Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 01:50
Behavioral task
behavioral1
Sample
750322caf9645bfaa4ff59a32ba273d3376a0bdd4ab29294de438d758d7a81c5.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
150 seconds
General
-
Target
750322caf9645bfaa4ff59a32ba273d3376a0bdd4ab29294de438d758d7a81c5.exe
-
Size
332KB
-
MD5
e11cd07de57c4fad1a33b26e6963586c
-
SHA1
8fb5dc6c0e90ba0aca2efd61a605f1533e961b50
-
SHA256
750322caf9645bfaa4ff59a32ba273d3376a0bdd4ab29294de438d758d7a81c5
-
SHA512
024377bfd910583aa873f93e642525120a818ab684e4f6eb3b2cae4fa75031c2bdba03213aa49facbf784e54798189093a2fd86340dece43da75c3a256ec921e
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeK:R4wFHoSHYHUrAwfMp3CDK
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/1976-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2544-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2560-23-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2560-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2412-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1984-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2176-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2892-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2792-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2660-88-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1880-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2676-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2684-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2036-121-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1104-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2916-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2276-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2584-181-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/1048-189-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/936-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/376-226-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2612-244-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1400-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1440-257-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1696-273-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2508-279-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2224-281-0x0000000077910000-0x0000000077A2F000-memory.dmp family_blackmoon behavioral1/memory/1588-288-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2544-299-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2840-357-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2468-436-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1600-479-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1284-523-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1684-559-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2760-602-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2684-649-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2720-662-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/2584-723-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2716-829-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/2380-835-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1476-966-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2564-1071-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2904-1108-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2764-1114-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2732-1130-0x00000000003B0000-0x00000000003D7000-memory.dmp family_blackmoon behavioral1/memory/2316-1198-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1528-1247-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/1748-1246-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2224-19405-0x0000000077910000-0x0000000077A2F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2544 rlrxlfl.exe 2560 jddpv.exe 2412 rxfxfxf.exe 1984 jjvvj.exe 2176 fxflrfr.exe 2760 7bhhtt.exe 2892 jpdjd.exe 2640 rrxxxrl.exe 2792 hhhnth.exe 2660 vvpvv.exe 1880 nhnhnn.exe 2676 nbhnnn.exe 2684 3xlffxx.exe 2036 3bhttt.exe 1104 ddjpv.exe 2956 flrrrrr.exe 2128 vvjjp.exe 576 fxxffrx.exe 2916 hbbbhh.exe 1596 jdddv.exe 2276 5rffllr.exe 2584 btttbb.exe 1048 jddvp.exe 2672 llrlxxl.exe 1532 ddjpd.exe 1264 3rxrrll.exe 936 7nbbtt.exe 376 5vddj.exe 688 1lxlxlr.exe 1400 jjjjp.exe 2612 dvpvj.exe 1440 rxxxrxr.exe 2296 vpjvv.exe 2268 jvdjv.exe 1696 5xlrlrr.exe 2508 1flxfff.exe 2224 1nbnnh.exe 1684 bntbhh.exe 2544 hhnntt.exe 2416 7vddj.exe 2212 ddvdj.exe 2900 lrfxfff.exe 2084 httttb.exe 2176 nnnhnn.exe 2504 vpvvv.exe 2780 9vjpp.exe 2872 fxxllff.exe 3012 tnnhhh.exe 2484 tnnnhb.exe 2840 7jjjd.exe 2804 5lllrrr.exe 2680 flxxflr.exe 2644 tntnnn.exe 2384 vppjj.exe 2148 jjpjv.exe 1620 rxrrflr.exe 2036 9lrrxxx.exe 2964 nbhntn.exe 2604 btthhb.exe 2140 pvjpd.exe 2692 3lxrxxx.exe 272 xxrflrr.exe 748 hbbtbt.exe 2056 9hnbhh.exe -
resource yara_rule behavioral1/memory/1976-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1976-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2544-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000120fe-8.dat upx behavioral1/files/0x0008000000016d4a-16.dat upx behavioral1/memory/2544-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2560-23-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0007000000016d4e-24.dat upx behavioral1/memory/2560-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016d55-33.dat upx behavioral1/memory/2412-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016d71-41.dat upx behavioral1/memory/1984-40-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/1984-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2176-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016dc6-49.dat upx behavioral1/files/0x0009000000016dc9-57.dat upx behavioral1/memory/2892-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016dd1-65.dat upx behavioral1/files/0x00050000000194e3-72.dat upx behavioral1/memory/2792-79-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194e7-80.dat upx behavioral1/files/0x00050000000194e9-89.dat upx behavioral1/files/0x00050000000194ef-97.dat upx behavioral1/memory/1880-96-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194f3-104.dat upx behavioral1/memory/2676-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019524-113.dat upx behavioral1/memory/2684-112-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001954e-120.dat upx behavioral1/memory/2036-121-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001956c-128.dat upx behavioral1/memory/1104-129-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019570-136.dat upx behavioral1/files/0x000500000001958e-143.dat upx behavioral1/files/0x0009000000016d21-150.dat upx behavioral1/memory/2916-157-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195d6-158.dat upx behavioral1/memory/2276-168-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019604-166.dat upx behavioral1/files/0x0005000000019605-174.dat upx behavioral1/files/0x0005000000019606-183.dat upx behavioral1/files/0x0005000000019608-190.dat upx behavioral1/memory/1048-189-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001960a-197.dat upx behavioral1/files/0x000500000001960c-204.dat upx behavioral1/files/0x000500000001961c-211.dat upx behavioral1/memory/936-218-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001961e-219.dat upx behavioral1/memory/376-226-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019667-227.dat upx behavioral1/files/0x00050000000196a1-234.dat upx behavioral1/files/0x0005000000019926-241.dat upx behavioral1/memory/2612-244-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1400-242-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019c34-250.dat upx behavioral1/memory/1696-273-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2508-279-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2224-280-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/1588-288-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2416-300-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2544-299-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2900-311-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2840-357-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxrfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxfrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lrrxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhntbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1976 wrote to memory of 2544 1976 750322caf9645bfaa4ff59a32ba273d3376a0bdd4ab29294de438d758d7a81c5.exe 30 PID 1976 wrote to memory of 2544 1976 750322caf9645bfaa4ff59a32ba273d3376a0bdd4ab29294de438d758d7a81c5.exe 30 PID 1976 wrote to memory of 2544 1976 750322caf9645bfaa4ff59a32ba273d3376a0bdd4ab29294de438d758d7a81c5.exe 30 PID 1976 wrote to memory of 2544 1976 750322caf9645bfaa4ff59a32ba273d3376a0bdd4ab29294de438d758d7a81c5.exe 30 PID 2544 wrote to memory of 2560 2544 rlrxlfl.exe 31 PID 2544 wrote to memory of 2560 2544 rlrxlfl.exe 31 PID 2544 wrote to memory of 2560 2544 rlrxlfl.exe 31 PID 2544 wrote to memory of 2560 2544 rlrxlfl.exe 31 PID 2560 wrote to memory of 2412 2560 jddpv.exe 32 PID 2560 wrote to memory of 2412 2560 jddpv.exe 32 PID 2560 wrote to memory of 2412 2560 jddpv.exe 32 PID 2560 wrote to memory of 2412 2560 jddpv.exe 32 PID 2412 wrote to memory of 1984 2412 rxfxfxf.exe 33 PID 2412 wrote to memory of 1984 2412 rxfxfxf.exe 33 PID 2412 wrote to memory of 1984 2412 rxfxfxf.exe 33 PID 2412 wrote to memory of 1984 2412 rxfxfxf.exe 33 PID 1984 wrote to memory of 2176 1984 jjvvj.exe 34 PID 1984 wrote to memory of 2176 1984 jjvvj.exe 34 PID 1984 wrote to memory of 2176 1984 jjvvj.exe 34 PID 1984 wrote to memory of 2176 1984 jjvvj.exe 34 PID 2176 wrote to memory of 2760 2176 fxflrfr.exe 35 PID 2176 wrote to memory of 2760 2176 fxflrfr.exe 35 PID 2176 wrote to memory of 2760 2176 fxflrfr.exe 35 PID 2176 wrote to memory of 2760 2176 fxflrfr.exe 35 PID 2760 wrote to memory of 2892 2760 7bhhtt.exe 36 PID 2760 wrote to memory of 2892 2760 7bhhtt.exe 36 PID 2760 wrote to memory of 2892 2760 7bhhtt.exe 36 PID 2760 wrote to memory of 2892 2760 7bhhtt.exe 36 PID 2892 wrote to memory of 2640 2892 jpdjd.exe 37 PID 2892 wrote to memory of 2640 2892 jpdjd.exe 37 PID 2892 wrote to memory of 2640 2892 jpdjd.exe 37 PID 2892 wrote to memory of 2640 2892 jpdjd.exe 37 PID 2640 wrote to memory of 2792 2640 rrxxxrl.exe 38 PID 2640 wrote to memory of 2792 2640 rrxxxrl.exe 38 PID 2640 wrote to memory of 2792 2640 rrxxxrl.exe 38 PID 2640 wrote to memory of 2792 2640 rrxxxrl.exe 38 PID 2792 wrote to memory of 2660 2792 hhhnth.exe 39 PID 2792 wrote to memory of 2660 2792 hhhnth.exe 39 PID 2792 wrote to memory of 2660 2792 hhhnth.exe 39 PID 2792 wrote to memory of 2660 2792 hhhnth.exe 39 PID 2660 wrote to memory of 1880 2660 vvpvv.exe 40 PID 2660 wrote to memory of 1880 2660 vvpvv.exe 40 PID 2660 wrote to memory of 1880 2660 vvpvv.exe 40 PID 2660 wrote to memory of 1880 2660 vvpvv.exe 40 PID 1880 wrote to memory of 2676 1880 nhnhnn.exe 41 PID 1880 wrote to memory of 2676 1880 nhnhnn.exe 41 PID 1880 wrote to memory of 2676 1880 nhnhnn.exe 41 PID 1880 wrote to memory of 2676 1880 nhnhnn.exe 41 PID 2676 wrote to memory of 2684 2676 nbhnnn.exe 42 PID 2676 wrote to memory of 2684 2676 nbhnnn.exe 42 PID 2676 wrote to memory of 2684 2676 nbhnnn.exe 42 PID 2676 wrote to memory of 2684 2676 nbhnnn.exe 42 PID 2684 wrote to memory of 2036 2684 3xlffxx.exe 43 PID 2684 wrote to memory of 2036 2684 3xlffxx.exe 43 PID 2684 wrote to memory of 2036 2684 3xlffxx.exe 43 PID 2684 wrote to memory of 2036 2684 3xlffxx.exe 43 PID 2036 wrote to memory of 1104 2036 3bhttt.exe 44 PID 2036 wrote to memory of 1104 2036 3bhttt.exe 44 PID 2036 wrote to memory of 1104 2036 3bhttt.exe 44 PID 2036 wrote to memory of 1104 2036 3bhttt.exe 44 PID 1104 wrote to memory of 2956 1104 ddjpv.exe 45 PID 1104 wrote to memory of 2956 1104 ddjpv.exe 45 PID 1104 wrote to memory of 2956 1104 ddjpv.exe 45 PID 1104 wrote to memory of 2956 1104 ddjpv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\750322caf9645bfaa4ff59a32ba273d3376a0bdd4ab29294de438d758d7a81c5.exe"C:\Users\Admin\AppData\Local\Temp\750322caf9645bfaa4ff59a32ba273d3376a0bdd4ab29294de438d758d7a81c5.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\rlrxlfl.exec:\rlrxlfl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\jddpv.exec:\jddpv.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\rxfxfxf.exec:\rxfxfxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\jjvvj.exec:\jjvvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\fxflrfr.exec:\fxflrfr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\7bhhtt.exec:\7bhhtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\jpdjd.exec:\jpdjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\rrxxxrl.exec:\rrxxxrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\hhhnth.exec:\hhhnth.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\vvpvv.exec:\vvpvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\nhnhnn.exec:\nhnhnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\nbhnnn.exec:\nbhnnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\3xlffxx.exec:\3xlffxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\3bhttt.exec:\3bhttt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\ddjpv.exec:\ddjpv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
\??\c:\flrrrrr.exec:\flrrrrr.exe17⤵
- Executes dropped EXE
PID:2956 -
\??\c:\vvjjp.exec:\vvjjp.exe18⤵
- Executes dropped EXE
PID:2128 -
\??\c:\fxxffrx.exec:\fxxffrx.exe19⤵
- Executes dropped EXE
PID:576 -
\??\c:\hbbbhh.exec:\hbbbhh.exe20⤵
- Executes dropped EXE
PID:2916 -
\??\c:\jdddv.exec:\jdddv.exe21⤵
- Executes dropped EXE
PID:1596 -
\??\c:\5rffllr.exec:\5rffllr.exe22⤵
- Executes dropped EXE
PID:2276 -
\??\c:\btttbb.exec:\btttbb.exe23⤵
- Executes dropped EXE
PID:2584 -
\??\c:\jddvp.exec:\jddvp.exe24⤵
- Executes dropped EXE
PID:1048 -
\??\c:\llrlxxl.exec:\llrlxxl.exe25⤵
- Executes dropped EXE
PID:2672 -
\??\c:\ddjpd.exec:\ddjpd.exe26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1532 -
\??\c:\3rxrrll.exec:\3rxrrll.exe27⤵
- Executes dropped EXE
PID:1264 -
\??\c:\7nbbtt.exec:\7nbbtt.exe28⤵
- Executes dropped EXE
PID:936 -
\??\c:\5vddj.exec:\5vddj.exe29⤵
- Executes dropped EXE
PID:376 -
\??\c:\1lxlxlr.exec:\1lxlxlr.exe30⤵
- Executes dropped EXE
PID:688 -
\??\c:\jjjjp.exec:\jjjjp.exe31⤵
- Executes dropped EXE
PID:1400 -
\??\c:\dvpvj.exec:\dvpvj.exe32⤵
- Executes dropped EXE
PID:2612 -
\??\c:\rxxxrxr.exec:\rxxxrxr.exe33⤵
- Executes dropped EXE
PID:1440 -
\??\c:\vpjvv.exec:\vpjvv.exe34⤵
- Executes dropped EXE
PID:2296 -
\??\c:\jvdjv.exec:\jvdjv.exe35⤵
- Executes dropped EXE
PID:2268 -
\??\c:\5xlrlrr.exec:\5xlrlrr.exe36⤵
- Executes dropped EXE
PID:1696 -
\??\c:\1flxfff.exec:\1flxfff.exe37⤵
- Executes dropped EXE
PID:2508 -
\??\c:\1nbnnh.exec:\1nbnnh.exe38⤵
- Executes dropped EXE
PID:2224 -
\??\c:\dppjd.exec:\dppjd.exe39⤵PID:1588
-
\??\c:\bntbhh.exec:\bntbhh.exe40⤵
- Executes dropped EXE
PID:1684 -
\??\c:\hhnntt.exec:\hhnntt.exe41⤵
- Executes dropped EXE
PID:2544 -
\??\c:\7vddj.exec:\7vddj.exe42⤵
- Executes dropped EXE
PID:2416 -
\??\c:\ddvdj.exec:\ddvdj.exe43⤵
- Executes dropped EXE
PID:2212 -
\??\c:\lrfxfff.exec:\lrfxfff.exe44⤵
- Executes dropped EXE
PID:2900 -
\??\c:\httttb.exec:\httttb.exe45⤵
- Executes dropped EXE
PID:2084 -
\??\c:\nnnhnn.exec:\nnnhnn.exe46⤵
- Executes dropped EXE
PID:2176 -
\??\c:\vpvvv.exec:\vpvvv.exe47⤵
- Executes dropped EXE
PID:2504 -
\??\c:\9vjpp.exec:\9vjpp.exe48⤵
- Executes dropped EXE
PID:2780 -
\??\c:\fxxllff.exec:\fxxllff.exe49⤵
- Executes dropped EXE
PID:2872 -
\??\c:\tnnhhh.exec:\tnnhhh.exe50⤵
- Executes dropped EXE
PID:3012 -
\??\c:\tnnnhb.exec:\tnnnhb.exe51⤵
- Executes dropped EXE
PID:2484 -
\??\c:\7jjjd.exec:\7jjjd.exe52⤵
- Executes dropped EXE
PID:2840 -
\??\c:\5lllrrr.exec:\5lllrrr.exe53⤵
- Executes dropped EXE
PID:2804 -
\??\c:\flxxflr.exec:\flxxflr.exe54⤵
- Executes dropped EXE
PID:2680 -
\??\c:\tntnnn.exec:\tntnnn.exe55⤵
- Executes dropped EXE
PID:2644 -
\??\c:\vppjj.exec:\vppjj.exe56⤵
- Executes dropped EXE
PID:2384 -
\??\c:\jjpjv.exec:\jjpjv.exe57⤵
- Executes dropped EXE
PID:2148 -
\??\c:\rxrrflr.exec:\rxrrflr.exe58⤵
- Executes dropped EXE
PID:1620 -
\??\c:\9lrrxxx.exec:\9lrrxxx.exe59⤵
- Executes dropped EXE
PID:2036 -
\??\c:\nbhntn.exec:\nbhntn.exe60⤵
- Executes dropped EXE
PID:2964 -
\??\c:\btthhb.exec:\btthhb.exe61⤵
- Executes dropped EXE
PID:2604 -
\??\c:\pvjpd.exec:\pvjpd.exe62⤵
- Executes dropped EXE
PID:2140 -
\??\c:\3lxrxxx.exec:\3lxrxxx.exe63⤵
- Executes dropped EXE
PID:2692 -
\??\c:\xxrflrr.exec:\xxrflrr.exe64⤵
- Executes dropped EXE
PID:272 -
\??\c:\hbbtbt.exec:\hbbtbt.exe65⤵
- Executes dropped EXE
PID:748 -
\??\c:\9hnbhh.exec:\9hnbhh.exe66⤵
- Executes dropped EXE
PID:2056 -
\??\c:\1djdv.exec:\1djdv.exe67⤵PID:2468
-
\??\c:\5xfrfxf.exec:\5xfrfxf.exe68⤵PID:2276
-
\??\c:\nhhhhn.exec:\nhhhhn.exe69⤵PID:2552
-
\??\c:\tnbttn.exec:\tnbttn.exe70⤵PID:1904
-
\??\c:\pjjjv.exec:\pjjjv.exe71⤵PID:2312
-
\??\c:\frlxxfl.exec:\frlxxfl.exe72⤵PID:1744
-
\??\c:\lfllrrr.exec:\lfllrrr.exe73⤵PID:820
-
\??\c:\1thnhh.exec:\1thnhh.exe74⤵PID:984
-
\??\c:\pvvpv.exec:\pvvpv.exe75⤵PID:1600
-
\??\c:\pjppp.exec:\pjppp.exe76⤵
- System Location Discovery: System Language Discovery
PID:2940 -
\??\c:\xrxrrrx.exec:\xrxrrrx.exe77⤵PID:1076
-
\??\c:\lrffrxf.exec:\lrffrxf.exe78⤵PID:892
-
\??\c:\hbhthh.exec:\hbhthh.exe79⤵PID:1800
-
\??\c:\vvvpv.exec:\vvvpv.exe80⤵PID:2476
-
\??\c:\jjpvj.exec:\jjpvj.exe81⤵PID:2100
-
\??\c:\xrffffl.exec:\xrffffl.exe82⤵PID:1540
-
\??\c:\xxllxxr.exec:\xxllxxr.exe83⤵PID:1440
-
\??\c:\hbhhnt.exec:\hbhhnt.exe84⤵PID:1284
-
\??\c:\nntnnh.exec:\nntnnh.exe85⤵PID:876
-
\??\c:\jjjdv.exec:\jjjdv.exe86⤵PID:2280
-
\??\c:\fxrxlfl.exec:\fxrxlfl.exe87⤵PID:2508
-
\??\c:\fxxxxfl.exec:\fxxxxfl.exe88⤵PID:2436
-
\??\c:\hhbttn.exec:\hhbttn.exe89⤵PID:1588
-
\??\c:\pvvvd.exec:\pvvvd.exe90⤵PID:1684
-
\??\c:\vvvdp.exec:\vvvdp.exe91⤵PID:792
-
\??\c:\lrfxflx.exec:\lrfxflx.exe92⤵PID:1908
-
\??\c:\7httbh.exec:\7httbh.exe93⤵PID:2196
-
\??\c:\3bnntn.exec:\3bnntn.exe94⤵PID:2900
-
\??\c:\dvdjj.exec:\dvdjj.exe95⤵PID:1984
-
\??\c:\ppvvv.exec:\ppvvv.exe96⤵PID:2176
-
\??\c:\7xlrrff.exec:\7xlrrff.exe97⤵PID:2768
-
\??\c:\7nbbhh.exec:\7nbbhh.exe98⤵PID:2760
-
\??\c:\ttttbb.exec:\ttttbb.exe99⤵PID:2756
-
\??\c:\jpddj.exec:\jpddj.exe100⤵PID:1716
-
\??\c:\jjvpv.exec:\jjvpv.exe101⤵PID:2776
-
\??\c:\xfllxxr.exec:\xfllxxr.exe102⤵PID:2660
-
\??\c:\nnntnn.exec:\nnntnn.exe103⤵PID:2804
-
\??\c:\bhnnbn.exec:\bhnnbn.exe104⤵PID:2680
-
\??\c:\dvdvv.exec:\dvdvv.exe105⤵PID:2648
-
\??\c:\djjjp.exec:\djjjp.exe106⤵PID:2664
-
\??\c:\1lrrxrr.exec:\1lrrxrr.exe107⤵PID:2684
-
\??\c:\5tnttb.exec:\5tnttb.exe108⤵PID:1412
-
\??\c:\vddjp.exec:\vddjp.exe109⤵PID:2036
-
\??\c:\jjpvv.exec:\jjpvv.exe110⤵PID:2720
-
\??\c:\xxxxrxx.exec:\xxxxrxx.exe111⤵PID:2360
-
\??\c:\xfllxxf.exec:\xfllxxf.exe112⤵PID:2140
-
\??\c:\5nttbb.exec:\5nttbb.exe113⤵PID:1396
-
\??\c:\pjvpv.exec:\pjvpv.exe114⤵PID:272
-
\??\c:\djdjj.exec:\djdjj.exe115⤵PID:748
-
\??\c:\1xflrff.exec:\1xflrff.exe116⤵PID:2056
-
\??\c:\xrxfrff.exec:\xrxfrff.exe117⤵
- System Location Discovery: System Language Discovery
PID:1896 -
\??\c:\hnntbh.exec:\hnntbh.exe118⤵PID:2584
-
\??\c:\3vppv.exec:\3vppv.exe119⤵PID:2552
-
\??\c:\jppdd.exec:\jppdd.exe120⤵PID:2616
-
\??\c:\llrfrxx.exec:\llrfrxx.exe121⤵PID:1048
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-