Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 18:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
64fef5bf390975f3d6023bef1427cf354645a16010f12d0bb9222f7b50b97c7c.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
120 seconds
General
-
Target
64fef5bf390975f3d6023bef1427cf354645a16010f12d0bb9222f7b50b97c7c.exe
-
Size
453KB
-
MD5
df2cf06e57c16f7af9c8c7924a9916ef
-
SHA1
cad7859621cabac31e7d83a62a921d898d1482cf
-
SHA256
64fef5bf390975f3d6023bef1427cf354645a16010f12d0bb9222f7b50b97c7c
-
SHA512
35e3cbfd2f521438225a6e60e88cea3bd9929091c69592c6439b76abeefb31a3b708da9fb9371bea115154bac7ea3c6a414773fbea85962bc3be965bd508fadf
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeo:q7Tc2NYHUrAwfMp3CDo
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 55 IoCs
resource yara_rule behavioral1/memory/2120-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1516-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-103-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2204-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1076-133-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2988-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2160-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2428-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2156-188-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1028-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/744-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2028-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1700-231-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2232-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3028-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2276-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1572-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2452-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-349-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2704-369-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2016-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1708-412-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1076-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-463-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1900-471-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/496-472-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1864-499-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1864-500-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1780-501-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1780-508-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2968-568-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2120-567-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1296-575-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2544-608-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1912-662-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-668-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2860-670-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1680-671-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-712-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1536-774-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2596-781-0x0000000000280000-0x00000000002AA000-memory.dmp family_blackmoon behavioral1/memory/1996-787-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/2276-827-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2056-894-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1516-920-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2852-971-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1700-1047-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2796 dppdp.exe 2468 vjjvv.exe 2128 tnhntb.exe 2680 hnthht.exe 2684 rlrxlxf.exe 2772 1dvvd.exe 2828 tnthnn.exe 1516 3jvdv.exe 2588 bththh.exe 2204 djpdp.exe 380 hbbbbt.exe 2872 7lrlrxx.exe 1076 5vpjp.exe 2376 vvdjj.exe 536 jjvjv.exe 2988 5rlrfrx.exe 2160 pppvj.exe 2428 bbnttb.exe 2156 1fxflrx.exe 1028 hnbhht.exe 744 llxfrxl.exe 1804 jjppv.exe 2028 xxrlfrl.exe 1700 7thnth.exe 1640 rrflxxf.exe 2232 jpjjv.exe 3028 9rlrxfr.exe 1160 ntntbh.exe 2276 5lxlllx.exe 1572 jdvvv.exe 2908 lrxfrxf.exe 1684 bbhthn.exe 2452 lffxfxx.exe 1168 btnthn.exe 2196 1jdjd.exe 2128 5dvdd.exe 2740 fxflrrx.exe 2056 9bthtb.exe 2812 dpdvp.exe 2764 ddpdj.exe 2824 fflfllr.exe 2704 tbtbnt.exe 2444 pvjvj.exe 2580 pdvdp.exe 1676 fflflfl.exe 1436 nnhtht.exe 468 hhhbbb.exe 2016 vvvvj.exe 1708 xxlrrll.exe 1076 7bnbth.exe 2852 tttbnh.exe 1856 vjvdj.exe 2888 ffffxff.exe 872 flflxff.exe 2176 hbnbhh.exe 2944 ddvvv.exe 2224 pjvvd.exe 1900 rlxfrxr.exe 496 bttbnn.exe 1608 djvvj.exe 1980 rxxfffx.exe 1864 frlrfrr.exe 1780 bnhnbn.exe 1788 jvvvv.exe -
resource yara_rule behavioral1/memory/2120-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1516-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1028-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/744-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1572-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1076-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/496-472-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1780-501-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-548-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-567-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-608-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2540-631-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1912-662-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-668-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1680-671-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1288-735-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1288-760-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2236-763-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/1996-787-0x00000000005C0000-0x00000000005EA000-memory.dmp upx behavioral1/memory/876-868-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2128-875-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1516-920-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2872-939-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-952-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-971-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/1976-990-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/956-1028-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-1047-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxrfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhntbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlxlxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxlrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxxfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbttbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bththh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrxflx.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2120 wrote to memory of 2796 2120 64fef5bf390975f3d6023bef1427cf354645a16010f12d0bb9222f7b50b97c7c.exe 31 PID 2120 wrote to memory of 2796 2120 64fef5bf390975f3d6023bef1427cf354645a16010f12d0bb9222f7b50b97c7c.exe 31 PID 2120 wrote to memory of 2796 2120 64fef5bf390975f3d6023bef1427cf354645a16010f12d0bb9222f7b50b97c7c.exe 31 PID 2120 wrote to memory of 2796 2120 64fef5bf390975f3d6023bef1427cf354645a16010f12d0bb9222f7b50b97c7c.exe 31 PID 2796 wrote to memory of 2468 2796 dppdp.exe 32 PID 2796 wrote to memory of 2468 2796 dppdp.exe 32 PID 2796 wrote to memory of 2468 2796 dppdp.exe 32 PID 2796 wrote to memory of 2468 2796 dppdp.exe 32 PID 2468 wrote to memory of 2128 2468 vjjvv.exe 33 PID 2468 wrote to memory of 2128 2468 vjjvv.exe 33 PID 2468 wrote to memory of 2128 2468 vjjvv.exe 33 PID 2468 wrote to memory of 2128 2468 vjjvv.exe 33 PID 2128 wrote to memory of 2680 2128 tnhntb.exe 34 PID 2128 wrote to memory of 2680 2128 tnhntb.exe 34 PID 2128 wrote to memory of 2680 2128 tnhntb.exe 34 PID 2128 wrote to memory of 2680 2128 tnhntb.exe 34 PID 2680 wrote to memory of 2684 2680 hnthht.exe 35 PID 2680 wrote to memory of 2684 2680 hnthht.exe 35 PID 2680 wrote to memory of 2684 2680 hnthht.exe 35 PID 2680 wrote to memory of 2684 2680 hnthht.exe 35 PID 2684 wrote to memory of 2772 2684 rlrxlxf.exe 36 PID 2684 wrote to memory of 2772 2684 rlrxlxf.exe 36 PID 2684 wrote to memory of 2772 2684 rlrxlxf.exe 36 PID 2684 wrote to memory of 2772 2684 rlrxlxf.exe 36 PID 2772 wrote to memory of 2828 2772 1dvvd.exe 37 PID 2772 wrote to memory of 2828 2772 1dvvd.exe 37 PID 2772 wrote to memory of 2828 2772 1dvvd.exe 37 PID 2772 wrote to memory of 2828 2772 1dvvd.exe 37 PID 2828 wrote to memory of 1516 2828 tnthnn.exe 38 PID 2828 wrote to memory of 1516 2828 tnthnn.exe 38 PID 2828 wrote to memory of 1516 2828 tnthnn.exe 38 PID 2828 wrote to memory of 1516 2828 tnthnn.exe 38 PID 1516 wrote to memory of 2588 1516 3jvdv.exe 39 PID 1516 wrote to memory of 2588 1516 3jvdv.exe 39 PID 1516 wrote to memory of 2588 1516 3jvdv.exe 39 PID 1516 wrote to memory of 2588 1516 3jvdv.exe 39 PID 2588 wrote to memory of 2204 2588 bththh.exe 40 PID 2588 wrote to memory of 2204 2588 bththh.exe 40 PID 2588 wrote to memory of 2204 2588 bththh.exe 40 PID 2588 wrote to memory of 2204 2588 bththh.exe 40 PID 2204 wrote to memory of 380 2204 djpdp.exe 41 PID 2204 wrote to memory of 380 2204 djpdp.exe 41 PID 2204 wrote to memory of 380 2204 djpdp.exe 41 PID 2204 wrote to memory of 380 2204 djpdp.exe 41 PID 380 wrote to memory of 2872 380 hbbbbt.exe 42 PID 380 wrote to memory of 2872 380 hbbbbt.exe 42 PID 380 wrote to memory of 2872 380 hbbbbt.exe 42 PID 380 wrote to memory of 2872 380 hbbbbt.exe 42 PID 2872 wrote to memory of 1076 2872 7lrlrxx.exe 43 PID 2872 wrote to memory of 1076 2872 7lrlrxx.exe 43 PID 2872 wrote to memory of 1076 2872 7lrlrxx.exe 43 PID 2872 wrote to memory of 1076 2872 7lrlrxx.exe 43 PID 1076 wrote to memory of 2376 1076 5vpjp.exe 44 PID 1076 wrote to memory of 2376 1076 5vpjp.exe 44 PID 1076 wrote to memory of 2376 1076 5vpjp.exe 44 PID 1076 wrote to memory of 2376 1076 5vpjp.exe 44 PID 2376 wrote to memory of 536 2376 vvdjj.exe 45 PID 2376 wrote to memory of 536 2376 vvdjj.exe 45 PID 2376 wrote to memory of 536 2376 vvdjj.exe 45 PID 2376 wrote to memory of 536 2376 vvdjj.exe 45 PID 536 wrote to memory of 2988 536 jjvjv.exe 46 PID 536 wrote to memory of 2988 536 jjvjv.exe 46 PID 536 wrote to memory of 2988 536 jjvjv.exe 46 PID 536 wrote to memory of 2988 536 jjvjv.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\64fef5bf390975f3d6023bef1427cf354645a16010f12d0bb9222f7b50b97c7c.exe"C:\Users\Admin\AppData\Local\Temp\64fef5bf390975f3d6023bef1427cf354645a16010f12d0bb9222f7b50b97c7c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\dppdp.exec:\dppdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\vjjvv.exec:\vjjvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\tnhntb.exec:\tnhntb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\hnthht.exec:\hnthht.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\rlrxlxf.exec:\rlrxlxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\1dvvd.exec:\1dvvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\tnthnn.exec:\tnthnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\3jvdv.exec:\3jvdv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\bththh.exec:\bththh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\djpdp.exec:\djpdp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\hbbbbt.exec:\hbbbbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
\??\c:\7lrlrxx.exec:\7lrlrxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\5vpjp.exec:\5vpjp.exe14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1076 -
\??\c:\vvdjj.exec:\vvdjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\jjvjv.exec:\jjvjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\5rlrfrx.exec:\5rlrfrx.exe17⤵
- Executes dropped EXE
PID:2988 -
\??\c:\pppvj.exec:\pppvj.exe18⤵
- Executes dropped EXE
PID:2160 -
\??\c:\bbnttb.exec:\bbnttb.exe19⤵
- Executes dropped EXE
PID:2428 -
\??\c:\1fxflrx.exec:\1fxflrx.exe20⤵
- Executes dropped EXE
PID:2156 -
\??\c:\hnbhht.exec:\hnbhht.exe21⤵
- Executes dropped EXE
PID:1028 -
\??\c:\llxfrxl.exec:\llxfrxl.exe22⤵
- Executes dropped EXE
PID:744 -
\??\c:\jjppv.exec:\jjppv.exe23⤵
- Executes dropped EXE
PID:1804 -
\??\c:\xxrlfrl.exec:\xxrlfrl.exe24⤵
- Executes dropped EXE
PID:2028 -
\??\c:\7thnth.exec:\7thnth.exe25⤵
- Executes dropped EXE
PID:1700 -
\??\c:\rrflxxf.exec:\rrflxxf.exe26⤵
- Executes dropped EXE
PID:1640 -
\??\c:\jpjjv.exec:\jpjjv.exe27⤵
- Executes dropped EXE
PID:2232 -
\??\c:\9rlrxfr.exec:\9rlrxfr.exe28⤵
- Executes dropped EXE
PID:3028 -
\??\c:\ntntbh.exec:\ntntbh.exe29⤵
- Executes dropped EXE
PID:1160 -
\??\c:\5lxlllx.exec:\5lxlllx.exe30⤵
- Executes dropped EXE
PID:2276 -
\??\c:\jdvvv.exec:\jdvvv.exe31⤵
- Executes dropped EXE
PID:1572 -
\??\c:\lrxfrxf.exec:\lrxfrxf.exe32⤵
- Executes dropped EXE
PID:2908 -
\??\c:\bbhthn.exec:\bbhthn.exe33⤵
- Executes dropped EXE
PID:1684 -
\??\c:\lffxfxx.exec:\lffxfxx.exe34⤵
- Executes dropped EXE
PID:2452 -
\??\c:\btnthn.exec:\btnthn.exe35⤵
- Executes dropped EXE
PID:1168 -
\??\c:\1jdjd.exec:\1jdjd.exe36⤵
- Executes dropped EXE
PID:2196 -
\??\c:\5dvdd.exec:\5dvdd.exe37⤵
- Executes dropped EXE
PID:2128 -
\??\c:\fxflrrx.exec:\fxflrrx.exe38⤵
- Executes dropped EXE
PID:2740 -
\??\c:\9bthtb.exec:\9bthtb.exe39⤵
- Executes dropped EXE
PID:2056 -
\??\c:\dpdvp.exec:\dpdvp.exe40⤵
- Executes dropped EXE
PID:2812 -
\??\c:\ddpdj.exec:\ddpdj.exe41⤵
- Executes dropped EXE
PID:2764 -
\??\c:\fflfllr.exec:\fflfllr.exe42⤵
- Executes dropped EXE
PID:2824 -
\??\c:\tbtbnt.exec:\tbtbnt.exe43⤵
- Executes dropped EXE
PID:2704 -
\??\c:\pvjvj.exec:\pvjvj.exe44⤵
- Executes dropped EXE
PID:2444 -
\??\c:\pdvdp.exec:\pdvdp.exe45⤵
- Executes dropped EXE
PID:2580 -
\??\c:\fflflfl.exec:\fflflfl.exe46⤵
- Executes dropped EXE
PID:1676 -
\??\c:\nnhtht.exec:\nnhtht.exe47⤵
- Executes dropped EXE
PID:1436 -
\??\c:\hhhbbb.exec:\hhhbbb.exe48⤵
- Executes dropped EXE
PID:468 -
\??\c:\vvvvj.exec:\vvvvj.exe49⤵
- Executes dropped EXE
PID:2016 -
\??\c:\xxlrrll.exec:\xxlrrll.exe50⤵
- Executes dropped EXE
PID:1708 -
\??\c:\7bnbth.exec:\7bnbth.exe51⤵
- Executes dropped EXE
PID:1076 -
\??\c:\tttbnh.exec:\tttbnh.exe52⤵
- Executes dropped EXE
PID:2852 -
\??\c:\vjvdj.exec:\vjvdj.exe53⤵
- Executes dropped EXE
PID:1856 -
\??\c:\ffffxff.exec:\ffffxff.exe54⤵
- Executes dropped EXE
PID:2888 -
\??\c:\flflxff.exec:\flflxff.exe55⤵
- Executes dropped EXE
PID:872 -
\??\c:\hbnbhh.exec:\hbnbhh.exe56⤵
- Executes dropped EXE
PID:2176 -
\??\c:\ddvvv.exec:\ddvvv.exe57⤵
- Executes dropped EXE
PID:2944 -
\??\c:\pjvvd.exec:\pjvvd.exe58⤵
- Executes dropped EXE
PID:2224 -
\??\c:\rlxfrxr.exec:\rlxfrxr.exe59⤵
- Executes dropped EXE
PID:1900 -
\??\c:\bttbnn.exec:\bttbnn.exe60⤵
- Executes dropped EXE
PID:496 -
\??\c:\djvvj.exec:\djvvj.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1608 -
\??\c:\rxxfffx.exec:\rxxfffx.exe62⤵
- Executes dropped EXE
PID:1980 -
\??\c:\frlrfrr.exec:\frlrfrr.exe63⤵
- Executes dropped EXE
PID:1864 -
\??\c:\bnhnbn.exec:\bnhnbn.exe64⤵
- Executes dropped EXE
PID:1780 -
\??\c:\jvvvv.exec:\jvvvv.exe65⤵
- Executes dropped EXE
PID:1788 -
\??\c:\flxlfll.exec:\flxlfll.exe66⤵PID:1640
-
\??\c:\1nntbh.exec:\1nntbh.exe67⤵PID:3036
-
\??\c:\pdvdp.exec:\pdvdp.exe68⤵PID:2416
-
\??\c:\xllxlxl.exec:\xllxlxl.exe69⤵PID:700
-
\??\c:\xfrxflf.exec:\xfrxflf.exe70⤵PID:2968
-
\??\c:\tbtnbh.exec:\tbtnbh.exe71⤵PID:2276
-
\??\c:\pvjpv.exec:\pvjpv.exe72⤵PID:2952
-
\??\c:\vjddv.exec:\vjddv.exe73⤵PID:2120
-
\??\c:\9flxxlf.exec:\9flxxlf.exe74⤵PID:1296
-
\??\c:\tbbnhb.exec:\tbbnhb.exe75⤵PID:2796
-
\??\c:\ddvvj.exec:\ddvvj.exe76⤵PID:2628
-
\??\c:\vvjjv.exec:\vvjjv.exe77⤵PID:1168
-
\??\c:\rfxllxr.exec:\rfxllxr.exe78⤵PID:2752
-
\??\c:\hhbhth.exec:\hhbhth.exe79⤵PID:2780
-
\??\c:\3httbn.exec:\3httbn.exe80⤵PID:2544
-
\??\c:\vjppp.exec:\vjppp.exe81⤵PID:2788
-
\??\c:\xfllxfr.exec:\xfllxfr.exe82⤵PID:2812
-
\??\c:\5nbhnh.exec:\5nbhnh.exe83⤵PID:2732
-
\??\c:\hhthhn.exec:\hhthhn.exe84⤵PID:2540
-
\??\c:\jvjvv.exec:\jvjvv.exe85⤵PID:1516
-
\??\c:\flxrflx.exec:\flxrflx.exe86⤵PID:2504
-
\??\c:\xfrxlxr.exec:\xfrxlxr.exe87⤵PID:2484
-
\??\c:\3bbhth.exec:\3bbhth.exe88⤵PID:1912
-
\??\c:\ppvvj.exec:\ppvvj.exe89⤵PID:2860
-
\??\c:\9lfrxlr.exec:\9lfrxlr.exe90⤵PID:1680
-
\??\c:\5llllrl.exec:\5llllrl.exe91⤵PID:2016
-
\??\c:\5nbbhh.exec:\5nbbhh.exe92⤵PID:1708
-
\??\c:\djpvd.exec:\djpvd.exe93⤵
- System Location Discovery: System Language Discovery
PID:1076 -
\??\c:\5xlfxxf.exec:\5xlfxxf.exe94⤵PID:2896
-
\??\c:\3xlrflx.exec:\3xlrflx.exe95⤵PID:1856
-
\??\c:\bbnhth.exec:\bbnhth.exe96⤵PID:2888
-
\??\c:\vddjj.exec:\vddjj.exe97⤵PID:872
-
\??\c:\9frxfrr.exec:\9frxfrr.exe98⤵PID:2632
-
\??\c:\9xllllr.exec:\9xllllr.exe99⤵PID:2024
-
\??\c:\ntbhtb.exec:\ntbhtb.exe100⤵PID:1288
-
\??\c:\jjppp.exec:\jjppp.exe101⤵PID:960
-
\??\c:\fxlrllx.exec:\fxlrllx.exe102⤵PID:1784
-
\??\c:\xrffrrx.exec:\xrffrrx.exe103⤵PID:980
-
\??\c:\tbtbhn.exec:\tbtbhn.exe104⤵PID:2236
-
\??\c:\3pdpd.exec:\3pdpd.exe105⤵PID:1536
-
\??\c:\vddjp.exec:\vddjp.exe106⤵PID:2596
-
\??\c:\xrlrffl.exec:\xrlrffl.exe107⤵PID:1996
-
\??\c:\ttbnnb.exec:\ttbnnb.exe108⤵PID:388
-
\??\c:\pdvjv.exec:\pdvjv.exe109⤵PID:1992
-
\??\c:\llrrxfl.exec:\llrrxfl.exe110⤵PID:3032
-
\??\c:\hhtbnt.exec:\hhtbnt.exe111⤵PID:2020
-
\??\c:\vvddp.exec:\vvddp.exe112⤵PID:2088
-
\??\c:\pvppd.exec:\pvppd.exe113⤵PID:1432
-
\??\c:\fflxfrx.exec:\fflxfrx.exe114⤵PID:2276
-
\??\c:\bhnthb.exec:\bhnthb.exe115⤵PID:2328
-
\??\c:\ddjvd.exec:\ddjvd.exe116⤵PID:2124
-
\??\c:\9jjvp.exec:\9jjvp.exe117⤵PID:1296
-
\??\c:\llxfxrf.exec:\llxfxrf.exe118⤵PID:2284
-
\??\c:\hhthnb.exec:\hhthnb.exe119⤵PID:2192
-
\??\c:\htnbnb.exec:\htnbnb.exe120⤵PID:876
-
\??\c:\dpvpp.exec:\dpvpp.exe121⤵PID:2924
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-