.exec:\vpdjp.exe92⤵PID:2960
-
\??\c:\ffxfflx.exec:\ffxfflx.exe93⤵PID:2940
-
\??\c:\9rrxllx.exec:\9rrxllx.exe94⤵PID:1804
-
\??\c:\1hhnbh.exec:\1hhnbh.exe95⤵PID:1300
-
\??\c:\jjjvp.exec:\jjjvp.exe96⤵PID:2932
-
\??\c:\dddpj.exec:\dddpj.exe97⤵PID:1952
-
\??\c:\rrlrxfr.exec:\rrlrxfr.exe98⤵PID:1084
-
\??\c:\bttnhh.exec:\bttnhh.exe99⤵PID:2576
-
\??\c:\ttnbnt.exec:\ttnbnt.exe100⤵PID:1668
-
\??\c:\dvpdp.exec:\dvpdp.exe101⤵
- System Location Discovery: System Language Discovery
PID:1760 -
\??\c:\djjvj.exec:\djjvj.exe102⤵PID:2112
-
\??\c:\rlflrfl.exec:\rlflrfl.exe103⤵PID:2340
-
\??\c:\hhtthh.exec:\hhtthh.exe104⤵PID:2192
-
\??\c:\tthhtt.exec:\tthhtt.exe105⤵PID:2152
-
\??\c:\ddvdj.exec:\ddvdj.exe106⤵PID:3004
-
\??\c:\xxxxflr.exec:\xxxxflr.exe107⤵PID:2076
-
\??\c:\7fxflxf.exec:\7fxflxf.exe108⤵PID:2472
-
\??\c:\5hthnb.exec:\5hthnb.exe109⤵PID:1304
-
\??\c:\1nhntb.exec:\1nhntb.exe110⤵PID:2504
-
\??\c:\rrrfllr.exec:\rrrfllr.exe111⤵PID:1880
-
\??\c:\rlxfrlx.exec:\rlxfrlx.exe112⤵PID:2336
-
\??\c:\hhbnnt.exec:\hhbnnt.exe113⤵PID:2896
-
\??\c:\1nnbnn.exec:\1nnbnn.exe114⤵PID:2496
-
\??\c:\vvpvv.exec:\vvpvv.exe115⤵PID:2516
-
\??\c:\lfrlrxr.exec:\lfrlrxr.exe116⤵PID:2088
-
\??\c:\xrlfxfr.exec:\xrlfxfr.exe117⤵PID:1632
-
\??\c:\9tttnb.exec:\9tttnb.exe118⤵PID:1232
-
\??\c:\tntntt.exec:\tntntt.exe119⤵PID:1620
-
\??\c:\9dpvd.exec:\9dpvd.exe120⤵PID:1536
-
\??\c:\ffxxfrx.exec:\ffxxfrx.exe121⤵PID:2752
-
\??\c:\nhbnbb.exec:\nhbnbb.exe122⤵PID:2720
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-