Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 20:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a467830b48f4ae74ed93025831647e984c9616ad4bbf4d3450d9cddeb81b54deN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
a467830b48f4ae74ed93025831647e984c9616ad4bbf4d3450d9cddeb81b54deN.exe
-
Size
454KB
-
MD5
1f63b1e218d7855f4113ccf2ac095310
-
SHA1
b084b62beaf064ee27eee1eae21a898f31ae539e
-
SHA256
a467830b48f4ae74ed93025831647e984c9616ad4bbf4d3450d9cddeb81b54de
-
SHA512
f5ed7b42a0b5990aca4007471871ad20545f972443bb8df13ba1e50e7e2d06a82fddc2611a6374790d557af787cf2bfe8c87b62fdb2514b75e8d42b41b526d40
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeG:q7Tc2NYHUrAwfMp3CDG
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/2980-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1856-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2068-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1684-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1284-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1612-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2100-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2076-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2076-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1696-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1544-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1088-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1780-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-297-0x0000000076EA0000-0x0000000076FBF000-memory.dmp family_blackmoon behavioral1/memory/2148-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2072-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1616-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-402-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/860-499-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-613-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1932-627-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-675-0x0000000001C50000-0x0000000001C7A000-memory.dmp family_blackmoon behavioral1/memory/1676-705-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2408-781-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1508-1106-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2696-1149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2728 7tthnt.exe 1856 pppdp.exe 2836 hhntbh.exe 2852 rlflrxr.exe 2580 tnhtnt.exe 2716 5ddpp.exe 2592 ntnbhb.exe 2612 hhnbnb.exe 2888 9xxrlrl.exe 2068 tnhnbn.exe 1684 lllrrrl.exe 1284 pjdjp.exe 1156 lrrfrxl.exe 2920 vdvpj.exe 2944 rrlfxrf.exe 2956 hbbnhb.exe 1612 5pjpd.exe 2100 hhhbnt.exe 3008 rfllrll.exe 2076 ntntht.exe 2340 jjpjd.exe 964 nnntnt.exe 2344 9ppjd.exe 1696 hhbthh.exe 1544 dddjp.exe 1088 ntnhht.exe 1652 rlxxflr.exe 1760 bnbnnb.exe 1780 ffflflf.exe 3032 nnhbtb.exe 1756 ddvvd.exe 2456 nnhntb.exe 2728 btnnbh.exe 2816 jddjv.exe 2708 djpvj.exe 2840 9rflfll.exe 2872 bhhnbn.exe 2912 9vpvv.exe 2664 rlrllll.exe 2544 lxrxlrl.exe 2148 tbtbhn.exe 2608 7djpv.exe 2072 rrfxflr.exe 1616 hhnntt.exe 3048 3tnnhh.exe 2236 5jpdj.exe 2960 rlfxllx.exe 2788 hbnntb.exe 2892 jdvvj.exe 808 9dvjv.exe 2288 9lflxxf.exe 2916 bbbnhn.exe 1524 pvvjv.exe 1348 xxrlffr.exe 2528 bhbtbh.exe 3020 9hbhnb.exe 2184 jjdjv.exe 600 xxxrlrf.exe 2056 9bbnhn.exe 840 vpjpj.exe 932 7dvdj.exe 860 fxrfflf.exe 1084 hbtbnt.exe 1696 5dvjd.exe -
resource yara_rule behavioral1/memory/2980-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1856-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1856-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-36-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2580-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1284-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1544-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1088-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1780-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/860-499-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-561-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1552-580-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-613-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-627-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-762-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-781-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-794-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-958-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1168-1053-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/812-1078-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-1149-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lflxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbttnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btttbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9httbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hnbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbthtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xrxrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rllxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thttnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrfxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2980 wrote to memory of 2728 2980 a467830b48f4ae74ed93025831647e984c9616ad4bbf4d3450d9cddeb81b54deN.exe 31 PID 2980 wrote to memory of 2728 2980 a467830b48f4ae74ed93025831647e984c9616ad4bbf4d3450d9cddeb81b54deN.exe 31 PID 2980 wrote to memory of 2728 2980 a467830b48f4ae74ed93025831647e984c9616ad4bbf4d3450d9cddeb81b54deN.exe 31 PID 2980 wrote to memory of 2728 2980 a467830b48f4ae74ed93025831647e984c9616ad4bbf4d3450d9cddeb81b54deN.exe 31 PID 2728 wrote to memory of 1856 2728 7tthnt.exe 32 PID 2728 wrote to memory of 1856 2728 7tthnt.exe 32 PID 2728 wrote to memory of 1856 2728 7tthnt.exe 32 PID 2728 wrote to memory of 1856 2728 7tthnt.exe 32 PID 1856 wrote to memory of 2836 1856 pppdp.exe 33 PID 1856 wrote to memory of 2836 1856 pppdp.exe 33 PID 1856 wrote to memory of 2836 1856 pppdp.exe 33 PID 1856 wrote to memory of 2836 1856 pppdp.exe 33 PID 2836 wrote to memory of 2852 2836 hhntbh.exe 34 PID 2836 wrote to memory of 2852 2836 hhntbh.exe 34 PID 2836 wrote to memory of 2852 2836 hhntbh.exe 34 PID 2836 wrote to memory of 2852 2836 hhntbh.exe 34 PID 2852 wrote to memory of 2580 2852 rlflrxr.exe 35 PID 2852 wrote to memory of 2580 2852 rlflrxr.exe 35 PID 2852 wrote to memory of 2580 2852 rlflrxr.exe 35 PID 2852 wrote to memory of 2580 2852 rlflrxr.exe 35 PID 2580 wrote to memory of 2716 2580 tnhtnt.exe 36 PID 2580 wrote to memory of 2716 2580 tnhtnt.exe 36 PID 2580 wrote to memory of 2716 2580 tnhtnt.exe 36 PID 2580 wrote to memory of 2716 2580 tnhtnt.exe 36 PID 2716 wrote to memory of 2592 2716 5ddpp.exe 37 PID 2716 wrote to memory of 2592 2716 5ddpp.exe 37 PID 2716 wrote to memory of 2592 2716 5ddpp.exe 37 PID 2716 wrote to memory of 2592 2716 5ddpp.exe 37 PID 2592 wrote to memory of 2612 2592 ntnbhb.exe 38 PID 2592 wrote to memory of 2612 2592 ntnbhb.exe 38 PID 2592 wrote to memory of 2612 2592 ntnbhb.exe 38 PID 2592 wrote to memory of 2612 2592 ntnbhb.exe 38 PID 2612 wrote to memory of 2888 2612 hhnbnb.exe 39 PID 2612 wrote to memory of 2888 2612 hhnbnb.exe 39 PID 2612 wrote to memory of 2888 2612 hhnbnb.exe 39 PID 2612 wrote to memory of 2888 2612 hhnbnb.exe 39 PID 2888 wrote to memory of 2068 2888 9xxrlrl.exe 40 PID 2888 wrote to memory of 2068 2888 9xxrlrl.exe 40 PID 2888 wrote to memory of 2068 2888 9xxrlrl.exe 40 PID 2888 wrote to memory of 2068 2888 9xxrlrl.exe 40 PID 2068 wrote to memory of 1684 2068 tnhnbn.exe 41 PID 2068 wrote to memory of 1684 2068 tnhnbn.exe 41 PID 2068 wrote to memory of 1684 2068 tnhnbn.exe 41 PID 2068 wrote to memory of 1684 2068 tnhnbn.exe 41 PID 1684 wrote to memory of 1284 1684 lllrrrl.exe 42 PID 1684 wrote to memory of 1284 1684 lllrrrl.exe 42 PID 1684 wrote to memory of 1284 1684 lllrrrl.exe 42 PID 1684 wrote to memory of 1284 1684 lllrrrl.exe 42 PID 1284 wrote to memory of 1156 1284 pjdjp.exe 43 PID 1284 wrote to memory of 1156 1284 pjdjp.exe 43 PID 1284 wrote to memory of 1156 1284 pjdjp.exe 43 PID 1284 wrote to memory of 1156 1284 pjdjp.exe 43 PID 1156 wrote to memory of 2920 1156 lrrfrxl.exe 44 PID 1156 wrote to memory of 2920 1156 lrrfrxl.exe 44 PID 1156 wrote to memory of 2920 1156 lrrfrxl.exe 44 PID 1156 wrote to memory of 2920 1156 lrrfrxl.exe 44 PID 2920 wrote to memory of 2944 2920 vdvpj.exe 45 PID 2920 wrote to memory of 2944 2920 vdvpj.exe 45 PID 2920 wrote to memory of 2944 2920 vdvpj.exe 45 PID 2920 wrote to memory of 2944 2920 vdvpj.exe 45 PID 2944 wrote to memory of 2956 2944 rrlfxrf.exe 46 PID 2944 wrote to memory of 2956 2944 rrlfxrf.exe 46 PID 2944 wrote to memory of 2956 2944 rrlfxrf.exe 46 PID 2944 wrote to memory of 2956 2944 rrlfxrf.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\a467830b48f4ae74ed93025831647e984c9616ad4bbf4d3450d9cddeb81b54deN.exe"C:\Users\Admin\AppData\Local\Temp\a467830b48f4ae74ed93025831647e984c9616ad4bbf4d3450d9cddeb81b54deN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\7tthnt.exec:\7tthnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\pppdp.exec:\pppdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
\??\c:\hhntbh.exec:\hhntbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\rlflrxr.exec:\rlflrxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\tnhtnt.exec:\tnhtnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\5ddpp.exec:\5ddpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\ntnbhb.exec:\ntnbhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\hhnbnb.exec:\hhnbnb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\9xxrlrl.exec:\9xxrlrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\tnhnbn.exec:\tnhnbn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\lllrrrl.exec:\lllrrrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\pjdjp.exec:\pjdjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
\??\c:\lrrfrxl.exec:\lrrfrxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
\??\c:\vdvpj.exec:\vdvpj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\rrlfxrf.exec:\rrlfxrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\hbbnhb.exec:\hbbnhb.exe17⤵
- Executes dropped EXE
PID:2956 -
\??\c:\5pjpd.exec:\5pjpd.exe18⤵
- Executes dropped EXE
PID:1612 -
\??\c:\hhhbnt.exec:\hhhbnt.exe19⤵
- Executes dropped EXE
PID:2100 -
\??\c:\rfllrll.exec:\rfllrll.exe20⤵
- Executes dropped EXE
PID:3008 -
\??\c:\ntntht.exec:\ntntht.exe21⤵
- Executes dropped EXE
PID:2076 -
\??\c:\jjpjd.exec:\jjpjd.exe22⤵
- Executes dropped EXE
PID:2340 -
\??\c:\nnntnt.exec:\nnntnt.exe23⤵
- Executes dropped EXE
PID:964 -
\??\c:\9ppjd.exec:\9ppjd.exe24⤵
- Executes dropped EXE
PID:2344 -
\??\c:\hhbthh.exec:\hhbthh.exe25⤵
- Executes dropped EXE
PID:1696 -
\??\c:\dddjp.exec:\dddjp.exe26⤵
- Executes dropped EXE
PID:1544 -
\??\c:\ntnhht.exec:\ntnhht.exe27⤵
- Executes dropped EXE
PID:1088 -
\??\c:\rlxxflr.exec:\rlxxflr.exe28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1652 -
\??\c:\bnbnnb.exec:\bnbnnb.exe29⤵
- Executes dropped EXE
PID:1760 -
\??\c:\ffflflf.exec:\ffflflf.exe30⤵
- Executes dropped EXE
PID:1780 -
\??\c:\nnhbtb.exec:\nnhbtb.exe31⤵
- Executes dropped EXE
PID:3032 -
\??\c:\ddvvd.exec:\ddvvd.exe32⤵
- Executes dropped EXE
PID:1756 -
\??\c:\nnhntb.exec:\nnhntb.exe33⤵
- Executes dropped EXE
PID:2456 -
\??\c:\tttbhn.exec:\tttbhn.exe34⤵PID:1552
-
\??\c:\btnnbh.exec:\btnnbh.exe35⤵
- Executes dropped EXE
PID:2728 -
\??\c:\jddjv.exec:\jddjv.exe36⤵
- Executes dropped EXE
PID:2816 -
\??\c:\djpvj.exec:\djpvj.exe37⤵
- Executes dropped EXE
PID:2708 -
\??\c:\9rflfll.exec:\9rflfll.exe38⤵
- Executes dropped EXE
PID:2840 -
\??\c:\bhhnbn.exec:\bhhnbn.exe39⤵
- Executes dropped EXE
PID:2872 -
\??\c:\9vpvv.exec:\9vpvv.exe40⤵
- Executes dropped EXE
PID:2912 -
\??\c:\rlrllll.exec:\rlrllll.exe41⤵
- Executes dropped EXE
PID:2664 -
\??\c:\lxrxlrl.exec:\lxrxlrl.exe42⤵
- Executes dropped EXE
PID:2544 -
\??\c:\tbtbhn.exec:\tbtbhn.exe43⤵
- Executes dropped EXE
PID:2148 -
\??\c:\7djpv.exec:\7djpv.exe44⤵
- Executes dropped EXE
PID:2608 -
\??\c:\rrfxflr.exec:\rrfxflr.exe45⤵
- Executes dropped EXE
PID:2072 -
\??\c:\hhnntt.exec:\hhnntt.exe46⤵
- Executes dropped EXE
PID:1616 -
\??\c:\3tnnhh.exec:\3tnnhh.exe47⤵
- Executes dropped EXE
PID:3048 -
\??\c:\5jpdj.exec:\5jpdj.exe48⤵
- Executes dropped EXE
PID:2236 -
\??\c:\rlfxllx.exec:\rlfxllx.exe49⤵
- Executes dropped EXE
PID:2960 -
\??\c:\hbnntb.exec:\hbnntb.exe50⤵
- Executes dropped EXE
PID:2788 -
\??\c:\jdvvj.exec:\jdvvj.exe51⤵
- Executes dropped EXE
PID:2892 -
\??\c:\9dvjv.exec:\9dvjv.exe52⤵
- Executes dropped EXE
PID:808 -
\??\c:\9lflxxf.exec:\9lflxxf.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2288 -
\??\c:\bbbnhn.exec:\bbbnhn.exe54⤵
- Executes dropped EXE
PID:2916 -
\??\c:\pvvjv.exec:\pvvjv.exe55⤵
- Executes dropped EXE
PID:1524 -
\??\c:\xxrlffr.exec:\xxrlffr.exe56⤵
- Executes dropped EXE
PID:1348 -
\??\c:\bhbtbh.exec:\bhbtbh.exe57⤵
- Executes dropped EXE
PID:2528 -
\??\c:\9hbhnb.exec:\9hbhnb.exe58⤵
- Executes dropped EXE
PID:3020 -
\??\c:\jjdjv.exec:\jjdjv.exe59⤵
- Executes dropped EXE
PID:2184 -
\??\c:\xxxrlrf.exec:\xxxrlrf.exe60⤵
- Executes dropped EXE
PID:600 -
\??\c:\9bbnhn.exec:\9bbnhn.exe61⤵
- Executes dropped EXE
PID:2056 -
\??\c:\vpjpj.exec:\vpjpj.exe62⤵
- Executes dropped EXE
PID:840 -
\??\c:\7dvdj.exec:\7dvdj.exe63⤵
- Executes dropped EXE
PID:932 -
\??\c:\fxrfflf.exec:\fxrfflf.exe64⤵
- Executes dropped EXE
PID:860 -
\??\c:\hbtbnt.exec:\hbtbnt.exe65⤵
- Executes dropped EXE
PID:1084 -
\??\c:\5dvjd.exec:\5dvjd.exe66⤵
- Executes dropped EXE
PID:1696 -
\??\c:\vvvpv.exec:\vvvpv.exe67⤵PID:1964
-
\??\c:\3xlffll.exec:\3xlffll.exe68⤵PID:2732
-
\??\c:\nhhtth.exec:\nhhtth.exe69⤵PID:1088
-
\??\c:\pvpdv.exec:\pvpdv.exe70⤵PID:1572
-
\??\c:\dvvdj.exec:\dvvdj.exe71⤵PID:2444
-
\??\c:\lllrflr.exec:\lllrflr.exe72⤵PID:1900
-
\??\c:\3httbh.exec:\3httbh.exe73⤵PID:1780
-
\??\c:\7vvjp.exec:\7vvjp.exe74⤵PID:2064
-
\??\c:\jdpjp.exec:\jdpjp.exe75⤵PID:2856
-
\??\c:\rxrrflx.exec:\rxrrflx.exe76⤵PID:2660
-
\??\c:\bhnhth.exec:\bhnhth.exe77⤵PID:1584
-
\??\c:\nthbth.exec:\nthbth.exe78⤵PID:1552
-
\??\c:\vddvj.exec:\vddvj.exe79⤵PID:2692
-
\??\c:\3xlrllx.exec:\3xlrllx.exe80⤵PID:2020
-
\??\c:\hbbhnb.exec:\hbbhnb.exe81⤵PID:2684
-
\??\c:\5jvdj.exec:\5jvdj.exe82⤵PID:2988
-
\??\c:\djjjp.exec:\djjjp.exe83⤵PID:836
-
\??\c:\xxxfxfl.exec:\xxxfxfl.exe84⤵PID:1932
-
\??\c:\hhbhhn.exec:\hhbhhn.exe85⤵PID:2624
-
\??\c:\thtntn.exec:\thtntn.exe86⤵PID:1796
-
\??\c:\vppdd.exec:\vppdd.exe87⤵PID:2400
-
\??\c:\llfrllf.exec:\llfrllf.exe88⤵PID:680
-
\??\c:\bbthbh.exec:\bbthbh.exe89⤵PID:1344
-
\??\c:\jpjvd.exec:\jpjvd.exe90⤵PID:2052
-
\??\c:\9jdjv.exec:\9jdjv.exe91⤵PID:2636
-
\??\c:\lxxllxr.exec:\lxxllxr.exe92⤵PID:2784
-
\??\c:\nhbnbh.exec:\nhbnbh.exe93⤵PID:2776
-
\??\c:\jdpdv.exec:\jdpdv.exe94⤵PID:2868
-
\??\c:\pjjpj.exec:\pjjpj.exe95⤵PID:2920
-
\??\c:\fxfxfxl.exec:\fxfxfxl.exe96⤵PID:1676
-
\??\c:\tnhntt.exec:\tnhntt.exe97⤵
- System Location Discovery: System Language Discovery
PID:2972 -
\??\c:\bhbbtt.exec:\bhbbtt.exe98⤵PID:2916
-
\??\c:\5pjjv.exec:\5pjjv.exe99⤵PID:280
-
\??\c:\rllxllx.exec:\rllxllx.exe100⤵PID:2136
-
\??\c:\5lflxfx.exec:\5lflxfx.exe101⤵PID:3000
-
\??\c:\hhthbh.exec:\hhthbh.exe102⤵PID:3020
-
\??\c:\pjddv.exec:\pjddv.exe103⤵PID:2060
-
\??\c:\rlxxlrx.exec:\rlxxlrx.exe104⤵PID:2080
-
\??\c:\xrllxxl.exec:\xrllxxl.exe105⤵PID:2520
-
\??\c:\bhbbnt.exec:\bhbbnt.exe106⤵PID:2496
-
\??\c:\ppdjp.exec:\ppdjp.exe107⤵PID:864
-
\??\c:\9ppvj.exec:\9ppvj.exe108⤵PID:2408
-
\??\c:\lfflrxl.exec:\lfflrxl.exe109⤵PID:1772
-
\??\c:\9nhtth.exec:\9nhtth.exe110⤵PID:1404
-
\??\c:\dvvvv.exec:\dvvvv.exe111⤵PID:2032
-
\??\c:\pjvpv.exec:\pjvpv.exe112⤵PID:988
-
\??\c:\lflrllf.exec:\lflrllf.exe113⤵PID:1652
-
\??\c:\bbtthh.exec:\bbtthh.exe114⤵
- System Location Discovery: System Language Discovery
PID:1760 -
\??\c:\9pdjj.exec:\9pdjj.exe115⤵PID:1184
-
\??\c:\ffxfrxx.exec:\ffxfrxx.exe116⤵PID:2272
-
\??\c:\bntnht.exec:\bntnht.exe117⤵PID:2428
-
\??\c:\bhtnbh.exec:\bhtnbh.exe118⤵PID:1756
-
\??\c:\lllrlxr.exec:\lllrlxr.exe119⤵PID:2640
-
\??\c:\tbbnnt.exec:\tbbnnt.exe120⤵PID:1592
-
\??\c:\3jdpv.exec:\3jdpv.exe121⤵PID:2680
-
\??\c:\vddjj.exec:\vddjj.exe122⤵PID:2808
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-