Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 04:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a6574ceae9ab44b1a7e6068b2b5c73c8a322d3fd0dd23b016f3d20a8bf87b300.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
a6574ceae9ab44b1a7e6068b2b5c73c8a322d3fd0dd23b016f3d20a8bf87b300.exe
-
Size
453KB
-
MD5
aa50a9422ef3c3e770fc6df958f6d5f6
-
SHA1
5727000564274a33e402b2132deb06520c89ea8c
-
SHA256
a6574ceae9ab44b1a7e6068b2b5c73c8a322d3fd0dd23b016f3d20a8bf87b300
-
SHA512
b72a49e4e4d46fae0d981487ef985f924e7d07d79476fc0e4a74be34caf9756f52e935cd2f095e832fad9ea9fae3c5fd8a8643e8996f8c00ddd82b3106e563a4
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbetD:q7Tc2NYHUrAwfMp3CDtD
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/1992-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1196-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2016-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1232-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/844-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/784-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1636-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/596-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1808-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2196-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1208-212-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2968-258-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2968-260-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/3008-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-286-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2056-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2408-309-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2732-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1976-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1728-402-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1168-426-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/596-429-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1168-428-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1848-448-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-461-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1720-500-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2192-521-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-534-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1968-651-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1116-665-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1400-682-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2960-728-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1852-817-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2168-824-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2092-992-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1708-1031-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2160-1165-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2636-1172-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2016 pjddp.exe 1196 bthtbh.exe 1232 rrlrxxl.exe 2344 xrlxllr.exe 2812 vjdvd.exe 2836 5ffflll.exe 2972 dddpv.exe 2856 3dvdj.exe 2660 7xrlxll.exe 2676 fllxlrl.exe 2300 pjdjp.exe 844 bthntb.exe 784 jdddv.exe 1636 nhttht.exe 596 3pddv.exe 1808 ttntbh.exe 1840 jjdpd.exe 1600 nhntbn.exe 2928 3pjvd.exe 2196 ttbhnt.exe 2424 vpjvv.exe 1208 pjdjv.exe 2864 5jjdj.exe 1668 7bhntb.exe 912 ddjpv.exe 2192 jpjpd.exe 2968 1vppd.exe 2216 lrrfxll.exe 3008 hbntbh.exe 2164 7hhnht.exe 2056 nhbhtb.exe 1672 rlxlflf.exe 2408 xrrxlrl.exe 1960 5hbtnh.exe 2108 vvjvj.exe 2732 frllrrl.exe 2880 xlxlrrf.exe 2892 htbbnn.exe 2792 jdppv.exe 2884 vpddd.exe 2720 lfrrrrr.exe 2796 hhnbhn.exe 2716 thnnnh.exe 1976 dvjjp.exe 1700 lrfrrfr.exe 3060 nhttbb.exe 1728 dddjd.exe 1172 ddjpv.exe 784 fxlxxlx.exe 696 bbtbhh.exe 1168 nhbtbb.exe 596 9vpvj.exe 2916 vvvpj.exe 1848 1fflrrx.exe 1496 hbbhhb.exe 2944 ddvdd.exe 2940 frfxrrx.exe 2208 lxrxfxf.exe 996 tnbhhh.exe 940 1dpvd.exe 1692 pjvdd.exe 1720 rrllrxx.exe 2496 hnhnbb.exe 1660 vdjvj.exe -
resource yara_rule behavioral1/memory/1992-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1196-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1232-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/844-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/784-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/844-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/784-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1808-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/596-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1808-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/912-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1976-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/596-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1848-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-521-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-534-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/660-535-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-548-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1116-665-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1400-682-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/2960-728-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/920-772-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-785-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-792-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-953-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-985-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1532-1012-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-1080-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-1087-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-1125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-1138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-1146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1780-1185-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hbntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xlfffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5djjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlllrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1992 wrote to memory of 2016 1992 a6574ceae9ab44b1a7e6068b2b5c73c8a322d3fd0dd23b016f3d20a8bf87b300.exe 30 PID 1992 wrote to memory of 2016 1992 a6574ceae9ab44b1a7e6068b2b5c73c8a322d3fd0dd23b016f3d20a8bf87b300.exe 30 PID 1992 wrote to memory of 2016 1992 a6574ceae9ab44b1a7e6068b2b5c73c8a322d3fd0dd23b016f3d20a8bf87b300.exe 30 PID 1992 wrote to memory of 2016 1992 a6574ceae9ab44b1a7e6068b2b5c73c8a322d3fd0dd23b016f3d20a8bf87b300.exe 30 PID 2016 wrote to memory of 1196 2016 pjddp.exe 31 PID 2016 wrote to memory of 1196 2016 pjddp.exe 31 PID 2016 wrote to memory of 1196 2016 pjddp.exe 31 PID 2016 wrote to memory of 1196 2016 pjddp.exe 31 PID 1196 wrote to memory of 1232 1196 bthtbh.exe 32 PID 1196 wrote to memory of 1232 1196 bthtbh.exe 32 PID 1196 wrote to memory of 1232 1196 bthtbh.exe 32 PID 1196 wrote to memory of 1232 1196 bthtbh.exe 32 PID 1232 wrote to memory of 2344 1232 rrlrxxl.exe 33 PID 1232 wrote to memory of 2344 1232 rrlrxxl.exe 33 PID 1232 wrote to memory of 2344 1232 rrlrxxl.exe 33 PID 1232 wrote to memory of 2344 1232 rrlrxxl.exe 33 PID 2344 wrote to memory of 2812 2344 xrlxllr.exe 34 PID 2344 wrote to memory of 2812 2344 xrlxllr.exe 34 PID 2344 wrote to memory of 2812 2344 xrlxllr.exe 34 PID 2344 wrote to memory of 2812 2344 xrlxllr.exe 34 PID 2812 wrote to memory of 2836 2812 vjdvd.exe 35 PID 2812 wrote to memory of 2836 2812 vjdvd.exe 35 PID 2812 wrote to memory of 2836 2812 vjdvd.exe 35 PID 2812 wrote to memory of 2836 2812 vjdvd.exe 35 PID 2836 wrote to memory of 2972 2836 5ffflll.exe 36 PID 2836 wrote to memory of 2972 2836 5ffflll.exe 36 PID 2836 wrote to memory of 2972 2836 5ffflll.exe 36 PID 2836 wrote to memory of 2972 2836 5ffflll.exe 36 PID 2972 wrote to memory of 2856 2972 dddpv.exe 37 PID 2972 wrote to memory of 2856 2972 dddpv.exe 37 PID 2972 wrote to memory of 2856 2972 dddpv.exe 37 PID 2972 wrote to memory of 2856 2972 dddpv.exe 37 PID 2856 wrote to memory of 2660 2856 3dvdj.exe 38 PID 2856 wrote to memory of 2660 2856 3dvdj.exe 38 PID 2856 wrote to memory of 2660 2856 3dvdj.exe 38 PID 2856 wrote to memory of 2660 2856 3dvdj.exe 38 PID 2660 wrote to memory of 2676 2660 7xrlxll.exe 39 PID 2660 wrote to memory of 2676 2660 7xrlxll.exe 39 PID 2660 wrote to memory of 2676 2660 7xrlxll.exe 39 PID 2660 wrote to memory of 2676 2660 7xrlxll.exe 39 PID 2676 wrote to memory of 2300 2676 fllxlrl.exe 40 PID 2676 wrote to memory of 2300 2676 fllxlrl.exe 40 PID 2676 wrote to memory of 2300 2676 fllxlrl.exe 40 PID 2676 wrote to memory of 2300 2676 fllxlrl.exe 40 PID 2300 wrote to memory of 844 2300 pjdjp.exe 41 PID 2300 wrote to memory of 844 2300 pjdjp.exe 41 PID 2300 wrote to memory of 844 2300 pjdjp.exe 41 PID 2300 wrote to memory of 844 2300 pjdjp.exe 41 PID 844 wrote to memory of 784 844 bthntb.exe 42 PID 844 wrote to memory of 784 844 bthntb.exe 42 PID 844 wrote to memory of 784 844 bthntb.exe 42 PID 844 wrote to memory of 784 844 bthntb.exe 42 PID 784 wrote to memory of 1636 784 jdddv.exe 43 PID 784 wrote to memory of 1636 784 jdddv.exe 43 PID 784 wrote to memory of 1636 784 jdddv.exe 43 PID 784 wrote to memory of 1636 784 jdddv.exe 43 PID 1636 wrote to memory of 596 1636 nhttht.exe 44 PID 1636 wrote to memory of 596 1636 nhttht.exe 44 PID 1636 wrote to memory of 596 1636 nhttht.exe 44 PID 1636 wrote to memory of 596 1636 nhttht.exe 44 PID 596 wrote to memory of 1808 596 3pddv.exe 45 PID 596 wrote to memory of 1808 596 3pddv.exe 45 PID 596 wrote to memory of 1808 596 3pddv.exe 45 PID 596 wrote to memory of 1808 596 3pddv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\a6574ceae9ab44b1a7e6068b2b5c73c8a322d3fd0dd23b016f3d20a8bf87b300.exe"C:\Users\Admin\AppData\Local\Temp\a6574ceae9ab44b1a7e6068b2b5c73c8a322d3fd0dd23b016f3d20a8bf87b300.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\pjddp.exec:\pjddp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\bthtbh.exec:\bthtbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
\??\c:\rrlrxxl.exec:\rrlrxxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\xrlxllr.exec:\xrlxllr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\vjdvd.exec:\vjdvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\5ffflll.exec:\5ffflll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\dddpv.exec:\dddpv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\3dvdj.exec:\3dvdj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\7xrlxll.exec:\7xrlxll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\fllxlrl.exec:\fllxlrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\pjdjp.exec:\pjdjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\bthntb.exec:\bthntb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
\??\c:\jdddv.exec:\jdddv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:784 -
\??\c:\nhttht.exec:\nhttht.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\3pddv.exec:\3pddv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:596 -
\??\c:\ttntbh.exec:\ttntbh.exe17⤵
- Executes dropped EXE
PID:1808 -
\??\c:\jjdpd.exec:\jjdpd.exe18⤵
- Executes dropped EXE
PID:1840 -
\??\c:\nhntbn.exec:\nhntbn.exe19⤵
- Executes dropped EXE
PID:1600 -
\??\c:\3pjvd.exec:\3pjvd.exe20⤵
- Executes dropped EXE
PID:2928 -
\??\c:\ttbhnt.exec:\ttbhnt.exe21⤵
- Executes dropped EXE
PID:2196 -
\??\c:\vpjvv.exec:\vpjvv.exe22⤵
- Executes dropped EXE
PID:2424 -
\??\c:\pjdjv.exec:\pjdjv.exe23⤵
- Executes dropped EXE
PID:1208 -
\??\c:\5jjdj.exec:\5jjdj.exe24⤵
- Executes dropped EXE
PID:2864 -
\??\c:\7bhntb.exec:\7bhntb.exe25⤵
- Executes dropped EXE
PID:1668 -
\??\c:\ddjpv.exec:\ddjpv.exe26⤵
- Executes dropped EXE
PID:912 -
\??\c:\jpjpd.exec:\jpjpd.exe27⤵
- Executes dropped EXE
PID:2192 -
\??\c:\1vppd.exec:\1vppd.exe28⤵
- Executes dropped EXE
PID:2968 -
\??\c:\lrrfxll.exec:\lrrfxll.exe29⤵
- Executes dropped EXE
PID:2216 -
\??\c:\hbntbh.exec:\hbntbh.exe30⤵
- Executes dropped EXE
PID:3008 -
\??\c:\7hhnht.exec:\7hhnht.exe31⤵
- Executes dropped EXE
PID:2164 -
\??\c:\nhbhtb.exec:\nhbhtb.exe32⤵
- Executes dropped EXE
PID:2056 -
\??\c:\rlxlflf.exec:\rlxlflf.exe33⤵
- Executes dropped EXE
PID:1672 -
\??\c:\xrrxlrl.exec:\xrrxlrl.exe34⤵
- Executes dropped EXE
PID:2408 -
\??\c:\5hbtnh.exec:\5hbtnh.exe35⤵
- Executes dropped EXE
PID:1960 -
\??\c:\vvjvj.exec:\vvjvj.exe36⤵
- Executes dropped EXE
PID:2108 -
\??\c:\frllrrl.exec:\frllrrl.exe37⤵
- Executes dropped EXE
PID:2732 -
\??\c:\xlxlrrf.exec:\xlxlrrf.exe38⤵
- Executes dropped EXE
PID:2880 -
\??\c:\htbbnn.exec:\htbbnn.exe39⤵
- Executes dropped EXE
PID:2892 -
\??\c:\jdppv.exec:\jdppv.exe40⤵
- Executes dropped EXE
PID:2792 -
\??\c:\vpddd.exec:\vpddd.exe41⤵
- Executes dropped EXE
PID:2884 -
\??\c:\lfrrrrr.exec:\lfrrrrr.exe42⤵
- Executes dropped EXE
PID:2720 -
\??\c:\hhnbhn.exec:\hhnbhn.exe43⤵
- Executes dropped EXE
PID:2796 -
\??\c:\thnnnh.exec:\thnnnh.exe44⤵
- Executes dropped EXE
PID:2716 -
\??\c:\dvjjp.exec:\dvjjp.exe45⤵
- Executes dropped EXE
PID:1976 -
\??\c:\lrfrrfr.exec:\lrfrrfr.exe46⤵
- Executes dropped EXE
PID:1700 -
\??\c:\nhttbb.exec:\nhttbb.exe47⤵
- Executes dropped EXE
PID:3060 -
\??\c:\dddjd.exec:\dddjd.exe48⤵
- Executes dropped EXE
PID:1728 -
\??\c:\ddjpv.exec:\ddjpv.exe49⤵
- Executes dropped EXE
PID:1172 -
\??\c:\fxlxxlx.exec:\fxlxxlx.exe50⤵
- Executes dropped EXE
PID:784 -
\??\c:\bbtbhh.exec:\bbtbhh.exe51⤵
- Executes dropped EXE
PID:696 -
\??\c:\nhbtbb.exec:\nhbtbb.exe52⤵
- Executes dropped EXE
PID:1168 -
\??\c:\9vpvj.exec:\9vpvj.exe53⤵
- Executes dropped EXE
PID:596 -
\??\c:\vvvpj.exec:\vvvpj.exe54⤵
- Executes dropped EXE
PID:2916 -
\??\c:\1fflrrx.exec:\1fflrrx.exe55⤵
- Executes dropped EXE
PID:1848 -
\??\c:\hbbhhb.exec:\hbbhhb.exe56⤵
- Executes dropped EXE
PID:1496 -
\??\c:\ddvdd.exec:\ddvdd.exe57⤵
- Executes dropped EXE
PID:2944 -
\??\c:\frfxrrx.exec:\frfxrrx.exe58⤵
- Executes dropped EXE
PID:2940 -
\??\c:\lxrxfxf.exec:\lxrxfxf.exe59⤵
- Executes dropped EXE
PID:2208 -
\??\c:\tnbhhh.exec:\tnbhhh.exe60⤵
- Executes dropped EXE
PID:996 -
\??\c:\1dpvd.exec:\1dpvd.exe61⤵
- Executes dropped EXE
PID:940 -
\??\c:\pjvdd.exec:\pjvdd.exe62⤵
- Executes dropped EXE
PID:1692 -
\??\c:\rrllrxx.exec:\rrllrxx.exe63⤵
- Executes dropped EXE
PID:1720 -
\??\c:\hnhnbb.exec:\hnhnbb.exe64⤵
- Executes dropped EXE
PID:2496 -
\??\c:\vdjvj.exec:\vdjvj.exe65⤵
- Executes dropped EXE
PID:1660 -
\??\c:\vpppv.exec:\vpppv.exe66⤵PID:2128
-
\??\c:\rxxflxl.exec:\rxxflxl.exe67⤵PID:2192
-
\??\c:\ntthbt.exec:\ntthbt.exe68⤵PID:2456
-
\??\c:\hbtbhn.exec:\hbtbhn.exe69⤵PID:660
-
\??\c:\1jjjj.exec:\1jjjj.exe70⤵PID:1736
-
\??\c:\5xllrxl.exec:\5xllrxl.exe71⤵PID:3008
-
\??\c:\fffxflx.exec:\fffxflx.exe72⤵PID:2400
-
\??\c:\nnhtht.exec:\nnhtht.exe73⤵PID:1580
-
\??\c:\pdjpj.exec:\pdjpj.exe74⤵PID:2356
-
\??\c:\rrlrflf.exec:\rrlrflf.exe75⤵PID:2416
-
\??\c:\tnnbtb.exec:\tnnbtb.exe76⤵PID:2900
-
\??\c:\nnthnt.exec:\nnthnt.exe77⤵PID:2788
-
\??\c:\3vpdv.exec:\3vpdv.exe78⤵PID:2696
-
\??\c:\lfffrxl.exec:\lfffrxl.exe79⤵PID:2160
-
\??\c:\xxxflrf.exec:\xxxflrf.exe80⤵PID:2756
-
\??\c:\nhhhtt.exec:\nhhhtt.exe81⤵PID:2728
-
\??\c:\jdvdj.exec:\jdvdj.exe82⤵PID:2256
-
\??\c:\1dvpv.exec:\1dvpv.exe83⤵PID:2952
-
\??\c:\ffflxrx.exec:\ffflxrx.exe84⤵PID:2628
-
\??\c:\tttbnh.exec:\tttbnh.exe85⤵PID:2608
-
\??\c:\3btbhn.exec:\3btbhn.exe86⤵PID:2660
-
\??\c:\pvvdp.exec:\pvvdp.exe87⤵PID:1968
-
\??\c:\rlllfff.exec:\rlllfff.exe88⤵PID:2252
-
\??\c:\hbbhnt.exec:\hbbhnt.exe89⤵PID:1116
-
\??\c:\nnnbbt.exec:\nnnbbt.exe90⤵PID:852
-
\??\c:\ddjjv.exec:\ddjjv.exe91⤵PID:1800
-
\??\c:\xrlxlrx.exec:\xrlxlrx.exe92⤵PID:1400
-
\??\c:\7hthtb.exec:\7hthtb.exe93⤵PID:532
-
\??\c:\bbtnbh.exec:\bbtnbh.exe94⤵PID:264
-
\??\c:\7vppv.exec:\7vppv.exe95⤵PID:1804
-
\??\c:\1ffrlrr.exec:\1ffrlrr.exe96⤵PID:1632
-
\??\c:\lxrrffl.exec:\lxrrffl.exe97⤵PID:1324
-
\??\c:\7bthtb.exec:\7bthtb.exe98⤵PID:2704
-
\??\c:\9hbntt.exec:\9hbntt.exe99⤵
- System Location Discovery: System Language Discovery
PID:2960 -
\??\c:\ppjjp.exec:\ppjjp.exe100⤵PID:2264
-
\??\c:\xllllll.exec:\xllllll.exe101⤵PID:2940
-
\??\c:\lxffxfl.exec:\lxffxfl.exe102⤵PID:620
-
\??\c:\bnbbhh.exec:\bnbbhh.exe103⤵PID:1204
-
\??\c:\pjddp.exec:\pjddp.exe104⤵PID:940
-
\??\c:\9jvpv.exec:\9jvpv.exe105⤵PID:1160
-
\??\c:\frxxxff.exec:\frxxxff.exe106⤵PID:1716
-
\??\c:\3nhntb.exec:\3nhntb.exe107⤵PID:920
-
\??\c:\nnhtbt.exec:\nnhtbt.exe108⤵PID:2540
-
\??\c:\jdpvd.exec:\jdpvd.exe109⤵PID:2644
-
\??\c:\rrflxxx.exec:\rrflxxx.exe110⤵PID:2192
-
\??\c:\1xlllfl.exec:\1xlllfl.exe111⤵PID:3012
-
\??\c:\nbttbt.exec:\nbttbt.exe112⤵PID:1648
-
\??\c:\7jjpj.exec:\7jjpj.exe113⤵PID:1852
-
\??\c:\1ddjp.exec:\1ddjp.exe114⤵PID:2168
-
\??\c:\fxrxlrf.exec:\fxrxlrf.exe115⤵PID:1416
-
\??\c:\5nbntb.exec:\5nbntb.exe116⤵PID:2120
-
\??\c:\1pdvp.exec:\1pdvp.exe117⤵PID:1196
-
\??\c:\pvppj.exec:\pvppj.exe118⤵PID:2416
-
\??\c:\fxfflrx.exec:\fxfflrx.exe119⤵PID:1960
-
\??\c:\tnntbb.exec:\tnntbb.exe120⤵PID:2788
-
\??\c:\1nbbnn.exec:\1nbbnn.exe121⤵PID:2108
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-