Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 19:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
eb57eb3a2a2c85c05c90c0af54720afac4aa06c2041236b1d6190bcf56a49971.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
eb57eb3a2a2c85c05c90c0af54720afac4aa06c2041236b1d6190bcf56a49971.exe
-
Size
454KB
-
MD5
2fee590e0ca9d4ef50e143bb1a663c80
-
SHA1
c66c9466f800b7480d59abd7af5c35d7d3181b81
-
SHA256
eb57eb3a2a2c85c05c90c0af54720afac4aa06c2041236b1d6190bcf56a49971
-
SHA512
46fd38b12f0e4931dabff9762dd0300ad50232dbd038b74eab12b947ec5c3992d90ea028e51e1d41d25104d82d33dbd29aa71e6b2ef82ada461bb4304e34b69e
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeb:q7Tc2NYHUrAwfMp3CDb
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/1508-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2084-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2068-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1284-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/684-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1788-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/696-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/904-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/988-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1760-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-292-0x0000000076EA0000-0x0000000076FBF000-memory.dmp family_blackmoon behavioral1/memory/2668-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/296-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1872-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1460-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1160-421-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1080-465-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2340-472-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1564-510-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-588-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-595-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-602-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1284-677-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2244-709-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/324-760-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2028-791-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2660-1112-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2976 pvvdp.exe 2680 ffxflfr.exe 3004 hnbnht.exe 2736 dvvjp.exe 2740 jjjdv.exe 2688 tbtntb.exe 2564 5lrxllx.exe 2084 5ttnbh.exe 2888 5vpvj.exe 2068 fxxrlxx.exe 1684 pppjj.exe 1284 5lrxxfr.exe 1156 9ppdj.exe 2932 bnntnh.exe 916 dvpvp.exe 684 llrllrr.exe 896 3jpdd.exe 2136 dvdjp.exe 1788 hhbbnt.exe 600 hhbbnb.exe 696 jjjpv.exe 1924 lfxfrrx.exe 904 djvjp.exe 2408 xxrxlrl.exe 2332 ppjvp.exe 2732 btntnn.exe 988 hbnthn.exe 1760 llllrxf.exe 1920 7nnhnh.exe 1888 xrrrfrr.exe 1756 hhhtht.exe 2456 1jddp.exe 2976 ddvjd.exe 2680 rxrflrx.exe 2036 hbthth.exe 2744 tbhhbt.exe 2736 djdpd.exe 2668 fllxxlr.exe 2740 bbbnhh.exe 2560 dppdp.exe 2096 fffrxfx.exe 2276 3nnhhb.exe 2760 ppjpj.exe 296 jjvjv.exe 1872 rlflffr.exe 1460 hhhnbh.exe 1684 3dpjp.exe 2776 dpdvd.exe 2796 lrrlrrr.exe 1160 btbhtn.exe 380 jjjvj.exe 1364 lrlxlrl.exe 2352 3tttbb.exe 3012 vvpdd.exe 2168 lfxlxfx.exe 2184 flllxfx.exe 1080 nnbnbn.exe 2340 5dppv.exe 964 7fffllf.exe 932 3rlrfrx.exe 628 bhnbnt.exe 860 7ppdd.exe 2316 pjjpv.exe 1564 7rlxflr.exe -
resource yara_rule behavioral1/memory/1508-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1284-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/684-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1788-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/696-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/904-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/988-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-292-0x0000000076EA0000-0x0000000076FBF000-memory.dmp upx behavioral1/memory/2668-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/296-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1872-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1460-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1160-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1080-465-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-472-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/628-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1564-510-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-517-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-537-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1916-550-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-588-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-595-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-602-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2724-605-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/2244-709-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/324-753-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-799-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-858-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-1083-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-1103-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrxrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxrrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nhnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrrlxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppdp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1508 wrote to memory of 2976 1508 eb57eb3a2a2c85c05c90c0af54720afac4aa06c2041236b1d6190bcf56a49971.exe 31 PID 1508 wrote to memory of 2976 1508 eb57eb3a2a2c85c05c90c0af54720afac4aa06c2041236b1d6190bcf56a49971.exe 31 PID 1508 wrote to memory of 2976 1508 eb57eb3a2a2c85c05c90c0af54720afac4aa06c2041236b1d6190bcf56a49971.exe 31 PID 1508 wrote to memory of 2976 1508 eb57eb3a2a2c85c05c90c0af54720afac4aa06c2041236b1d6190bcf56a49971.exe 31 PID 2976 wrote to memory of 2680 2976 pvvdp.exe 32 PID 2976 wrote to memory of 2680 2976 pvvdp.exe 32 PID 2976 wrote to memory of 2680 2976 pvvdp.exe 32 PID 2976 wrote to memory of 2680 2976 pvvdp.exe 32 PID 2680 wrote to memory of 3004 2680 ffxflfr.exe 33 PID 2680 wrote to memory of 3004 2680 ffxflfr.exe 33 PID 2680 wrote to memory of 3004 2680 ffxflfr.exe 33 PID 2680 wrote to memory of 3004 2680 ffxflfr.exe 33 PID 3004 wrote to memory of 2736 3004 hnbnht.exe 34 PID 3004 wrote to memory of 2736 3004 hnbnht.exe 34 PID 3004 wrote to memory of 2736 3004 hnbnht.exe 34 PID 3004 wrote to memory of 2736 3004 hnbnht.exe 34 PID 2736 wrote to memory of 2740 2736 dvvjp.exe 35 PID 2736 wrote to memory of 2740 2736 dvvjp.exe 35 PID 2736 wrote to memory of 2740 2736 dvvjp.exe 35 PID 2736 wrote to memory of 2740 2736 dvvjp.exe 35 PID 2740 wrote to memory of 2688 2740 jjjdv.exe 36 PID 2740 wrote to memory of 2688 2740 jjjdv.exe 36 PID 2740 wrote to memory of 2688 2740 jjjdv.exe 36 PID 2740 wrote to memory of 2688 2740 jjjdv.exe 36 PID 2688 wrote to memory of 2564 2688 tbtntb.exe 37 PID 2688 wrote to memory of 2564 2688 tbtntb.exe 37 PID 2688 wrote to memory of 2564 2688 tbtntb.exe 37 PID 2688 wrote to memory of 2564 2688 tbtntb.exe 37 PID 2564 wrote to memory of 2084 2564 5lrxllx.exe 38 PID 2564 wrote to memory of 2084 2564 5lrxllx.exe 38 PID 2564 wrote to memory of 2084 2564 5lrxllx.exe 38 PID 2564 wrote to memory of 2084 2564 5lrxllx.exe 38 PID 2084 wrote to memory of 2888 2084 5ttnbh.exe 39 PID 2084 wrote to memory of 2888 2084 5ttnbh.exe 39 PID 2084 wrote to memory of 2888 2084 5ttnbh.exe 39 PID 2084 wrote to memory of 2888 2084 5ttnbh.exe 39 PID 2888 wrote to memory of 2068 2888 5vpvj.exe 40 PID 2888 wrote to memory of 2068 2888 5vpvj.exe 40 PID 2888 wrote to memory of 2068 2888 5vpvj.exe 40 PID 2888 wrote to memory of 2068 2888 5vpvj.exe 40 PID 2068 wrote to memory of 1684 2068 fxxrlxx.exe 41 PID 2068 wrote to memory of 1684 2068 fxxrlxx.exe 41 PID 2068 wrote to memory of 1684 2068 fxxrlxx.exe 41 PID 2068 wrote to memory of 1684 2068 fxxrlxx.exe 41 PID 1684 wrote to memory of 1284 1684 pppjj.exe 42 PID 1684 wrote to memory of 1284 1684 pppjj.exe 42 PID 1684 wrote to memory of 1284 1684 pppjj.exe 42 PID 1684 wrote to memory of 1284 1684 pppjj.exe 42 PID 1284 wrote to memory of 1156 1284 5lrxxfr.exe 43 PID 1284 wrote to memory of 1156 1284 5lrxxfr.exe 43 PID 1284 wrote to memory of 1156 1284 5lrxxfr.exe 43 PID 1284 wrote to memory of 1156 1284 5lrxxfr.exe 43 PID 1156 wrote to memory of 2932 1156 9ppdj.exe 44 PID 1156 wrote to memory of 2932 1156 9ppdj.exe 44 PID 1156 wrote to memory of 2932 1156 9ppdj.exe 44 PID 1156 wrote to memory of 2932 1156 9ppdj.exe 44 PID 2932 wrote to memory of 916 2932 bnntnh.exe 45 PID 2932 wrote to memory of 916 2932 bnntnh.exe 45 PID 2932 wrote to memory of 916 2932 bnntnh.exe 45 PID 2932 wrote to memory of 916 2932 bnntnh.exe 45 PID 916 wrote to memory of 684 916 dvpvp.exe 46 PID 916 wrote to memory of 684 916 dvpvp.exe 46 PID 916 wrote to memory of 684 916 dvpvp.exe 46 PID 916 wrote to memory of 684 916 dvpvp.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb57eb3a2a2c85c05c90c0af54720afac4aa06c2041236b1d6190bcf56a49971.exe"C:\Users\Admin\AppData\Local\Temp\eb57eb3a2a2c85c05c90c0af54720afac4aa06c2041236b1d6190bcf56a49971.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\pvvdp.exec:\pvvdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\ffxflfr.exec:\ffxflfr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\hnbnht.exec:\hnbnht.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\dvvjp.exec:\dvvjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\jjjdv.exec:\jjjdv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\tbtntb.exec:\tbtntb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\5lrxllx.exec:\5lrxllx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\5ttnbh.exec:\5ttnbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\5vpvj.exec:\5vpvj.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\fxxrlxx.exec:\fxxrlxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\pppjj.exec:\pppjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\5lrxxfr.exec:\5lrxxfr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
\??\c:\9ppdj.exec:\9ppdj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
\??\c:\bnntnh.exec:\bnntnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\dvpvp.exec:\dvpvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
\??\c:\llrllrr.exec:\llrllrr.exe17⤵
- Executes dropped EXE
PID:684 -
\??\c:\3jpdd.exec:\3jpdd.exe18⤵
- Executes dropped EXE
PID:896 -
\??\c:\dvdjp.exec:\dvdjp.exe19⤵
- Executes dropped EXE
PID:2136 -
\??\c:\hhbbnt.exec:\hhbbnt.exe20⤵
- Executes dropped EXE
PID:1788 -
\??\c:\hhbbnb.exec:\hhbbnb.exe21⤵
- Executes dropped EXE
PID:600 -
\??\c:\jjjpv.exec:\jjjpv.exe22⤵
- Executes dropped EXE
PID:696 -
\??\c:\lfxfrrx.exec:\lfxfrrx.exe23⤵
- Executes dropped EXE
PID:1924 -
\??\c:\djvjp.exec:\djvjp.exe24⤵
- Executes dropped EXE
PID:904 -
\??\c:\xxrxlrl.exec:\xxrxlrl.exe25⤵
- Executes dropped EXE
PID:2408 -
\??\c:\ppjvp.exec:\ppjvp.exe26⤵
- Executes dropped EXE
PID:2332 -
\??\c:\btntnn.exec:\btntnn.exe27⤵
- Executes dropped EXE
PID:2732 -
\??\c:\hbnthn.exec:\hbnthn.exe28⤵
- Executes dropped EXE
PID:988 -
\??\c:\llllrxf.exec:\llllrxf.exe29⤵
- Executes dropped EXE
PID:1760 -
\??\c:\7nnhnh.exec:\7nnhnh.exe30⤵
- Executes dropped EXE
PID:1920 -
\??\c:\xrrrfrr.exec:\xrrrfrr.exe31⤵
- Executes dropped EXE
PID:1888 -
\??\c:\hhhtht.exec:\hhhtht.exe32⤵
- Executes dropped EXE
PID:1756 -
\??\c:\1jddp.exec:\1jddp.exe33⤵
- Executes dropped EXE
PID:2456 -
\??\c:\rlxrxlx.exec:\rlxrxlx.exe34⤵PID:1584
-
\??\c:\ddvjd.exec:\ddvjd.exe35⤵
- Executes dropped EXE
PID:2976 -
\??\c:\rxrflrx.exec:\rxrflrx.exe36⤵
- Executes dropped EXE
PID:2680 -
\??\c:\hbthth.exec:\hbthth.exe37⤵
- Executes dropped EXE
PID:2036 -
\??\c:\tbhhbt.exec:\tbhhbt.exe38⤵
- Executes dropped EXE
PID:2744 -
\??\c:\djdpd.exec:\djdpd.exe39⤵
- Executes dropped EXE
PID:2736 -
\??\c:\fllxxlr.exec:\fllxxlr.exe40⤵
- Executes dropped EXE
PID:2668 -
\??\c:\bbbnhh.exec:\bbbnhh.exe41⤵
- Executes dropped EXE
PID:2740 -
\??\c:\dppdp.exec:\dppdp.exe42⤵
- Executes dropped EXE
PID:2560 -
\??\c:\fffrxfx.exec:\fffrxfx.exe43⤵
- Executes dropped EXE
PID:2096 -
\??\c:\3nnhhb.exec:\3nnhhb.exe44⤵
- Executes dropped EXE
PID:2276 -
\??\c:\ppjpj.exec:\ppjpj.exe45⤵
- Executes dropped EXE
PID:2760 -
\??\c:\jjvjv.exec:\jjvjv.exe46⤵
- Executes dropped EXE
PID:296 -
\??\c:\rlflffr.exec:\rlflffr.exe47⤵
- Executes dropped EXE
PID:1872 -
\??\c:\hhhnbh.exec:\hhhnbh.exe48⤵
- Executes dropped EXE
PID:1460 -
\??\c:\3dpjp.exec:\3dpjp.exe49⤵
- Executes dropped EXE
PID:1684 -
\??\c:\dpdvd.exec:\dpdvd.exe50⤵
- Executes dropped EXE
PID:2776 -
\??\c:\lrrlrrr.exec:\lrrlrrr.exe51⤵
- Executes dropped EXE
PID:2796 -
\??\c:\btbhtn.exec:\btbhtn.exe52⤵
- Executes dropped EXE
PID:1160 -
\??\c:\jjjvj.exec:\jjjvj.exe53⤵
- Executes dropped EXE
PID:380 -
\??\c:\lrlxlrl.exec:\lrlxlrl.exe54⤵
- Executes dropped EXE
PID:1364 -
\??\c:\3tttbb.exec:\3tttbb.exe55⤵
- Executes dropped EXE
PID:2352 -
\??\c:\vvpdd.exec:\vvpdd.exe56⤵
- Executes dropped EXE
PID:3012 -
\??\c:\lfxlxfx.exec:\lfxlxfx.exe57⤵
- Executes dropped EXE
PID:2168 -
\??\c:\flllxfx.exec:\flllxfx.exe58⤵
- Executes dropped EXE
PID:2184 -
\??\c:\nnbnbn.exec:\nnbnbn.exe59⤵
- Executes dropped EXE
PID:1080 -
\??\c:\5dppv.exec:\5dppv.exe60⤵
- Executes dropped EXE
PID:2340 -
\??\c:\7fffllf.exec:\7fffllf.exe61⤵
- Executes dropped EXE
PID:964 -
\??\c:\3rlrfrx.exec:\3rlrfrx.exe62⤵
- Executes dropped EXE
PID:932 -
\??\c:\bhnbnt.exec:\bhnbnt.exe63⤵
- Executes dropped EXE
PID:628 -
\??\c:\7ppdd.exec:\7ppdd.exe64⤵
- Executes dropped EXE
PID:860 -
\??\c:\pjjpv.exec:\pjjpv.exe65⤵
- Executes dropped EXE
PID:2316 -
\??\c:\7rlxflr.exec:\7rlxflr.exe66⤵
- Executes dropped EXE
PID:1564 -
\??\c:\tttbhh.exec:\tttbhh.exe67⤵PID:992
-
\??\c:\djdjv.exec:\djdjv.exe68⤵PID:2044
-
\??\c:\rxrlxfr.exec:\rxrlxfr.exe69⤵PID:1520
-
\??\c:\ttnbnt.exec:\ttnbnt.exe70⤵PID:2928
-
\??\c:\nnhttb.exec:\nnhttb.exe71⤵PID:1736
-
\??\c:\pjdjp.exec:\pjdjp.exe72⤵PID:1908
-
\??\c:\5lfxlll.exec:\5lfxlll.exe73⤵PID:1916
-
\??\c:\bbttbn.exec:\bbttbn.exe74⤵PID:2996
-
\??\c:\7nnbhn.exec:\7nnbhn.exe75⤵PID:2660
-
\??\c:\7vvdp.exec:\7vvdp.exe76⤵PID:1592
-
\??\c:\ffflrxl.exec:\ffflrxl.exe77⤵PID:2804
-
\??\c:\flxrflf.exec:\flxrflf.exe78⤵PID:2708
-
\??\c:\btnnhn.exec:\btnnhn.exe79⤵PID:2836
-
\??\c:\7ddjv.exec:\7ddjv.exe80⤵PID:2756
-
\??\c:\3fxfxxr.exec:\3fxfxxr.exe81⤵PID:2724
-
\??\c:\ntthbb.exec:\ntthbb.exe82⤵PID:836
-
\??\c:\bhbhth.exec:\bhbhth.exe83⤵PID:2540
-
\??\c:\ddjpd.exec:\ddjpd.exe84⤵PID:2672
-
\??\c:\rlllxxr.exec:\rlllxxr.exe85⤵PID:2400
-
\??\c:\7hbnhn.exec:\7hbnhn.exe86⤵PID:3064
-
\??\c:\thhtbb.exec:\thhtbb.exe87⤵PID:2072
-
\??\c:\9ppvj.exec:\9ppvj.exe88⤵PID:1344
-
\??\c:\rrlrffx.exec:\rrlrffx.exe89⤵PID:2236
-
\??\c:\rrllflx.exec:\rrllflx.exe90⤵PID:2636
-
\??\c:\1httbn.exec:\1httbn.exe91⤵PID:1608
-
\??\c:\jvjpd.exec:\jvjpd.exe92⤵PID:1284
-
\??\c:\fffllrl.exec:\fffllrl.exe93⤵PID:2792
-
\??\c:\lfxfllf.exec:\lfxfllf.exe94⤵PID:1096
-
\??\c:\hhhnhn.exec:\hhhnhn.exe95⤵PID:2916
-
\??\c:\dddjj.exec:\dddjj.exe96⤵PID:2244
-
\??\c:\9rrrflf.exec:\9rrrflf.exe97⤵PID:1364
-
\??\c:\5bbhtt.exec:\5bbhtt.exe98⤵PID:2152
-
\??\c:\7tthtb.exec:\7tthtb.exe99⤵PID:3000
-
\??\c:\pjjvj.exec:\pjjvj.exe100⤵PID:2172
-
\??\c:\7rrlxxx.exec:\7rrlxxx.exe101⤵PID:912
-
\??\c:\rlfrfrf.exec:\rlfrfrf.exe102⤵PID:600
-
\??\c:\tnhnbb.exec:\tnhnbb.exe103⤵PID:2056
-
\??\c:\vvjvj.exec:\vvjvj.exe104⤵PID:324
-
\??\c:\3xrfrxl.exec:\3xrfrxl.exe105⤵PID:864
-
\??\c:\xxfrllx.exec:\xxfrllx.exe106⤵PID:848
-
\??\c:\tnhntn.exec:\tnhntn.exe107⤵PID:2408
-
\??\c:\5vpvj.exec:\5vpvj.exe108⤵PID:1088
-
\??\c:\9fxrxlr.exec:\9fxrxlr.exe109⤵PID:2028
-
\??\c:\lfrflrx.exec:\lfrflrx.exe110⤵PID:572
-
\??\c:\hnhtnn.exec:\hnhtnn.exe111⤵PID:2484
-
\??\c:\jddvd.exec:\jddvd.exe112⤵PID:2500
-
\??\c:\tthhth.exec:\tthhth.exe113⤵PID:1744
-
\??\c:\7htthn.exec:\7htthn.exe114⤵PID:1900
-
\??\c:\jdpvp.exec:\jdpvp.exe115⤵PID:2452
-
\??\c:\9frfffl.exec:\9frfffl.exe116⤵PID:1508
-
\??\c:\bthnbb.exec:\bthnbb.exe117⤵PID:2020
-
\??\c:\fxfxxrx.exec:\fxfxxrx.exe118⤵PID:1620
-
\??\c:\7nhtbh.exec:\7nhtbh.exe119⤵PID:2840
-
\??\c:\hhbhhh.exec:\hhbhhh.exe120⤵PID:2852
-
\??\c:\1djvp.exec:\1djvp.exe121⤵PID:3004
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-