Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 20:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cb7b854dd73a8ac0d7a5a0d65b47b7a049892d5ee2b49b61e66b21f6130b4aed.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
cb7b854dd73a8ac0d7a5a0d65b47b7a049892d5ee2b49b61e66b21f6130b4aed.exe
-
Size
454KB
-
MD5
ea5443a99d54eba5f33b731938905cdd
-
SHA1
653d6b1ecee07f05f416a2fd27ea85ffffbc4d0f
-
SHA256
cb7b854dd73a8ac0d7a5a0d65b47b7a049892d5ee2b49b61e66b21f6130b4aed
-
SHA512
6051c33e8f98006e62ba716f6fbeda87a0d385163c4fb6c834edbec4bd48c1080837bc0e05ef1e82463d01ba097984a61a61051cf5d03bc771c806378fe7e136
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbed:q7Tc2NYHUrAwfMp3CDd
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2052-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1812-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2260-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-95-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2952-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1604-114-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/1604-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2020-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1928-169-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2392-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1928-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2384-188-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/772-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2384-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/960-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/920-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/292-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1720-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1692-342-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2440-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1356-420-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2812-433-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1804-448-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2476-449-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1804-447-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2020-462-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/536-482-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1760-559-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-630-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-669-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1672-1016-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1812 1nbthh.exe 2260 3vvpd.exe 2848 ddjjj.exe 3068 tbbtth.exe 2728 3vjjp.exe 2864 xlrxfxf.exe 2604 5dvvv.exe 2512 9xrflff.exe 2752 1pjjp.exe 2608 djdjv.exe 2952 5llrflx.exe 1604 dvppv.exe 2812 7pjpv.exe 2960 nnhbtb.exe 2024 dpvvv.exe 2020 ttnbnn.exe 2676 rllxlxl.exe 1928 3nhnnh.exe 2392 3hhntt.exe 2384 nhttnn.exe 772 nhnhtt.exe 960 vpdjd.exe 2092 rxxfxxl.exe 2064 5flfllr.exe 700 ddvdj.exe 920 dpvvv.exe 1532 xrlfllx.exe 1136 jjdjv.exe 292 thnhhb.exe 2364 pjjpj.exe 1044 tthtnt.exe 1720 1btttn.exe 1296 1vvdp.exe 2052 tbbbhn.exe 1692 vpdjp.exe 2436 lllrflr.exe 2280 7bnnbt.exe 3020 vvvdv.exe 2848 jddjv.exe 2708 fffrflf.exe 2640 5hhntt.exe 2336 djdjv.exe 2864 llfrflx.exe 2604 rllxflf.exe 2544 1httnn.exe 2504 vjddj.exe 2440 xrlrrrf.exe 2756 bnbbtb.exe 2952 9nhhtb.exe 1356 pjdjp.exe 2672 rfffffl.exe 2812 fffxlrx.exe 852 nnhtbb.exe 1804 ppdjj.exe 2476 9lfrflr.exe 2020 flfrrfx.exe 2264 nnbhtb.exe 1908 5jddj.exe 536 7jjjp.exe 1148 xlfllxf.exe 1484 hbhhtt.exe 2888 ddppp.exe 2880 xrlrxxl.exe 1556 xfxfxxl.exe -
resource yara_rule behavioral1/memory/2052-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1812-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1604-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1928-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/772-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/960-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-228-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/920-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/292-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1356-419-0x00000000003D0000-0x00000000003FA000-memory.dmp upx behavioral1/memory/1356-420-0x00000000003D0000-0x00000000003FA000-memory.dmp upx behavioral1/memory/2812-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2476-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/536-482-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/536-477-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/1484-489-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-523-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-559-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-566-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-630-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-631-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-669-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-710-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxfllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2052 wrote to memory of 1812 2052 cb7b854dd73a8ac0d7a5a0d65b47b7a049892d5ee2b49b61e66b21f6130b4aed.exe 28 PID 2052 wrote to memory of 1812 2052 cb7b854dd73a8ac0d7a5a0d65b47b7a049892d5ee2b49b61e66b21f6130b4aed.exe 28 PID 2052 wrote to memory of 1812 2052 cb7b854dd73a8ac0d7a5a0d65b47b7a049892d5ee2b49b61e66b21f6130b4aed.exe 28 PID 2052 wrote to memory of 1812 2052 cb7b854dd73a8ac0d7a5a0d65b47b7a049892d5ee2b49b61e66b21f6130b4aed.exe 28 PID 1812 wrote to memory of 2260 1812 1nbthh.exe 29 PID 1812 wrote to memory of 2260 1812 1nbthh.exe 29 PID 1812 wrote to memory of 2260 1812 1nbthh.exe 29 PID 1812 wrote to memory of 2260 1812 1nbthh.exe 29 PID 2260 wrote to memory of 2848 2260 3vvpd.exe 30 PID 2260 wrote to memory of 2848 2260 3vvpd.exe 30 PID 2260 wrote to memory of 2848 2260 3vvpd.exe 30 PID 2260 wrote to memory of 2848 2260 3vvpd.exe 30 PID 2848 wrote to memory of 3068 2848 ddjjj.exe 31 PID 2848 wrote to memory of 3068 2848 ddjjj.exe 31 PID 2848 wrote to memory of 3068 2848 ddjjj.exe 31 PID 2848 wrote to memory of 3068 2848 ddjjj.exe 31 PID 3068 wrote to memory of 2728 3068 tbbtth.exe 32 PID 3068 wrote to memory of 2728 3068 tbbtth.exe 32 PID 3068 wrote to memory of 2728 3068 tbbtth.exe 32 PID 3068 wrote to memory of 2728 3068 tbbtth.exe 32 PID 2728 wrote to memory of 2864 2728 3vjjp.exe 33 PID 2728 wrote to memory of 2864 2728 3vjjp.exe 33 PID 2728 wrote to memory of 2864 2728 3vjjp.exe 33 PID 2728 wrote to memory of 2864 2728 3vjjp.exe 33 PID 2864 wrote to memory of 2604 2864 xlrxfxf.exe 34 PID 2864 wrote to memory of 2604 2864 xlrxfxf.exe 34 PID 2864 wrote to memory of 2604 2864 xlrxfxf.exe 34 PID 2864 wrote to memory of 2604 2864 xlrxfxf.exe 34 PID 2604 wrote to memory of 2512 2604 5dvvv.exe 35 PID 2604 wrote to memory of 2512 2604 5dvvv.exe 35 PID 2604 wrote to memory of 2512 2604 5dvvv.exe 35 PID 2604 wrote to memory of 2512 2604 5dvvv.exe 35 PID 2512 wrote to memory of 2752 2512 9xrflff.exe 36 PID 2512 wrote to memory of 2752 2512 9xrflff.exe 36 PID 2512 wrote to memory of 2752 2512 9xrflff.exe 36 PID 2512 wrote to memory of 2752 2512 9xrflff.exe 36 PID 2752 wrote to memory of 2608 2752 1pjjp.exe 37 PID 2752 wrote to memory of 2608 2752 1pjjp.exe 37 PID 2752 wrote to memory of 2608 2752 1pjjp.exe 37 PID 2752 wrote to memory of 2608 2752 1pjjp.exe 37 PID 2608 wrote to memory of 2952 2608 djdjv.exe 38 PID 2608 wrote to memory of 2952 2608 djdjv.exe 38 PID 2608 wrote to memory of 2952 2608 djdjv.exe 38 PID 2608 wrote to memory of 2952 2608 djdjv.exe 38 PID 2952 wrote to memory of 1604 2952 5llrflx.exe 39 PID 2952 wrote to memory of 1604 2952 5llrflx.exe 39 PID 2952 wrote to memory of 1604 2952 5llrflx.exe 39 PID 2952 wrote to memory of 1604 2952 5llrflx.exe 39 PID 1604 wrote to memory of 2812 1604 dvppv.exe 40 PID 1604 wrote to memory of 2812 1604 dvppv.exe 40 PID 1604 wrote to memory of 2812 1604 dvppv.exe 40 PID 1604 wrote to memory of 2812 1604 dvppv.exe 40 PID 2812 wrote to memory of 2960 2812 7pjpv.exe 41 PID 2812 wrote to memory of 2960 2812 7pjpv.exe 41 PID 2812 wrote to memory of 2960 2812 7pjpv.exe 41 PID 2812 wrote to memory of 2960 2812 7pjpv.exe 41 PID 2960 wrote to memory of 2024 2960 nnhbtb.exe 42 PID 2960 wrote to memory of 2024 2960 nnhbtb.exe 42 PID 2960 wrote to memory of 2024 2960 nnhbtb.exe 42 PID 2960 wrote to memory of 2024 2960 nnhbtb.exe 42 PID 2024 wrote to memory of 2020 2024 dpvvv.exe 43 PID 2024 wrote to memory of 2020 2024 dpvvv.exe 43 PID 2024 wrote to memory of 2020 2024 dpvvv.exe 43 PID 2024 wrote to memory of 2020 2024 dpvvv.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb7b854dd73a8ac0d7a5a0d65b47b7a049892d5ee2b49b61e66b21f6130b4aed.exe"C:\Users\Admin\AppData\Local\Temp\cb7b854dd73a8ac0d7a5a0d65b47b7a049892d5ee2b49b61e66b21f6130b4aed.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\1nbthh.exec:\1nbthh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\3vvpd.exec:\3vvpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\ddjjj.exec:\ddjjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\tbbtth.exec:\tbbtth.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\3vjjp.exec:\3vjjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\xlrxfxf.exec:\xlrxfxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\5dvvv.exec:\5dvvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\9xrflff.exec:\9xrflff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\1pjjp.exec:\1pjjp.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\djdjv.exec:\djdjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\5llrflx.exec:\5llrflx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\dvppv.exec:\dvppv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\7pjpv.exec:\7pjpv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\nnhbtb.exec:\nnhbtb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\dpvvv.exec:\dpvvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\ttnbnn.exec:\ttnbnn.exe17⤵
- Executes dropped EXE
PID:2020 -
\??\c:\rllxlxl.exec:\rllxlxl.exe18⤵
- Executes dropped EXE
PID:2676 -
\??\c:\3nhnnh.exec:\3nhnnh.exe19⤵
- Executes dropped EXE
PID:1928 -
\??\c:\3hhntt.exec:\3hhntt.exe20⤵
- Executes dropped EXE
PID:2392 -
\??\c:\nhttnn.exec:\nhttnn.exe21⤵
- Executes dropped EXE
PID:2384 -
\??\c:\nhnhtt.exec:\nhnhtt.exe22⤵
- Executes dropped EXE
PID:772 -
\??\c:\vpdjd.exec:\vpdjd.exe23⤵
- Executes dropped EXE
PID:960 -
\??\c:\rxxfxxl.exec:\rxxfxxl.exe24⤵
- Executes dropped EXE
PID:2092 -
\??\c:\5flfllr.exec:\5flfllr.exe25⤵
- Executes dropped EXE
PID:2064 -
\??\c:\ddvdj.exec:\ddvdj.exe26⤵
- Executes dropped EXE
PID:700 -
\??\c:\dpvvv.exec:\dpvvv.exe27⤵
- Executes dropped EXE
PID:920 -
\??\c:\xrlfllx.exec:\xrlfllx.exe28⤵
- Executes dropped EXE
PID:1532 -
\??\c:\jjdjv.exec:\jjdjv.exe29⤵
- Executes dropped EXE
PID:1136 -
\??\c:\thnhhb.exec:\thnhhb.exe30⤵
- Executes dropped EXE
PID:292 -
\??\c:\pjjpj.exec:\pjjpj.exe31⤵
- Executes dropped EXE
PID:2364 -
\??\c:\tthtnt.exec:\tthtnt.exe32⤵
- Executes dropped EXE
PID:1044 -
\??\c:\1btttn.exec:\1btttn.exe33⤵
- Executes dropped EXE
PID:1720 -
\??\c:\1vvdp.exec:\1vvdp.exe34⤵
- Executes dropped EXE
PID:1296 -
\??\c:\tbbbhn.exec:\tbbbhn.exe35⤵
- Executes dropped EXE
PID:2052 -
\??\c:\vpdjp.exec:\vpdjp.exe36⤵
- Executes dropped EXE
PID:1692 -
\??\c:\lllrflr.exec:\lllrflr.exe37⤵
- Executes dropped EXE
PID:2436 -
\??\c:\7bnnbt.exec:\7bnnbt.exe38⤵
- Executes dropped EXE
PID:2280 -
\??\c:\vvvdv.exec:\vvvdv.exe39⤵
- Executes dropped EXE
PID:3020 -
\??\c:\jddjv.exec:\jddjv.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2848 -
\??\c:\fffrflf.exec:\fffrflf.exe41⤵
- Executes dropped EXE
PID:2708 -
\??\c:\5hhntt.exec:\5hhntt.exe42⤵
- Executes dropped EXE
PID:2640 -
\??\c:\djdjv.exec:\djdjv.exe43⤵
- Executes dropped EXE
PID:2336 -
\??\c:\llfrflx.exec:\llfrflx.exe44⤵
- Executes dropped EXE
PID:2864 -
\??\c:\rllxflf.exec:\rllxflf.exe45⤵
- Executes dropped EXE
PID:2604 -
\??\c:\1httnn.exec:\1httnn.exe46⤵
- Executes dropped EXE
PID:2544 -
\??\c:\vjddj.exec:\vjddj.exe47⤵
- Executes dropped EXE
PID:2504 -
\??\c:\xrlrrrf.exec:\xrlrrrf.exe48⤵
- Executes dropped EXE
PID:2440 -
\??\c:\bnbbtb.exec:\bnbbtb.exe49⤵
- Executes dropped EXE
PID:2756 -
\??\c:\9nhhtb.exec:\9nhhtb.exe50⤵
- Executes dropped EXE
PID:2952 -
\??\c:\pjdjp.exec:\pjdjp.exe51⤵
- Executes dropped EXE
PID:1356 -
\??\c:\rfffffl.exec:\rfffffl.exe52⤵
- Executes dropped EXE
PID:2672 -
\??\c:\fffxlrx.exec:\fffxlrx.exe53⤵
- Executes dropped EXE
PID:2812 -
\??\c:\nnhtbb.exec:\nnhtbb.exe54⤵
- Executes dropped EXE
PID:852 -
\??\c:\ppdjj.exec:\ppdjj.exe55⤵
- Executes dropped EXE
PID:1804 -
\??\c:\9lfrflr.exec:\9lfrflr.exe56⤵
- Executes dropped EXE
PID:2476 -
\??\c:\flfrrfx.exec:\flfrrfx.exe57⤵
- Executes dropped EXE
PID:2020 -
\??\c:\nnbhtb.exec:\nnbhtb.exe58⤵
- Executes dropped EXE
PID:2264 -
\??\c:\5jddj.exec:\5jddj.exe59⤵
- Executes dropped EXE
PID:1908 -
\??\c:\7jjjp.exec:\7jjjp.exe60⤵
- Executes dropped EXE
PID:536 -
\??\c:\xlfllxf.exec:\xlfllxf.exe61⤵
- Executes dropped EXE
PID:1148 -
\??\c:\hbhhtt.exec:\hbhhtt.exe62⤵
- Executes dropped EXE
PID:1484 -
\??\c:\ddppp.exec:\ddppp.exe63⤵
- Executes dropped EXE
PID:2888 -
\??\c:\xrlrxxl.exec:\xrlrxxl.exe64⤵
- Executes dropped EXE
PID:2880 -
\??\c:\xfxfxxl.exec:\xfxfxxl.exe65⤵
- Executes dropped EXE
PID:1556 -
\??\c:\thtttb.exec:\thtttb.exe66⤵PID:1664
-
\??\c:\jdppd.exec:\jdppd.exe67⤵PID:1188
-
\??\c:\7lffrxr.exec:\7lffrxr.exe68⤵PID:1756
-
\??\c:\tnbbhh.exec:\tnbbhh.exe69⤵PID:2404
-
\??\c:\bbhnbh.exec:\bbhnbh.exe70⤵PID:1724
-
\??\c:\jpdpd.exec:\jpdpd.exe71⤵PID:1776
-
\??\c:\9lflxxl.exec:\9lflxxl.exe72⤵PID:1760
-
\??\c:\tttthh.exec:\tttthh.exe73⤵PID:836
-
\??\c:\hhtthn.exec:\hhtthn.exe74⤵PID:3004
-
\??\c:\dpppd.exec:\dpppd.exe75⤵PID:2072
-
\??\c:\7fxfrrf.exec:\7fxfrrf.exe76⤵PID:2856
-
\??\c:\bthnhn.exec:\bthnhn.exe77⤵PID:2980
-
\??\c:\nbttbb.exec:\nbttbb.exe78⤵PID:3024
-
\??\c:\dvppv.exec:\dvppv.exe79⤵PID:2920
-
\??\c:\rlfllrf.exec:\rlfllrf.exe80⤵PID:2416
-
\??\c:\ttntbh.exec:\ttntbh.exe81⤵PID:1284
-
\??\c:\tnhthn.exec:\tnhthn.exe82⤵PID:1160
-
\??\c:\pjjdj.exec:\pjjdj.exe83⤵PID:3064
-
\??\c:\fffflfr.exec:\fffflfr.exe84⤵PID:2668
-
\??\c:\xfxlxfr.exec:\xfxlxfr.exe85⤵PID:2592
-
\??\c:\hbnbhb.exec:\hbnbhb.exe86⤵
- System Location Discovery: System Language Discovery
PID:2612 -
\??\c:\jdddj.exec:\jdddj.exe87⤵PID:2632
-
\??\c:\dpjdv.exec:\dpjdv.exe88⤵PID:2772
-
\??\c:\rrllllx.exec:\rrllllx.exe89⤵PID:2712
-
\??\c:\nbnntn.exec:\nbnntn.exe90⤵PID:2652
-
\??\c:\nnnhtb.exec:\nnnhtb.exe91⤵PID:2600
-
\??\c:\5lxxrxf.exec:\5lxxrxf.exe92⤵PID:2564
-
\??\c:\5xrfllx.exec:\5xrfllx.exe93⤵PID:2608
-
\??\c:\bthnhb.exec:\bthnhb.exe94⤵PID:1796
-
\??\c:\btnbnt.exec:\btnbnt.exe95⤵PID:2044
-
\??\c:\3dvdj.exec:\3dvdj.exe96⤵PID:2844
-
\??\c:\lfxxffr.exec:\lfxxffr.exe97⤵PID:2672
-
\??\c:\tttbtt.exec:\tttbtt.exe98⤵PID:2936
-
\??\c:\pdppv.exec:\pdppv.exe99⤵PID:1792
-
\??\c:\dpdpd.exec:\dpdpd.exe100⤵PID:1204
-
\??\c:\1xrllll.exec:\1xrllll.exe101⤵PID:2344
-
\??\c:\1hbtnn.exec:\1hbtnn.exe102⤵PID:1992
-
\??\c:\jjvvj.exec:\jjvvj.exe103⤵PID:1952
-
\??\c:\djdjv.exec:\djdjv.exe104⤵PID:1912
-
\??\c:\xxxfllr.exec:\xxxfllr.exe105⤵PID:2392
-
\??\c:\bbbhbb.exec:\bbbhbb.exe106⤵PID:2380
-
\??\c:\tnbhth.exec:\tnbhth.exe107⤵PID:1148
-
\??\c:\pjvdp.exec:\pjvdp.exe108⤵PID:584
-
\??\c:\lfxxxxl.exec:\lfxxxxl.exe109⤵PID:2800
-
\??\c:\xrrxllr.exec:\xrrxllr.exe110⤵PID:2880
-
\??\c:\1htbhn.exec:\1htbhn.exe111⤵PID:2168
-
\??\c:\5pdpj.exec:\5pdpj.exe112⤵PID:3032
-
\??\c:\vvvjv.exec:\vvvjv.exe113⤵PID:348
-
\??\c:\ffxxllx.exec:\ffxxllx.exe114⤵PID:352
-
\??\c:\9tttnn.exec:\9tttnn.exe115⤵PID:288
-
\??\c:\5nhhtt.exec:\5nhhtt.exe116⤵PID:2896
-
\??\c:\ddvpj.exec:\ddvpj.exe117⤵PID:600
-
\??\c:\llflxxr.exec:\llflxxr.exe118⤵PID:788
-
\??\c:\xlxxlfl.exec:\xlxxlfl.exe119⤵PID:2976
-
\??\c:\5hthbn.exec:\5hthbn.exe120⤵PID:1564
-
\??\c:\lffrxfx.exec:\lffrxfx.exe121⤵PID:2680
-
\??\c:\hbtntt.exec:\hbtntt.exe122⤵PID:2856
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-