Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 06:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
31a558e8e4d09e9256dd6e00b7a6b1bd6929ca8b2cb20f60ccafc5bd9b8da621.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
31a558e8e4d09e9256dd6e00b7a6b1bd6929ca8b2cb20f60ccafc5bd9b8da621.exe
-
Size
455KB
-
MD5
38614abd97b11955c9f24156c9a140ff
-
SHA1
ecdd2fc2445d75086644ac0d90b05110b7fa29f2
-
SHA256
31a558e8e4d09e9256dd6e00b7a6b1bd6929ca8b2cb20f60ccafc5bd9b8da621
-
SHA512
fcbb802958f97cea6c53ea4d159f7872fca5f90350f88a771c7e193619fb2c0066a3fe0aabdf460f137026fac437351deea4604528d202ac83d162e484d89abc
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbed:q7Tc2NYHUrAwfMp3CDd
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/2432-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1696-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2316-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2092-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1164-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1164-32-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2536-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1696-56-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2828-54-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2724-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1632-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1984-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1924-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1020-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2144-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2144-219-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/1652-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2144-253-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/1280-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2084-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-310-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1276-313-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/1276-317-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/1276-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-422-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-462-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-476-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2132-508-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2264-585-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2240-602-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1032-720-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2720-764-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2132-782-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1964-1205-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1696 rrlrffr.exe 2316 fxrxrrx.exe 1164 rlrlllr.exe 2092 nbhtbb.exe 2828 jvdvv.exe 2536 vvvjp.exe 2724 jjvvp.exe 2576 1pdjj.exe 2544 bthnhn.exe 2992 ppdjp.exe 1512 jvdvd.exe 1920 fxlxxfr.exe 2784 5hbbnn.exe 1632 vpjpp.exe 1984 xxrrxxl.exe 868 5xfxlrx.exe 1116 3rlxrfr.exe 2772 nnhthh.exe 2716 fxllrxl.exe 2628 vpdvp.exe 1924 fxrfxfl.exe 1020 5fxxflr.exe 2144 1dvdj.exe 1752 dvvdj.exe 2388 dpjjj.exe 1652 frlflrx.exe 3024 7hnbhh.exe 1280 lffxxxr.exe 1792 bttntt.exe 324 xxrxfrf.exe 2920 nththh.exe 2432 llrfrxl.exe 2084 rlffrxr.exe 2164 tbthbh.exe 1276 vpdjp.exe 2624 xfxlrxl.exe 2672 7fxxlrx.exe 2688 tntthh.exe 2760 vppdv.exe 2220 jvpvj.exe 2552 xlrrfxx.exe 2800 bttbnb.exe 2588 djdpj.exe 2532 fxrrfll.exe 1944 fxrflfr.exe 1616 nhttbb.exe 2000 1dpjd.exe 896 jjddv.exe 2260 5xllxxf.exe 2784 bbtbnn.exe 1712 nnhtbt.exe 2592 jppdp.exe 484 rllfffr.exe 1032 btntbb.exe 1908 3jppv.exe 2772 jjdjd.exe 2856 frffllr.exe 2160 hbbhbb.exe 2972 nnhthn.exe 1860 pppdp.exe 1424 rlffrxl.exe 1796 xlxxfxx.exe 344 btnnbh.exe 2132 hhttbb.exe -
resource yara_rule behavioral1/memory/2432-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1164-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1164-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/868-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1924-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1020-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1280-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/324-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1276-313-0x00000000005C0000-0x00000000005EA000-memory.dmp upx behavioral1/memory/1276-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1032-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-476-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-508-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-585-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2240-602-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2720-764-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-802-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-845-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-870-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-919-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-932-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/756-981-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-1242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-1328-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhtht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlffrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlfxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tthht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lrllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfflrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lxfflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxffrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbntht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nttbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2432 wrote to memory of 1696 2432 31a558e8e4d09e9256dd6e00b7a6b1bd6929ca8b2cb20f60ccafc5bd9b8da621.exe 31 PID 2432 wrote to memory of 1696 2432 31a558e8e4d09e9256dd6e00b7a6b1bd6929ca8b2cb20f60ccafc5bd9b8da621.exe 31 PID 2432 wrote to memory of 1696 2432 31a558e8e4d09e9256dd6e00b7a6b1bd6929ca8b2cb20f60ccafc5bd9b8da621.exe 31 PID 2432 wrote to memory of 1696 2432 31a558e8e4d09e9256dd6e00b7a6b1bd6929ca8b2cb20f60ccafc5bd9b8da621.exe 31 PID 1696 wrote to memory of 2316 1696 rrlrffr.exe 32 PID 1696 wrote to memory of 2316 1696 rrlrffr.exe 32 PID 1696 wrote to memory of 2316 1696 rrlrffr.exe 32 PID 1696 wrote to memory of 2316 1696 rrlrffr.exe 32 PID 2316 wrote to memory of 1164 2316 fxrxrrx.exe 33 PID 2316 wrote to memory of 1164 2316 fxrxrrx.exe 33 PID 2316 wrote to memory of 1164 2316 fxrxrrx.exe 33 PID 2316 wrote to memory of 1164 2316 fxrxrrx.exe 33 PID 1164 wrote to memory of 2092 1164 rlrlllr.exe 34 PID 1164 wrote to memory of 2092 1164 rlrlllr.exe 34 PID 1164 wrote to memory of 2092 1164 rlrlllr.exe 34 PID 1164 wrote to memory of 2092 1164 rlrlllr.exe 34 PID 2092 wrote to memory of 2828 2092 nbhtbb.exe 35 PID 2092 wrote to memory of 2828 2092 nbhtbb.exe 35 PID 2092 wrote to memory of 2828 2092 nbhtbb.exe 35 PID 2092 wrote to memory of 2828 2092 nbhtbb.exe 35 PID 2828 wrote to memory of 2536 2828 jvdvv.exe 36 PID 2828 wrote to memory of 2536 2828 jvdvv.exe 36 PID 2828 wrote to memory of 2536 2828 jvdvv.exe 36 PID 2828 wrote to memory of 2536 2828 jvdvv.exe 36 PID 2536 wrote to memory of 2724 2536 vvvjp.exe 37 PID 2536 wrote to memory of 2724 2536 vvvjp.exe 37 PID 2536 wrote to memory of 2724 2536 vvvjp.exe 37 PID 2536 wrote to memory of 2724 2536 vvvjp.exe 37 PID 2724 wrote to memory of 2576 2724 jjvvp.exe 38 PID 2724 wrote to memory of 2576 2724 jjvvp.exe 38 PID 2724 wrote to memory of 2576 2724 jjvvp.exe 38 PID 2724 wrote to memory of 2576 2724 jjvvp.exe 38 PID 2576 wrote to memory of 2544 2576 1pdjj.exe 39 PID 2576 wrote to memory of 2544 2576 1pdjj.exe 39 PID 2576 wrote to memory of 2544 2576 1pdjj.exe 39 PID 2576 wrote to memory of 2544 2576 1pdjj.exe 39 PID 2544 wrote to memory of 2992 2544 bthnhn.exe 40 PID 2544 wrote to memory of 2992 2544 bthnhn.exe 40 PID 2544 wrote to memory of 2992 2544 bthnhn.exe 40 PID 2544 wrote to memory of 2992 2544 bthnhn.exe 40 PID 2992 wrote to memory of 1512 2992 ppdjp.exe 41 PID 2992 wrote to memory of 1512 2992 ppdjp.exe 41 PID 2992 wrote to memory of 1512 2992 ppdjp.exe 41 PID 2992 wrote to memory of 1512 2992 ppdjp.exe 41 PID 1512 wrote to memory of 1920 1512 jvdvd.exe 42 PID 1512 wrote to memory of 1920 1512 jvdvd.exe 42 PID 1512 wrote to memory of 1920 1512 jvdvd.exe 42 PID 1512 wrote to memory of 1920 1512 jvdvd.exe 42 PID 1920 wrote to memory of 2784 1920 fxlxxfr.exe 43 PID 1920 wrote to memory of 2784 1920 fxlxxfr.exe 43 PID 1920 wrote to memory of 2784 1920 fxlxxfr.exe 43 PID 1920 wrote to memory of 2784 1920 fxlxxfr.exe 43 PID 2784 wrote to memory of 1632 2784 5hbbnn.exe 44 PID 2784 wrote to memory of 1632 2784 5hbbnn.exe 44 PID 2784 wrote to memory of 1632 2784 5hbbnn.exe 44 PID 2784 wrote to memory of 1632 2784 5hbbnn.exe 44 PID 1632 wrote to memory of 1984 1632 vpjpp.exe 45 PID 1632 wrote to memory of 1984 1632 vpjpp.exe 45 PID 1632 wrote to memory of 1984 1632 vpjpp.exe 45 PID 1632 wrote to memory of 1984 1632 vpjpp.exe 45 PID 1984 wrote to memory of 868 1984 xxrrxxl.exe 46 PID 1984 wrote to memory of 868 1984 xxrrxxl.exe 46 PID 1984 wrote to memory of 868 1984 xxrrxxl.exe 46 PID 1984 wrote to memory of 868 1984 xxrrxxl.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\31a558e8e4d09e9256dd6e00b7a6b1bd6929ca8b2cb20f60ccafc5bd9b8da621.exe"C:\Users\Admin\AppData\Local\Temp\31a558e8e4d09e9256dd6e00b7a6b1bd6929ca8b2cb20f60ccafc5bd9b8da621.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\rrlrffr.exec:\rrlrffr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\fxrxrrx.exec:\fxrxrrx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\rlrlllr.exec:\rlrlllr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
\??\c:\nbhtbb.exec:\nbhtbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\jvdvv.exec:\jvdvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\vvvjp.exec:\vvvjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\jjvvp.exec:\jjvvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\1pdjj.exec:\1pdjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\bthnhn.exec:\bthnhn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\ppdjp.exec:\ppdjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\jvdvd.exec:\jvdvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\fxlxxfr.exec:\fxlxxfr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\5hbbnn.exec:\5hbbnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\vpjpp.exec:\vpjpp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\xxrrxxl.exec:\xxrrxxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\5xfxlrx.exec:\5xfxlrx.exe17⤵
- Executes dropped EXE
PID:868 -
\??\c:\3rlxrfr.exec:\3rlxrfr.exe18⤵
- Executes dropped EXE
PID:1116 -
\??\c:\nnhthh.exec:\nnhthh.exe19⤵
- Executes dropped EXE
PID:2772 -
\??\c:\fxllrxl.exec:\fxllrxl.exe20⤵
- Executes dropped EXE
PID:2716 -
\??\c:\vpdvp.exec:\vpdvp.exe21⤵
- Executes dropped EXE
PID:2628 -
\??\c:\fxrfxfl.exec:\fxrfxfl.exe22⤵
- Executes dropped EXE
PID:1924 -
\??\c:\5fxxflr.exec:\5fxxflr.exe23⤵
- Executes dropped EXE
PID:1020 -
\??\c:\1dvdj.exec:\1dvdj.exe24⤵
- Executes dropped EXE
PID:2144 -
\??\c:\dvvdj.exec:\dvvdj.exe25⤵
- Executes dropped EXE
PID:1752 -
\??\c:\dpjjj.exec:\dpjjj.exe26⤵
- Executes dropped EXE
PID:2388 -
\??\c:\frlflrx.exec:\frlflrx.exe27⤵
- Executes dropped EXE
PID:1652 -
\??\c:\7hnbhh.exec:\7hnbhh.exe28⤵
- Executes dropped EXE
PID:3024 -
\??\c:\lffxxxr.exec:\lffxxxr.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1280 -
\??\c:\bttntt.exec:\bttntt.exe30⤵
- Executes dropped EXE
PID:1792 -
\??\c:\xxrxfrf.exec:\xxrxfrf.exe31⤵
- Executes dropped EXE
PID:324 -
\??\c:\nththh.exec:\nththh.exe32⤵
- Executes dropped EXE
PID:2920 -
\??\c:\llrfrxl.exec:\llrfrxl.exe33⤵
- Executes dropped EXE
PID:2432 -
\??\c:\rlffrxr.exec:\rlffrxr.exe34⤵
- Executes dropped EXE
PID:2084 -
\??\c:\tbthbh.exec:\tbthbh.exe35⤵
- Executes dropped EXE
PID:2164 -
\??\c:\vpdjp.exec:\vpdjp.exe36⤵
- Executes dropped EXE
PID:1276 -
\??\c:\xfxlrxl.exec:\xfxlrxl.exe37⤵
- Executes dropped EXE
PID:2624 -
\??\c:\7fxxlrx.exec:\7fxxlrx.exe38⤵
- Executes dropped EXE
PID:2672 -
\??\c:\tntthh.exec:\tntthh.exe39⤵
- Executes dropped EXE
PID:2688 -
\??\c:\vppdv.exec:\vppdv.exe40⤵
- Executes dropped EXE
PID:2760 -
\??\c:\jvpvj.exec:\jvpvj.exe41⤵
- Executes dropped EXE
PID:2220 -
\??\c:\xlrrfxx.exec:\xlrrfxx.exe42⤵
- Executes dropped EXE
PID:2552 -
\??\c:\bttbnb.exec:\bttbnb.exe43⤵
- Executes dropped EXE
PID:2800 -
\??\c:\djdpj.exec:\djdpj.exe44⤵
- Executes dropped EXE
PID:2588 -
\??\c:\fxrrfll.exec:\fxrrfll.exe45⤵
- Executes dropped EXE
PID:2532 -
\??\c:\fxrflfr.exec:\fxrflfr.exe46⤵
- Executes dropped EXE
PID:1944 -
\??\c:\nhttbb.exec:\nhttbb.exe47⤵
- Executes dropped EXE
PID:1616 -
\??\c:\1dpjd.exec:\1dpjd.exe48⤵
- Executes dropped EXE
PID:2000 -
\??\c:\jjddv.exec:\jjddv.exe49⤵
- Executes dropped EXE
PID:896 -
\??\c:\5xllxxf.exec:\5xllxxf.exe50⤵
- Executes dropped EXE
PID:2260 -
\??\c:\bbtbnn.exec:\bbtbnn.exe51⤵
- Executes dropped EXE
PID:2784 -
\??\c:\nnhtbt.exec:\nnhtbt.exe52⤵
- Executes dropped EXE
PID:1712 -
\??\c:\jppdp.exec:\jppdp.exe53⤵
- Executes dropped EXE
PID:2592 -
\??\c:\rllfffr.exec:\rllfffr.exe54⤵
- Executes dropped EXE
PID:484 -
\??\c:\btntbb.exec:\btntbb.exe55⤵
- Executes dropped EXE
PID:1032 -
\??\c:\3jppv.exec:\3jppv.exe56⤵
- Executes dropped EXE
PID:1908 -
\??\c:\jjdjd.exec:\jjdjd.exe57⤵
- Executes dropped EXE
PID:2772 -
\??\c:\frffllr.exec:\frffllr.exe58⤵
- Executes dropped EXE
PID:2856 -
\??\c:\hbbhbb.exec:\hbbhbb.exe59⤵
- Executes dropped EXE
PID:2160 -
\??\c:\nnhthn.exec:\nnhthn.exe60⤵
- Executes dropped EXE
PID:2972 -
\??\c:\pppdp.exec:\pppdp.exe61⤵
- Executes dropped EXE
PID:1860 -
\??\c:\rlffrxl.exec:\rlffrxl.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1424 -
\??\c:\xlxxfxx.exec:\xlxxfxx.exe63⤵
- Executes dropped EXE
PID:1796 -
\??\c:\btnnbh.exec:\btnnbh.exe64⤵
- Executes dropped EXE
PID:344 -
\??\c:\hhttbb.exec:\hhttbb.exe65⤵
- Executes dropped EXE
PID:2132 -
\??\c:\vpjpv.exec:\vpjpv.exe66⤵PID:1524
-
\??\c:\1rfrrxf.exec:\1rfrrxf.exe67⤵PID:2884
-
\??\c:\hbbtbt.exec:\hbbtbt.exe68⤵PID:2980
-
\??\c:\tnhnhh.exec:\tnhnhh.exe69⤵PID:3024
-
\??\c:\pdppp.exec:\pdppp.exe70⤵PID:2964
-
\??\c:\fxrxlrf.exec:\fxrxlrf.exe71⤵PID:1012
-
\??\c:\tnbhhh.exec:\tnbhhh.exe72⤵PID:2060
-
\??\c:\bbbnhn.exec:\bbbnhn.exe73⤵
- System Location Discovery: System Language Discovery
PID:2612 -
\??\c:\ppjjp.exec:\ppjjp.exe74⤵PID:2900
-
\??\c:\fxxlrrx.exec:\fxxlrrx.exe75⤵PID:1560
-
\??\c:\ntthnb.exec:\ntthnb.exe76⤵PID:1696
-
\??\c:\bbhnht.exec:\bbhnht.exe77⤵PID:2264
-
\??\c:\rrlxllr.exec:\rrlxllr.exe78⤵PID:2844
-
\??\c:\llflflf.exec:\llflflf.exe79⤵PID:2728
-
\??\c:\tthnhh.exec:\tthnhh.exe80⤵PID:2240
-
\??\c:\djdpj.exec:\djdpj.exe81⤵PID:2740
-
\??\c:\jdpdd.exec:\jdpdd.exe82⤵PID:2912
-
\??\c:\fxllxff.exec:\fxllxff.exe83⤵PID:2768
-
\??\c:\7hnntn.exec:\7hnntn.exe84⤵PID:2220
-
\??\c:\btnntt.exec:\btnntt.exe85⤵PID:2552
-
\??\c:\ppvdj.exec:\ppvdj.exe86⤵PID:2604
-
\??\c:\9lfflxf.exec:\9lfflxf.exe87⤵PID:2588
-
\??\c:\ffxlfrf.exec:\ffxlfrf.exe88⤵PID:2700
-
\??\c:\thtthh.exec:\thtthh.exe89⤵PID:1676
-
\??\c:\jjjdp.exec:\jjjdp.exe90⤵PID:908
-
\??\c:\ddvpd.exec:\ddvpd.exe91⤵PID:2812
-
\??\c:\frllrlx.exec:\frllrlx.exe92⤵PID:1920
-
\??\c:\nhtthn.exec:\nhtthn.exe93⤵PID:1660
-
\??\c:\tthnhh.exec:\tthnhh.exe94⤵PID:1708
-
\??\c:\jjdjd.exec:\jjdjd.exe95⤵PID:1380
-
\??\c:\fxlfllf.exec:\fxlfllf.exe96⤵PID:1996
-
\??\c:\flrxlrf.exec:\flrxlrf.exe97⤵PID:1688
-
\??\c:\thbhtt.exec:\thbhtt.exe98⤵PID:292
-
\??\c:\pppvd.exec:\pppvd.exe99⤵PID:1032
-
\??\c:\7rrfllr.exec:\7rrfllr.exe100⤵PID:2200
-
\??\c:\1hnbhn.exec:\1hnbhn.exe101⤵PID:2852
-
\??\c:\tnhbhn.exec:\tnhbhn.exe102⤵PID:2368
-
\??\c:\vpddd.exec:\vpddd.exe103⤵PID:2984
-
\??\c:\xlxrlll.exec:\xlxrlll.exe104⤵PID:1036
-
\??\c:\xxlrflx.exec:\xxlrflx.exe105⤵PID:1284
-
\??\c:\btthtt.exec:\btthtt.exe106⤵PID:872
-
\??\c:\1pjpd.exec:\1pjpd.exe107⤵PID:2720
-
\??\c:\djdvj.exec:\djdvj.exe108⤵PID:344
-
\??\c:\xfxxrlx.exec:\xfxxrlx.exe109⤵PID:2132
-
\??\c:\flxxflx.exec:\flxxflx.exe110⤵PID:1524
-
\??\c:\nnbhbt.exec:\nnbhbt.exe111⤵PID:2380
-
\??\c:\pppvd.exec:\pppvd.exe112⤵PID:2980
-
\??\c:\rlllrxl.exec:\rlllrxl.exe113⤵PID:3024
-
\??\c:\llxlflr.exec:\llxlflr.exe114⤵PID:1844
-
\??\c:\7btbnb.exec:\7btbnb.exe115⤵PID:2300
-
\??\c:\pvdjv.exec:\pvdjv.exe116⤵PID:900
-
\??\c:\dvjpd.exec:\dvjpd.exe117⤵PID:2920
-
\??\c:\1frxfrf.exec:\1frxfrf.exe118⤵PID:1704
-
\??\c:\tnbhht.exec:\tnbhht.exe119⤵PID:1584
-
\??\c:\btntbh.exec:\btntbh.exe120⤵PID:2088
-
\??\c:\vppdj.exec:\vppdj.exe121⤵PID:2264
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-