Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 19:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4847559b60ab1594de4b0f9a666fde6cddce4f18519bbc05ef692cbcb0f4a5e3.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
4847559b60ab1594de4b0f9a666fde6cddce4f18519bbc05ef692cbcb0f4a5e3.exe
-
Size
454KB
-
MD5
c7aa1b69f8bb514963107c152eb026b4
-
SHA1
7a72a0d432cd9031c6f1982be1ba03ea8d0a401c
-
SHA256
4847559b60ab1594de4b0f9a666fde6cddce4f18519bbc05ef692cbcb0f4a5e3
-
SHA512
17e595416bef1ef74d1091e8a4e6e18a79708b63df2e29a8c7eac9dd7349aae09cf4c9e8565f01a03ff15cdacdee34c03a6ab1a227c79ef7c13de1aba01cb9ff
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbed:q7Tc2NYHUrAwfMp3CDd
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/1980-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2312-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2120-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-46-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2788-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2264-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-67-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2852-65-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/836-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2092-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1052-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1052-125-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1664-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-140-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1132-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-199-0x0000000001C70000-0x0000000001C9A000-memory.dmp family_blackmoon behavioral1/memory/1844-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-233-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1476-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1660-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2256-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/288-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/288-288-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2468-304-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2340-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-336-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/584-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1184-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1708-505-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2520-525-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2272-538-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1156-582-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2472-595-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2264-634-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2392-659-0x0000000000340000-0x000000000036A000-memory.dmp family_blackmoon behavioral1/memory/1808-718-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-843-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1124-855-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2772-882-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1276-1101-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1752-1330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2456 1pddj.exe 2312 rfflxxl.exe 2120 ttthtt.exe 2788 5nntnt.exe 2704 1vpvj.exe 2852 xlffffl.exe 2264 ttntht.exe 2552 vjppj.exe 2668 xlxxxxx.exe 2092 nhhhtt.exe 836 jdvdj.exe 1052 dvjvj.exe 2608 7jvvv.exe 2300 3tnnbn.exe 1664 ddppv.exe 2876 lfrlrrf.exe 2956 3vddp.exe 2960 xrllxfx.exe 1704 pjvdd.exe 1132 3hntnt.exe 2496 jpdjv.exe 1844 fxrfxxr.exe 2032 pjvdj.exe 2940 xrrrxfl.exe 304 1dpvd.exe 1660 1vvpp.exe 1476 ttbbnn.exe 2200 7pddp.exe 2256 rllrlrl.exe 288 vpdpv.exe 2512 lflrxfr.exe 2468 nbbthh.exe 2340 dppvd.exe 2164 lfxflrf.exe 2396 pjjjp.exe 2792 3dppj.exe 2700 lffrxfl.exe 584 tthnnt.exe 2576 tnhtbh.exe 1184 djvdp.exe 2560 xrflxxr.exe 2544 7bhhtt.exe 2148 thtntt.exe 612 jdjjv.exe 2008 fxrrrrx.exe 2768 rlrxfrx.exe 1604 bthnbn.exe 2536 vpddj.exe 1616 pjvvd.exe 1664 xrlrlxl.exe 1788 tnnntb.exe 2928 hbtbbn.exe 2840 pjdvv.exe 2892 xlxfrrr.exe 2916 7lfrflx.exe 2072 1tbhnn.exe 2872 3vjjv.exe 372 fxrxlrl.exe 1496 9rxxllr.exe 1596 htbbbt.exe 1700 ppdpv.exe 1708 jvjpj.exe 604 rlfxrrl.exe 1752 thttnt.exe -
resource yara_rule behavioral1/memory/1980-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-46-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2788-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/836-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1052-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1052-123-0x0000000000430000-0x000000000045A000-memory.dmp upx behavioral1/memory/1664-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1132-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1844-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1476-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/288-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/584-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1184-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-373-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/1616-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-505-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-518-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-525-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-538-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1156-582-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-595-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-659-0x0000000000340000-0x000000000036A000-memory.dmp upx behavioral1/memory/2924-719-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1808-718-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-843-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-882-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/3020-1050-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1276-1101-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1752-1330-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xrrflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxfrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlfrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfffrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1980 wrote to memory of 2456 1980 4847559b60ab1594de4b0f9a666fde6cddce4f18519bbc05ef692cbcb0f4a5e3.exe 31 PID 1980 wrote to memory of 2456 1980 4847559b60ab1594de4b0f9a666fde6cddce4f18519bbc05ef692cbcb0f4a5e3.exe 31 PID 1980 wrote to memory of 2456 1980 4847559b60ab1594de4b0f9a666fde6cddce4f18519bbc05ef692cbcb0f4a5e3.exe 31 PID 1980 wrote to memory of 2456 1980 4847559b60ab1594de4b0f9a666fde6cddce4f18519bbc05ef692cbcb0f4a5e3.exe 31 PID 2456 wrote to memory of 2312 2456 1pddj.exe 32 PID 2456 wrote to memory of 2312 2456 1pddj.exe 32 PID 2456 wrote to memory of 2312 2456 1pddj.exe 32 PID 2456 wrote to memory of 2312 2456 1pddj.exe 32 PID 2312 wrote to memory of 2120 2312 rfflxxl.exe 33 PID 2312 wrote to memory of 2120 2312 rfflxxl.exe 33 PID 2312 wrote to memory of 2120 2312 rfflxxl.exe 33 PID 2312 wrote to memory of 2120 2312 rfflxxl.exe 33 PID 2120 wrote to memory of 2788 2120 ttthtt.exe 34 PID 2120 wrote to memory of 2788 2120 ttthtt.exe 34 PID 2120 wrote to memory of 2788 2120 ttthtt.exe 34 PID 2120 wrote to memory of 2788 2120 ttthtt.exe 34 PID 2788 wrote to memory of 2704 2788 5nntnt.exe 35 PID 2788 wrote to memory of 2704 2788 5nntnt.exe 35 PID 2788 wrote to memory of 2704 2788 5nntnt.exe 35 PID 2788 wrote to memory of 2704 2788 5nntnt.exe 35 PID 2704 wrote to memory of 2852 2704 1vpvj.exe 36 PID 2704 wrote to memory of 2852 2704 1vpvj.exe 36 PID 2704 wrote to memory of 2852 2704 1vpvj.exe 36 PID 2704 wrote to memory of 2852 2704 1vpvj.exe 36 PID 2852 wrote to memory of 2264 2852 xlffffl.exe 37 PID 2852 wrote to memory of 2264 2852 xlffffl.exe 37 PID 2852 wrote to memory of 2264 2852 xlffffl.exe 37 PID 2852 wrote to memory of 2264 2852 xlffffl.exe 37 PID 2264 wrote to memory of 2552 2264 ttntht.exe 38 PID 2264 wrote to memory of 2552 2264 ttntht.exe 38 PID 2264 wrote to memory of 2552 2264 ttntht.exe 38 PID 2264 wrote to memory of 2552 2264 ttntht.exe 38 PID 2552 wrote to memory of 2668 2552 vjppj.exe 39 PID 2552 wrote to memory of 2668 2552 vjppj.exe 39 PID 2552 wrote to memory of 2668 2552 vjppj.exe 39 PID 2552 wrote to memory of 2668 2552 vjppj.exe 39 PID 2668 wrote to memory of 2092 2668 xlxxxxx.exe 40 PID 2668 wrote to memory of 2092 2668 xlxxxxx.exe 40 PID 2668 wrote to memory of 2092 2668 xlxxxxx.exe 40 PID 2668 wrote to memory of 2092 2668 xlxxxxx.exe 40 PID 2092 wrote to memory of 836 2092 nhhhtt.exe 41 PID 2092 wrote to memory of 836 2092 nhhhtt.exe 41 PID 2092 wrote to memory of 836 2092 nhhhtt.exe 41 PID 2092 wrote to memory of 836 2092 nhhhtt.exe 41 PID 836 wrote to memory of 1052 836 jdvdj.exe 42 PID 836 wrote to memory of 1052 836 jdvdj.exe 42 PID 836 wrote to memory of 1052 836 jdvdj.exe 42 PID 836 wrote to memory of 1052 836 jdvdj.exe 42 PID 1052 wrote to memory of 2608 1052 dvjvj.exe 43 PID 1052 wrote to memory of 2608 1052 dvjvj.exe 43 PID 1052 wrote to memory of 2608 1052 dvjvj.exe 43 PID 1052 wrote to memory of 2608 1052 dvjvj.exe 43 PID 2608 wrote to memory of 2300 2608 7jvvv.exe 44 PID 2608 wrote to memory of 2300 2608 7jvvv.exe 44 PID 2608 wrote to memory of 2300 2608 7jvvv.exe 44 PID 2608 wrote to memory of 2300 2608 7jvvv.exe 44 PID 2300 wrote to memory of 1664 2300 3tnnbn.exe 45 PID 2300 wrote to memory of 1664 2300 3tnnbn.exe 45 PID 2300 wrote to memory of 1664 2300 3tnnbn.exe 45 PID 2300 wrote to memory of 1664 2300 3tnnbn.exe 45 PID 1664 wrote to memory of 2876 1664 ddppv.exe 46 PID 1664 wrote to memory of 2876 1664 ddppv.exe 46 PID 1664 wrote to memory of 2876 1664 ddppv.exe 46 PID 1664 wrote to memory of 2876 1664 ddppv.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\4847559b60ab1594de4b0f9a666fde6cddce4f18519bbc05ef692cbcb0f4a5e3.exe"C:\Users\Admin\AppData\Local\Temp\4847559b60ab1594de4b0f9a666fde6cddce4f18519bbc05ef692cbcb0f4a5e3.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\1pddj.exec:\1pddj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\rfflxxl.exec:\rfflxxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\ttthtt.exec:\ttthtt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\5nntnt.exec:\5nntnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\1vpvj.exec:\1vpvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\xlffffl.exec:\xlffffl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\ttntht.exec:\ttntht.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\vjppj.exec:\vjppj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\xlxxxxx.exec:\xlxxxxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\nhhhtt.exec:\nhhhtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\jdvdj.exec:\jdvdj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
\??\c:\dvjvj.exec:\dvjvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
\??\c:\7jvvv.exec:\7jvvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\3tnnbn.exec:\3tnnbn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\ddppv.exec:\ddppv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\lfrlrrf.exec:\lfrlrrf.exe17⤵
- Executes dropped EXE
PID:2876 -
\??\c:\3vddp.exec:\3vddp.exe18⤵
- Executes dropped EXE
PID:2956 -
\??\c:\xrllxfx.exec:\xrllxfx.exe19⤵
- Executes dropped EXE
PID:2960 -
\??\c:\pjvdd.exec:\pjvdd.exe20⤵
- Executes dropped EXE
PID:1704 -
\??\c:\3hntnt.exec:\3hntnt.exe21⤵
- Executes dropped EXE
PID:1132 -
\??\c:\jpdjv.exec:\jpdjv.exe22⤵
- Executes dropped EXE
PID:2496 -
\??\c:\fxrfxxr.exec:\fxrfxxr.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1844 -
\??\c:\pjvdj.exec:\pjvdj.exe24⤵
- Executes dropped EXE
PID:2032 -
\??\c:\xrrrxfl.exec:\xrrrxfl.exe25⤵
- Executes dropped EXE
PID:2940 -
\??\c:\1dpvd.exec:\1dpvd.exe26⤵
- Executes dropped EXE
PID:304 -
\??\c:\1vvpp.exec:\1vvpp.exe27⤵
- Executes dropped EXE
PID:1660 -
\??\c:\ttbbnn.exec:\ttbbnn.exe28⤵
- Executes dropped EXE
PID:1476 -
\??\c:\7pddp.exec:\7pddp.exe29⤵
- Executes dropped EXE
PID:2200 -
\??\c:\rllrlrl.exec:\rllrlrl.exe30⤵
- Executes dropped EXE
PID:2256 -
\??\c:\vpdpv.exec:\vpdpv.exe31⤵
- Executes dropped EXE
PID:288 -
\??\c:\lflrxfr.exec:\lflrxfr.exe32⤵
- Executes dropped EXE
PID:2512 -
\??\c:\nbbthh.exec:\nbbthh.exe33⤵
- Executes dropped EXE
PID:2468 -
\??\c:\dppvd.exec:\dppvd.exe34⤵
- Executes dropped EXE
PID:2340 -
\??\c:\lfxflrf.exec:\lfxflrf.exe35⤵
- Executes dropped EXE
PID:2164 -
\??\c:\pjjjp.exec:\pjjjp.exe36⤵
- Executes dropped EXE
PID:2396 -
\??\c:\3dppj.exec:\3dppj.exe37⤵
- Executes dropped EXE
PID:2792 -
\??\c:\lffrxfl.exec:\lffrxfl.exe38⤵
- Executes dropped EXE
PID:2700 -
\??\c:\tthnnt.exec:\tthnnt.exe39⤵
- Executes dropped EXE
PID:584 -
\??\c:\tnhtbh.exec:\tnhtbh.exe40⤵
- Executes dropped EXE
PID:2576 -
\??\c:\djvdp.exec:\djvdp.exe41⤵
- Executes dropped EXE
PID:1184 -
\??\c:\xrflxxr.exec:\xrflxxr.exe42⤵
- Executes dropped EXE
PID:2560 -
\??\c:\7bhhtt.exec:\7bhhtt.exe43⤵
- Executes dropped EXE
PID:2544 -
\??\c:\thtntt.exec:\thtntt.exe44⤵
- Executes dropped EXE
PID:2148 -
\??\c:\jdjjv.exec:\jdjjv.exe45⤵
- Executes dropped EXE
PID:612 -
\??\c:\fxrrrrx.exec:\fxrrrrx.exe46⤵
- Executes dropped EXE
PID:2008 -
\??\c:\rlrxfrx.exec:\rlrxfrx.exe47⤵
- Executes dropped EXE
PID:2768 -
\??\c:\bthnbn.exec:\bthnbn.exe48⤵
- Executes dropped EXE
PID:1604 -
\??\c:\vpddj.exec:\vpddj.exe49⤵
- Executes dropped EXE
PID:2536 -
\??\c:\pjvvd.exec:\pjvvd.exe50⤵
- Executes dropped EXE
PID:1616 -
\??\c:\xrlrlxl.exec:\xrlrlxl.exe51⤵
- Executes dropped EXE
PID:1664 -
\??\c:\tnnntb.exec:\tnnntb.exe52⤵
- Executes dropped EXE
PID:1788 -
\??\c:\hbtbbn.exec:\hbtbbn.exe53⤵
- Executes dropped EXE
PID:2928 -
\??\c:\pjdvv.exec:\pjdvv.exe54⤵
- Executes dropped EXE
PID:2840 -
\??\c:\xlxfrrr.exec:\xlxfrrr.exe55⤵
- Executes dropped EXE
PID:2892 -
\??\c:\7lfrflx.exec:\7lfrflx.exe56⤵
- Executes dropped EXE
PID:2916 -
\??\c:\1tbhnn.exec:\1tbhnn.exe57⤵
- Executes dropped EXE
PID:2072 -
\??\c:\3vjjv.exec:\3vjjv.exe58⤵
- Executes dropped EXE
PID:2872 -
\??\c:\fxrxlrl.exec:\fxrxlrl.exe59⤵
- Executes dropped EXE
PID:372 -
\??\c:\9rxxllr.exec:\9rxxllr.exe60⤵
- Executes dropped EXE
PID:1496 -
\??\c:\htbbbt.exec:\htbbbt.exe61⤵
- Executes dropped EXE
PID:1596 -
\??\c:\ppdpv.exec:\ppdpv.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1700 -
\??\c:\jvjpj.exec:\jvjpj.exe63⤵
- Executes dropped EXE
PID:1708 -
\??\c:\rlfxrrl.exec:\rlfxrrl.exe64⤵
- Executes dropped EXE
PID:604 -
\??\c:\thttnt.exec:\thttnt.exe65⤵
- Executes dropped EXE
PID:1752 -
\??\c:\nbbthh.exec:\nbbthh.exe66⤵PID:2520
-
\??\c:\jvppd.exec:\jvppd.exe67⤵PID:768
-
\??\c:\xrlrfrf.exec:\xrlrfrf.exe68⤵PID:2272
-
\??\c:\thbbhb.exec:\thbbhb.exe69⤵PID:2160
-
\??\c:\ddvdj.exec:\ddvdj.exe70⤵PID:1632
-
\??\c:\dpdvd.exec:\dpdvd.exe71⤵PID:296
-
\??\c:\3lflrrx.exec:\3lflrrx.exe72⤵PID:1628
-
\??\c:\tnhtbb.exec:\tnhtbb.exe73⤵PID:1728
-
\??\c:\9hnhbb.exec:\9hnhbb.exe74⤵PID:1976
-
\??\c:\9vddp.exec:\9vddp.exe75⤵PID:1156
-
\??\c:\rxfrrxl.exec:\rxfrrxl.exe76⤵PID:2728
-
\??\c:\7xrfrrf.exec:\7xrfrrf.exe77⤵PID:2472
-
\??\c:\bnhhnt.exec:\bnhhnt.exe78⤵PID:2696
-
\??\c:\ppdpd.exec:\ppdpd.exe79⤵PID:2396
-
\??\c:\pdvdp.exec:\pdvdp.exe80⤵PID:2792
-
\??\c:\5fxxxfr.exec:\5fxxxfr.exe81⤵PID:2676
-
\??\c:\hthnbb.exec:\hthnbb.exe82⤵PID:2748
-
\??\c:\ttnnbh.exec:\ttnnbh.exe83⤵PID:2596
-
\??\c:\dvdjv.exec:\dvdjv.exe84⤵PID:2264
-
\??\c:\lfxfrrf.exec:\lfxfrrf.exe85⤵PID:2824
-
\??\c:\lxrrxfx.exec:\lxrrxfx.exe86⤵PID:1760
-
\??\c:\tnbbhn.exec:\tnbbhn.exe87⤵PID:2668
-
\??\c:\7jvdv.exec:\7jvdv.exe88⤵PID:2392
-
\??\c:\3jdjv.exec:\3jdjv.exe89⤵PID:340
-
\??\c:\1xxxxxf.exec:\1xxxxxf.exe90⤵PID:976
-
\??\c:\nnnbht.exec:\nnnbht.exe91⤵PID:484
-
\??\c:\tnbhtt.exec:\tnbhtt.exe92⤵PID:1836
-
\??\c:\vpdjd.exec:\vpdjd.exe93⤵PID:2752
-
\??\c:\xlrrxxf.exec:\xlrrxxf.exe94⤵PID:2052
-
\??\c:\ffrlrll.exec:\ffrlrll.exe95⤵PID:1416
-
\??\c:\7nnnbt.exec:\7nnnbt.exe96⤵PID:1600
-
\??\c:\pvpdp.exec:\pvpdp.exe97⤵PID:1808
-
\??\c:\pjvdj.exec:\pjvdj.exe98⤵PID:2924
-
\??\c:\9xrrxfl.exec:\9xrrxfl.exe99⤵PID:1988
-
\??\c:\tnhbbh.exec:\tnhbbh.exe100⤵PID:2236
-
\??\c:\tbhntt.exec:\tbhntt.exe101⤵PID:1048
-
\??\c:\jdvdj.exec:\jdvdj.exe102⤵PID:1028
-
\??\c:\9vjpv.exec:\9vjpv.exe103⤵PID:832
-
\??\c:\httntn.exec:\httntn.exe104⤵PID:1496
-
\??\c:\tnnnbh.exec:\tnnnbh.exe105⤵PID:672
-
\??\c:\jvpvd.exec:\jvpvd.exe106⤵PID:2936
-
\??\c:\flxxlrf.exec:\flxxlrf.exe107⤵PID:3020
-
\??\c:\7xlrxfl.exec:\7xlrxfl.exe108⤵PID:2412
-
\??\c:\7htnbt.exec:\7htnbt.exe109⤵PID:1528
-
\??\c:\jdppv.exec:\jdppv.exe110⤵PID:1960
-
\??\c:\vppdj.exec:\vppdj.exe111⤵PID:568
-
\??\c:\rllfrrx.exec:\rllfrrx.exe112⤵PID:760
-
\??\c:\3bhhth.exec:\3bhhth.exe113⤵PID:2272
-
\??\c:\nhbbht.exec:\nhbbht.exe114⤵PID:1724
-
\??\c:\dvjdd.exec:\dvjdd.exe115⤵PID:876
-
\??\c:\frllrlr.exec:\frllrlr.exe116⤵PID:1768
-
\??\c:\1lxxlrr.exec:\1lxxlrr.exe117⤵PID:2432
-
\??\c:\nnbhtt.exec:\nnbhtt.exe118⤵PID:2456
-
\??\c:\dvvpd.exec:\dvvpd.exe119⤵PID:1124
-
\??\c:\jdpvd.exec:\jdpvd.exe120⤵PID:1156
-
\??\c:\xlxlrrx.exec:\xlxlrrx.exe121⤵PID:2312
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-