Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 03:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
73a6cd3af4ae4c6df85709d5373cd588d721b27fc95edf9b979629742a72ab79N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
73a6cd3af4ae4c6df85709d5373cd588d721b27fc95edf9b979629742a72ab79N.exe
-
Size
454KB
-
MD5
fb40289f8b0b561d943119de8d348710
-
SHA1
d174ce3006947689c7103aee59c9438c4732e5fc
-
SHA256
73a6cd3af4ae4c6df85709d5373cd588d721b27fc95edf9b979629742a72ab79
-
SHA512
721aa17d2a9c79bd77db8753cab4b8eaebcd7ded4c3ca86e209ba6631b08844964aa0160b1d1d9b11a5d76514e44ed848ceb90bd467d1059afe8601ad1e61fbf
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe8:q7Tc2NYHUrAwfMp3CD8
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/2156-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2420-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-47-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2744-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2332-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1804-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1804-97-0x0000000001C50000-0x0000000001C7A000-memory.dmp family_blackmoon behavioral1/memory/2672-111-0x00000000001E0000-0x000000000020A000-memory.dmp family_blackmoon behavioral1/memory/2672-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2392-124-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1432-146-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1432-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1604-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1252-178-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3060-183-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2236-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2084-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1888-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/320-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1776-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1728-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/996-307-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2340-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2176-318-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2728-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-402-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-415-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/840-436-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-458-0x0000000000270000-0x000000000029A000-memory.dmp family_blackmoon behavioral1/memory/2136-505-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-593-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-613-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1872-739-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-761-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1960-797-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2324-804-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2324-824-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1648-855-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2112-863-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2372-870-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2676 1vddj.exe 2420 lxffrxl.exe 2500 7bnnnn.exe 2864 ppvvd.exe 2744 bnbbnh.exe 2748 hbtbnt.exe 2332 rlxxrxl.exe 2756 fxffrlx.exe 1804 bnhntt.exe 2596 lfxxlrf.exe 2672 thbnnh.exe 2392 3dvvp.exe 3032 rrlrffr.exe 2060 5bnntn.exe 1432 pdjpd.exe 1604 1rxxxxx.exe 3020 1bnnbh.exe 1252 frxrrxf.exe 3060 vvppv.exe 2236 5fxxxfr.exe 2084 9nttbb.exe 1536 7pjpd.exe 1660 rlfflrl.exe 2108 1tbbhn.exe 1888 hthnnt.exe 2560 tnhbnt.exe 320 lfrrffl.exe 1800 bhnntb.exe 1776 rrlxllf.exe 1744 lfxfrfl.exe 1728 nhnttb.exe 1992 pjvvj.exe 996 xrllrrx.exe 2340 nhnbhh.exe 2176 vjvvj.exe 2348 fxrxllx.exe 2792 frfxfxf.exe 2932 9hbhnn.exe 2728 vpdjp.exe 2700 9jpdj.exe 2956 rrfxfxl.exe 2764 nbbbnh.exe 2652 5hbnth.exe 2892 vjpjv.exe 2860 pjdjp.exe 2856 frlxfrx.exe 2656 tthhtn.exe 3040 9tnhtt.exe 3032 7dvvj.exe 2552 5xrxfff.exe 2584 rfrxfff.exe 840 hbhbhn.exe 820 dpjdp.exe 1308 frflrrx.exe 2168 xlffrrx.exe 2260 pjvdj.exe 2252 dppjp.exe 2280 frlrrrf.exe 2120 bntntt.exe 2124 dvpvv.exe 1016 pppvp.exe 2136 1rfxxxf.exe 2028 thhnnn.exe 2240 nhttnb.exe -
resource yara_rule behavioral1/memory/2676-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1432-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1604-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1252-178-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2236-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1888-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/320-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/840-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1016-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-498-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-505-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2240-512-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-525-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/696-532-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-554-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-586-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-593-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-613-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-614-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/3040-677-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-703-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1872-739-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-817-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-856-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-863-0x0000000000220000-0x000000000024A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflxxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1frrrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrfrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfflrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lxrfrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3djdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfxlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2156 wrote to memory of 2676 2156 73a6cd3af4ae4c6df85709d5373cd588d721b27fc95edf9b979629742a72ab79N.exe 30 PID 2156 wrote to memory of 2676 2156 73a6cd3af4ae4c6df85709d5373cd588d721b27fc95edf9b979629742a72ab79N.exe 30 PID 2156 wrote to memory of 2676 2156 73a6cd3af4ae4c6df85709d5373cd588d721b27fc95edf9b979629742a72ab79N.exe 30 PID 2156 wrote to memory of 2676 2156 73a6cd3af4ae4c6df85709d5373cd588d721b27fc95edf9b979629742a72ab79N.exe 30 PID 2676 wrote to memory of 2420 2676 1vddj.exe 31 PID 2676 wrote to memory of 2420 2676 1vddj.exe 31 PID 2676 wrote to memory of 2420 2676 1vddj.exe 31 PID 2676 wrote to memory of 2420 2676 1vddj.exe 31 PID 2420 wrote to memory of 2500 2420 lxffrxl.exe 32 PID 2420 wrote to memory of 2500 2420 lxffrxl.exe 32 PID 2420 wrote to memory of 2500 2420 lxffrxl.exe 32 PID 2420 wrote to memory of 2500 2420 lxffrxl.exe 32 PID 2500 wrote to memory of 2864 2500 7bnnnn.exe 33 PID 2500 wrote to memory of 2864 2500 7bnnnn.exe 33 PID 2500 wrote to memory of 2864 2500 7bnnnn.exe 33 PID 2500 wrote to memory of 2864 2500 7bnnnn.exe 33 PID 2864 wrote to memory of 2744 2864 ppvvd.exe 34 PID 2864 wrote to memory of 2744 2864 ppvvd.exe 34 PID 2864 wrote to memory of 2744 2864 ppvvd.exe 34 PID 2864 wrote to memory of 2744 2864 ppvvd.exe 34 PID 2744 wrote to memory of 2748 2744 bnbbnh.exe 35 PID 2744 wrote to memory of 2748 2744 bnbbnh.exe 35 PID 2744 wrote to memory of 2748 2744 bnbbnh.exe 35 PID 2744 wrote to memory of 2748 2744 bnbbnh.exe 35 PID 2748 wrote to memory of 2332 2748 hbtbnt.exe 36 PID 2748 wrote to memory of 2332 2748 hbtbnt.exe 36 PID 2748 wrote to memory of 2332 2748 hbtbnt.exe 36 PID 2748 wrote to memory of 2332 2748 hbtbnt.exe 36 PID 2332 wrote to memory of 2756 2332 rlxxrxl.exe 37 PID 2332 wrote to memory of 2756 2332 rlxxrxl.exe 37 PID 2332 wrote to memory of 2756 2332 rlxxrxl.exe 37 PID 2332 wrote to memory of 2756 2332 rlxxrxl.exe 37 PID 2756 wrote to memory of 1804 2756 fxffrlx.exe 38 PID 2756 wrote to memory of 1804 2756 fxffrlx.exe 38 PID 2756 wrote to memory of 1804 2756 fxffrlx.exe 38 PID 2756 wrote to memory of 1804 2756 fxffrlx.exe 38 PID 1804 wrote to memory of 2596 1804 bnhntt.exe 39 PID 1804 wrote to memory of 2596 1804 bnhntt.exe 39 PID 1804 wrote to memory of 2596 1804 bnhntt.exe 39 PID 1804 wrote to memory of 2596 1804 bnhntt.exe 39 PID 2596 wrote to memory of 2672 2596 lfxxlrf.exe 40 PID 2596 wrote to memory of 2672 2596 lfxxlrf.exe 40 PID 2596 wrote to memory of 2672 2596 lfxxlrf.exe 40 PID 2596 wrote to memory of 2672 2596 lfxxlrf.exe 40 PID 2672 wrote to memory of 2392 2672 thbnnh.exe 41 PID 2672 wrote to memory of 2392 2672 thbnnh.exe 41 PID 2672 wrote to memory of 2392 2672 thbnnh.exe 41 PID 2672 wrote to memory of 2392 2672 thbnnh.exe 41 PID 2392 wrote to memory of 3032 2392 3dvvp.exe 42 PID 2392 wrote to memory of 3032 2392 3dvvp.exe 42 PID 2392 wrote to memory of 3032 2392 3dvvp.exe 42 PID 2392 wrote to memory of 3032 2392 3dvvp.exe 42 PID 3032 wrote to memory of 2060 3032 rrlrffr.exe 43 PID 3032 wrote to memory of 2060 3032 rrlrffr.exe 43 PID 3032 wrote to memory of 2060 3032 rrlrffr.exe 43 PID 3032 wrote to memory of 2060 3032 rrlrffr.exe 43 PID 2060 wrote to memory of 1432 2060 5bnntn.exe 44 PID 2060 wrote to memory of 1432 2060 5bnntn.exe 44 PID 2060 wrote to memory of 1432 2060 5bnntn.exe 44 PID 2060 wrote to memory of 1432 2060 5bnntn.exe 44 PID 1432 wrote to memory of 1604 1432 pdjpd.exe 45 PID 1432 wrote to memory of 1604 1432 pdjpd.exe 45 PID 1432 wrote to memory of 1604 1432 pdjpd.exe 45 PID 1432 wrote to memory of 1604 1432 pdjpd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\73a6cd3af4ae4c6df85709d5373cd588d721b27fc95edf9b979629742a72ab79N.exe"C:\Users\Admin\AppData\Local\Temp\73a6cd3af4ae4c6df85709d5373cd588d721b27fc95edf9b979629742a72ab79N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\1vddj.exec:\1vddj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\lxffrxl.exec:\lxffrxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\7bnnnn.exec:\7bnnnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\ppvvd.exec:\ppvvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\bnbbnh.exec:\bnbbnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\hbtbnt.exec:\hbtbnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\rlxxrxl.exec:\rlxxrxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\fxffrlx.exec:\fxffrlx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\bnhntt.exec:\bnhntt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\lfxxlrf.exec:\lfxxlrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\thbnnh.exec:\thbnnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\3dvvp.exec:\3dvvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\rrlrffr.exec:\rrlrffr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\5bnntn.exec:\5bnntn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\pdjpd.exec:\pdjpd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\1rxxxxx.exec:\1rxxxxx.exe17⤵
- Executes dropped EXE
PID:1604 -
\??\c:\1bnnbh.exec:\1bnnbh.exe18⤵
- Executes dropped EXE
PID:3020 -
\??\c:\frxrrxf.exec:\frxrrxf.exe19⤵
- Executes dropped EXE
PID:1252 -
\??\c:\vvppv.exec:\vvppv.exe20⤵
- Executes dropped EXE
PID:3060 -
\??\c:\5fxxxfr.exec:\5fxxxfr.exe21⤵
- Executes dropped EXE
PID:2236 -
\??\c:\9nttbb.exec:\9nttbb.exe22⤵
- Executes dropped EXE
PID:2084 -
\??\c:\7pjpd.exec:\7pjpd.exe23⤵
- Executes dropped EXE
PID:1536 -
\??\c:\rlfflrl.exec:\rlfflrl.exe24⤵
- Executes dropped EXE
PID:1660 -
\??\c:\1tbbhn.exec:\1tbbhn.exe25⤵
- Executes dropped EXE
PID:2108 -
\??\c:\hthnnt.exec:\hthnnt.exe26⤵
- Executes dropped EXE
PID:1888 -
\??\c:\tnhbnt.exec:\tnhbnt.exe27⤵
- Executes dropped EXE
PID:2560 -
\??\c:\lfrrffl.exec:\lfrrffl.exe28⤵
- Executes dropped EXE
PID:320 -
\??\c:\bhnntb.exec:\bhnntb.exe29⤵
- Executes dropped EXE
PID:1800 -
\??\c:\rrlxllf.exec:\rrlxllf.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1776 -
\??\c:\lfxfrfl.exec:\lfxfrfl.exe31⤵
- Executes dropped EXE
PID:1744 -
\??\c:\nhnttb.exec:\nhnttb.exe32⤵
- Executes dropped EXE
PID:1728 -
\??\c:\pjvvj.exec:\pjvvj.exe33⤵
- Executes dropped EXE
PID:1992 -
\??\c:\xrllrrx.exec:\xrllrrx.exe34⤵
- Executes dropped EXE
PID:996 -
\??\c:\nhnbhh.exec:\nhnbhh.exe35⤵
- Executes dropped EXE
PID:2340 -
\??\c:\vjvvj.exec:\vjvvj.exe36⤵
- Executes dropped EXE
PID:2176 -
\??\c:\fxrxllx.exec:\fxrxllx.exe37⤵
- Executes dropped EXE
PID:2348 -
\??\c:\frfxfxf.exec:\frfxfxf.exe38⤵
- Executes dropped EXE
PID:2792 -
\??\c:\9hbhnn.exec:\9hbhnn.exe39⤵
- Executes dropped EXE
PID:2932 -
\??\c:\vpdjp.exec:\vpdjp.exe40⤵
- Executes dropped EXE
PID:2728 -
\??\c:\9jpdj.exec:\9jpdj.exe41⤵
- Executes dropped EXE
PID:2700 -
\??\c:\rrfxfxl.exec:\rrfxfxl.exe42⤵
- Executes dropped EXE
PID:2956 -
\??\c:\nbbbnh.exec:\nbbbnh.exe43⤵
- Executes dropped EXE
PID:2764 -
\??\c:\5hbnth.exec:\5hbnth.exe44⤵
- Executes dropped EXE
PID:2652 -
\??\c:\vjpjv.exec:\vjpjv.exe45⤵
- Executes dropped EXE
PID:2892 -
\??\c:\pjdjp.exec:\pjdjp.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2860 -
\??\c:\frlxfrx.exec:\frlxfrx.exe47⤵
- Executes dropped EXE
PID:2856 -
\??\c:\tthhtn.exec:\tthhtn.exe48⤵
- Executes dropped EXE
PID:2656 -
\??\c:\9tnhtt.exec:\9tnhtt.exe49⤵
- Executes dropped EXE
PID:3040 -
\??\c:\7dvvj.exec:\7dvvj.exe50⤵
- Executes dropped EXE
PID:3032 -
\??\c:\5xrxfff.exec:\5xrxfff.exe51⤵
- Executes dropped EXE
PID:2552 -
\??\c:\rfrxfff.exec:\rfrxfff.exe52⤵
- Executes dropped EXE
PID:2584 -
\??\c:\hbhbhn.exec:\hbhbhn.exe53⤵
- Executes dropped EXE
PID:840 -
\??\c:\dpjdp.exec:\dpjdp.exe54⤵
- Executes dropped EXE
PID:820 -
\??\c:\frflrrx.exec:\frflrrx.exe55⤵
- Executes dropped EXE
PID:1308 -
\??\c:\xlffrrx.exec:\xlffrrx.exe56⤵
- Executes dropped EXE
PID:2168 -
\??\c:\pjvdj.exec:\pjvdj.exe57⤵
- Executes dropped EXE
PID:2260 -
\??\c:\dppjp.exec:\dppjp.exe58⤵
- Executes dropped EXE
PID:2252 -
\??\c:\frlrrrf.exec:\frlrrrf.exe59⤵
- Executes dropped EXE
PID:2280 -
\??\c:\bntntt.exec:\bntntt.exe60⤵
- Executes dropped EXE
PID:2120 -
\??\c:\dvpvv.exec:\dvpvv.exe61⤵
- Executes dropped EXE
PID:2124 -
\??\c:\pppvp.exec:\pppvp.exe62⤵
- Executes dropped EXE
PID:1016 -
\??\c:\1rfxxxf.exec:\1rfxxxf.exe63⤵
- Executes dropped EXE
PID:2136 -
\??\c:\thhnnn.exec:\thhnnn.exe64⤵
- Executes dropped EXE
PID:2028 -
\??\c:\nhttnb.exec:\nhttnb.exe65⤵
- Executes dropped EXE
PID:2240 -
\??\c:\vpppd.exec:\vpppd.exe66⤵PID:2460
-
\??\c:\3rfrflx.exec:\3rfrflx.exe67⤵PID:2324
-
\??\c:\1ffllfl.exec:\1ffllfl.exe68⤵PID:696
-
\??\c:\htnnhh.exec:\htnnhh.exe69⤵PID:292
-
\??\c:\jvjjv.exec:\jvjjv.exe70⤵PID:1752
-
\??\c:\5xrrxxf.exec:\5xrrxxf.exe71⤵PID:2484
-
\??\c:\rfrlrrr.exec:\rfrlrrr.exe72⤵PID:1728
-
\??\c:\hhbtbh.exec:\hhbtbh.exe73⤵PID:1588
-
\??\c:\btthtt.exec:\btthtt.exe74⤵PID:2676
-
\??\c:\5pdjv.exec:\5pdjv.exe75⤵PID:2088
-
\??\c:\frrflrx.exec:\frrflrx.exe76⤵PID:2360
-
\??\c:\lxffxrx.exec:\lxffxrx.exe77⤵PID:2548
-
\??\c:\nbnnbb.exec:\nbnnbb.exe78⤵PID:2864
-
\??\c:\jdvdp.exec:\jdvdp.exe79⤵PID:2800
-
\??\c:\pdppv.exec:\pdppv.exe80⤵PID:2704
-
\??\c:\ffffrxf.exec:\ffffrxf.exe81⤵PID:2712
-
\??\c:\5thhnn.exec:\5thhnn.exe82⤵PID:2828
-
\??\c:\tnttbh.exec:\tnttbh.exe83⤵PID:2780
-
\??\c:\9dpvd.exec:\9dpvd.exe84⤵PID:2768
-
\??\c:\lfxflrx.exec:\lfxflrx.exe85⤵PID:2628
-
\??\c:\frxxffl.exec:\frxxffl.exe86⤵PID:2668
-
\??\c:\nbtnhh.exec:\nbtnhh.exe87⤵PID:1712
-
\??\c:\1dppv.exec:\1dppv.exe88⤵PID:2648
-
\??\c:\jddpd.exec:\jddpd.exe89⤵PID:2996
-
\??\c:\xrllrrf.exec:\xrllrrf.exe90⤵PID:1112
-
\??\c:\xrflxfl.exec:\xrflxfl.exe91⤵PID:3040
-
\??\c:\7bttbh.exec:\7bttbh.exe92⤵PID:2920
-
\??\c:\jjvvp.exec:\jjvvp.exe93⤵PID:2880
-
\??\c:\frxxffl.exec:\frxxffl.exe94⤵PID:1620
-
\??\c:\5bttnn.exec:\5bttnn.exe95⤵PID:3020
-
\??\c:\htnttt.exec:\htnttt.exe96⤵PID:1552
-
\??\c:\pjddj.exec:\pjddj.exe97⤵PID:1252
-
\??\c:\xfxfrxl.exec:\xfxfrxl.exe98⤵PID:3028
-
\??\c:\rrxxrfx.exec:\rrxxrfx.exe99⤵PID:1872
-
\??\c:\9bthtb.exec:\9bthtb.exe100⤵PID:1796
-
\??\c:\7vvjj.exec:\7vvjj.exe101⤵PID:1440
-
\??\c:\xxrrfxx.exec:\xxrrfxx.exe102⤵PID:1536
-
\??\c:\1frlxrx.exec:\1frlxrx.exe103⤵PID:2124
-
\??\c:\btnthh.exec:\btnthh.exe104⤵PID:284
-
\??\c:\dvjpv.exec:\dvjpv.exe105⤵PID:1672
-
\??\c:\pjddj.exec:\pjddj.exe106⤵PID:2028
-
\??\c:\xlxxlrx.exec:\xlxxlrx.exe107⤵PID:2240
-
\??\c:\thhnbb.exec:\thhnbb.exe108⤵PID:1960
-
\??\c:\5bbhnn.exec:\5bbhnn.exe109⤵PID:2324
-
\??\c:\pjvpp.exec:\pjvpp.exe110⤵PID:2228
-
\??\c:\1lxxlll.exec:\1lxxlll.exe111⤵PID:292
-
\??\c:\rfllxxf.exec:\rfllxxf.exe112⤵PID:2496
-
\??\c:\7thhhn.exec:\7thhhn.exe113⤵PID:884
-
\??\c:\jvjdd.exec:\jvjdd.exe114⤵PID:1808
-
\??\c:\jdppd.exec:\jdppd.exe115⤵PID:2112
-
\??\c:\ffxlllx.exec:\ffxlllx.exe116⤵PID:2352
-
\??\c:\hbnttb.exec:\hbnttb.exe117⤵PID:1648
-
\??\c:\hbttnt.exec:\hbttnt.exe118⤵PID:2808
-
\??\c:\dpdpp.exec:\dpdpp.exe119⤵PID:2372
-
\??\c:\rrllrrx.exec:\rrllrrx.exe120⤵PID:2740
-
\??\c:\bbnbht.exec:\bbnbht.exe121⤵PID:2140
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-