Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 09:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b6c193de6d8744bdc0769f5c8abe2fefefce742fa3be460b1619fa4a8f75b84d.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
b6c193de6d8744bdc0769f5c8abe2fefefce742fa3be460b1619fa4a8f75b84d.exe
-
Size
454KB
-
MD5
028354d76bfca5b4d8452fd7dad45001
-
SHA1
7f5a15adf340040e323df9c4e43360861f3c5200
-
SHA256
b6c193de6d8744bdc0769f5c8abe2fefefce742fa3be460b1619fa4a8f75b84d
-
SHA512
ce6edfa4d27a6dc8a054b093bb97afceb40da0b01913efff223e5305094cc920f4ec3f9b807eb1458c5c417b01965e7043385aaac8a3b827440dfd2314a2ffa1
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeU:q7Tc2NYHUrAwfMp3CDU
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/2348-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2516-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2260-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2040-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-58-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2732-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1628-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1888-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1828-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1440-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1440-171-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1608-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/696-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1608-229-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2932-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1944-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2340-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2400-310-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2816-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-386-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/820-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1100-445-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-484-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2484-530-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1424-556-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1640-585-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/1184-610-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-660-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-667-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1400-674-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1456-682-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1952-751-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1204-825-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-856-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1628 3tbntb.exe 2516 ppjpp.exe 2260 xxffxfx.exe 2040 1hbbnb.exe 2820 5bnbnn.exe 2732 xfrxfrl.exe 2892 7bhntt.exe 2772 7ffxxll.exe 2600 fxlxllr.exe 2768 vjvpv.exe 2648 xrflxxl.exe 1888 tthtbb.exe 2804 dvppv.exe 1416 lfflfll.exe 572 1vddp.exe 2852 xfxlrfr.exe 1440 hbntht.exe 1828 rlrfxrf.exe 3024 tbbnhn.exe 1608 1rlxlxl.exe 2520 nnbhtb.exe 1656 xxrxrxl.exe 1180 llffxfl.exe 696 pjpdj.exe 1784 jdppd.exe 2224 fxrflxf.exe 2380 vpjjp.exe 2932 rlfxflr.exe 1944 bnntnb.exe 796 rfflllf.exe 2340 9rrfrrl.exe 1500 7dvdj.exe 2400 ffrfrrl.exe 848 9hhhtt.exe 2260 hnhhtb.exe 2812 vpdjp.exe 2868 rxlrxlf.exe 2816 rlflxfx.exe 2744 bbnthh.exe 2776 pjvpv.exe 2640 fxlxlxl.exe 2608 xxfrffr.exe 2636 tttbnb.exe 2616 vjvpp.exe 2068 vvjjv.exe 1396 fxxrrxl.exe 2460 tttbht.exe 820 7ntbbn.exe 2848 pddjd.exe 1668 rlxxxfr.exe 1416 5ttbhn.exe 1116 btbthb.exe 1100 ppjdv.exe 112 xflxxff.exe 1312 9llrlxf.exe 2172 9tbhbn.exe 2052 5pjjd.exe 2108 rllrffr.exe 1616 llfrfrf.exe 2588 hbtbnn.exe 1700 jjdjv.exe 1464 ddvvd.exe 1284 xrlrxfx.exe 2188 tthhnn.exe -
resource yara_rule behavioral1/memory/2348-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2040-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2040-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1888-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1828-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1440-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/696-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/820-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1100-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-484-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/2588-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-523-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-530-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-537-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1424-556-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1184-610-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-660-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-667-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1400-674-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1456-682-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1992-689-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-703-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-742-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1204-825-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-844-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-856-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/2828-872-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-885-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xxfllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlflxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbntnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7fllxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfffxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrxlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7btbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2348 wrote to memory of 1628 2348 b6c193de6d8744bdc0769f5c8abe2fefefce742fa3be460b1619fa4a8f75b84d.exe 30 PID 2348 wrote to memory of 1628 2348 b6c193de6d8744bdc0769f5c8abe2fefefce742fa3be460b1619fa4a8f75b84d.exe 30 PID 2348 wrote to memory of 1628 2348 b6c193de6d8744bdc0769f5c8abe2fefefce742fa3be460b1619fa4a8f75b84d.exe 30 PID 2348 wrote to memory of 1628 2348 b6c193de6d8744bdc0769f5c8abe2fefefce742fa3be460b1619fa4a8f75b84d.exe 30 PID 1628 wrote to memory of 2516 1628 3tbntb.exe 31 PID 1628 wrote to memory of 2516 1628 3tbntb.exe 31 PID 1628 wrote to memory of 2516 1628 3tbntb.exe 31 PID 1628 wrote to memory of 2516 1628 3tbntb.exe 31 PID 2516 wrote to memory of 2260 2516 ppjpp.exe 32 PID 2516 wrote to memory of 2260 2516 ppjpp.exe 32 PID 2516 wrote to memory of 2260 2516 ppjpp.exe 32 PID 2516 wrote to memory of 2260 2516 ppjpp.exe 32 PID 2260 wrote to memory of 2040 2260 xxffxfx.exe 33 PID 2260 wrote to memory of 2040 2260 xxffxfx.exe 33 PID 2260 wrote to memory of 2040 2260 xxffxfx.exe 33 PID 2260 wrote to memory of 2040 2260 xxffxfx.exe 33 PID 2040 wrote to memory of 2820 2040 1hbbnb.exe 34 PID 2040 wrote to memory of 2820 2040 1hbbnb.exe 34 PID 2040 wrote to memory of 2820 2040 1hbbnb.exe 34 PID 2040 wrote to memory of 2820 2040 1hbbnb.exe 34 PID 2820 wrote to memory of 2732 2820 5bnbnn.exe 35 PID 2820 wrote to memory of 2732 2820 5bnbnn.exe 35 PID 2820 wrote to memory of 2732 2820 5bnbnn.exe 35 PID 2820 wrote to memory of 2732 2820 5bnbnn.exe 35 PID 2732 wrote to memory of 2892 2732 xfrxfrl.exe 36 PID 2732 wrote to memory of 2892 2732 xfrxfrl.exe 36 PID 2732 wrote to memory of 2892 2732 xfrxfrl.exe 36 PID 2732 wrote to memory of 2892 2732 xfrxfrl.exe 36 PID 2892 wrote to memory of 2772 2892 7bhntt.exe 37 PID 2892 wrote to memory of 2772 2892 7bhntt.exe 37 PID 2892 wrote to memory of 2772 2892 7bhntt.exe 37 PID 2892 wrote to memory of 2772 2892 7bhntt.exe 37 PID 2772 wrote to memory of 2600 2772 7ffxxll.exe 38 PID 2772 wrote to memory of 2600 2772 7ffxxll.exe 38 PID 2772 wrote to memory of 2600 2772 7ffxxll.exe 38 PID 2772 wrote to memory of 2600 2772 7ffxxll.exe 38 PID 2600 wrote to memory of 2768 2600 fxlxllr.exe 39 PID 2600 wrote to memory of 2768 2600 fxlxllr.exe 39 PID 2600 wrote to memory of 2768 2600 fxlxllr.exe 39 PID 2600 wrote to memory of 2768 2600 fxlxllr.exe 39 PID 2768 wrote to memory of 2648 2768 vjvpv.exe 40 PID 2768 wrote to memory of 2648 2768 vjvpv.exe 40 PID 2768 wrote to memory of 2648 2768 vjvpv.exe 40 PID 2768 wrote to memory of 2648 2768 vjvpv.exe 40 PID 2648 wrote to memory of 1888 2648 xrflxxl.exe 41 PID 2648 wrote to memory of 1888 2648 xrflxxl.exe 41 PID 2648 wrote to memory of 1888 2648 xrflxxl.exe 41 PID 2648 wrote to memory of 1888 2648 xrflxxl.exe 41 PID 1888 wrote to memory of 2804 1888 tthtbb.exe 42 PID 1888 wrote to memory of 2804 1888 tthtbb.exe 42 PID 1888 wrote to memory of 2804 1888 tthtbb.exe 42 PID 1888 wrote to memory of 2804 1888 tthtbb.exe 42 PID 2804 wrote to memory of 1416 2804 dvppv.exe 43 PID 2804 wrote to memory of 1416 2804 dvppv.exe 43 PID 2804 wrote to memory of 1416 2804 dvppv.exe 43 PID 2804 wrote to memory of 1416 2804 dvppv.exe 43 PID 1416 wrote to memory of 572 1416 lfflfll.exe 44 PID 1416 wrote to memory of 572 1416 lfflfll.exe 44 PID 1416 wrote to memory of 572 1416 lfflfll.exe 44 PID 1416 wrote to memory of 572 1416 lfflfll.exe 44 PID 572 wrote to memory of 2852 572 1vddp.exe 45 PID 572 wrote to memory of 2852 572 1vddp.exe 45 PID 572 wrote to memory of 2852 572 1vddp.exe 45 PID 572 wrote to memory of 2852 572 1vddp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\b6c193de6d8744bdc0769f5c8abe2fefefce742fa3be460b1619fa4a8f75b84d.exe"C:\Users\Admin\AppData\Local\Temp\b6c193de6d8744bdc0769f5c8abe2fefefce742fa3be460b1619fa4a8f75b84d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\3tbntb.exec:\3tbntb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\ppjpp.exec:\ppjpp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\xxffxfx.exec:\xxffxfx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\1hbbnb.exec:\1hbbnb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\5bnbnn.exec:\5bnbnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\xfrxfrl.exec:\xfrxfrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\7bhntt.exec:\7bhntt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\7ffxxll.exec:\7ffxxll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\fxlxllr.exec:\fxlxllr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\vjvpv.exec:\vjvpv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\xrflxxl.exec:\xrflxxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\tthtbb.exec:\tthtbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
\??\c:\dvppv.exec:\dvppv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\lfflfll.exec:\lfflfll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
\??\c:\1vddp.exec:\1vddp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:572 -
\??\c:\xfxlrfr.exec:\xfxlrfr.exe17⤵
- Executes dropped EXE
PID:2852 -
\??\c:\hbntht.exec:\hbntht.exe18⤵
- Executes dropped EXE
PID:1440 -
\??\c:\rlrfxrf.exec:\rlrfxrf.exe19⤵
- Executes dropped EXE
PID:1828 -
\??\c:\tbbnhn.exec:\tbbnhn.exe20⤵
- Executes dropped EXE
PID:3024 -
\??\c:\1rlxlxl.exec:\1rlxlxl.exe21⤵
- Executes dropped EXE
PID:1608 -
\??\c:\nnbhtb.exec:\nnbhtb.exe22⤵
- Executes dropped EXE
PID:2520 -
\??\c:\xxrxrxl.exec:\xxrxrxl.exe23⤵
- Executes dropped EXE
PID:1656 -
\??\c:\llffxfl.exec:\llffxfl.exe24⤵
- Executes dropped EXE
PID:1180 -
\??\c:\pjpdj.exec:\pjpdj.exe25⤵
- Executes dropped EXE
PID:696 -
\??\c:\jdppd.exec:\jdppd.exe26⤵
- Executes dropped EXE
PID:1784 -
\??\c:\fxrflxf.exec:\fxrflxf.exe27⤵
- Executes dropped EXE
PID:2224 -
\??\c:\vpjjp.exec:\vpjjp.exe28⤵
- Executes dropped EXE
PID:2380 -
\??\c:\rlfxflr.exec:\rlfxflr.exe29⤵
- Executes dropped EXE
PID:2932 -
\??\c:\bnntnb.exec:\bnntnb.exe30⤵
- Executes dropped EXE
PID:1944 -
\??\c:\rfflllf.exec:\rfflllf.exe31⤵
- Executes dropped EXE
PID:796 -
\??\c:\9rrfrrl.exec:\9rrfrrl.exe32⤵
- Executes dropped EXE
PID:2340 -
\??\c:\7dvdj.exec:\7dvdj.exe33⤵
- Executes dropped EXE
PID:1500 -
\??\c:\ffrfrrl.exec:\ffrfrrl.exe34⤵
- Executes dropped EXE
PID:2400 -
\??\c:\9hhhtt.exec:\9hhhtt.exe35⤵
- Executes dropped EXE
PID:848 -
\??\c:\hnhhtb.exec:\hnhhtb.exe36⤵
- Executes dropped EXE
PID:2260 -
\??\c:\vpdjp.exec:\vpdjp.exe37⤵
- Executes dropped EXE
PID:2812 -
\??\c:\rxlrxlf.exec:\rxlrxlf.exe38⤵
- Executes dropped EXE
PID:2868 -
\??\c:\rlflxfx.exec:\rlflxfx.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2816 -
\??\c:\bbnthh.exec:\bbnthh.exe40⤵
- Executes dropped EXE
PID:2744 -
\??\c:\pjvpv.exec:\pjvpv.exe41⤵
- Executes dropped EXE
PID:2776 -
\??\c:\fxlxlxl.exec:\fxlxlxl.exe42⤵
- Executes dropped EXE
PID:2640 -
\??\c:\xxfrffr.exec:\xxfrffr.exe43⤵
- Executes dropped EXE
PID:2608 -
\??\c:\tttbnb.exec:\tttbnb.exe44⤵
- Executes dropped EXE
PID:2636 -
\??\c:\vjvpp.exec:\vjvpp.exe45⤵
- Executes dropped EXE
PID:2616 -
\??\c:\vvjjv.exec:\vvjjv.exe46⤵
- Executes dropped EXE
PID:2068 -
\??\c:\fxxrrxl.exec:\fxxrrxl.exe47⤵
- Executes dropped EXE
PID:1396 -
\??\c:\tttbht.exec:\tttbht.exe48⤵
- Executes dropped EXE
PID:2460 -
\??\c:\7ntbbn.exec:\7ntbbn.exe49⤵
- Executes dropped EXE
PID:820 -
\??\c:\pddjd.exec:\pddjd.exe50⤵
- Executes dropped EXE
PID:2848 -
\??\c:\rlxxxfr.exec:\rlxxxfr.exe51⤵
- Executes dropped EXE
PID:1668 -
\??\c:\5ttbhn.exec:\5ttbhn.exe52⤵
- Executes dropped EXE
PID:1416 -
\??\c:\btbthb.exec:\btbthb.exe53⤵
- Executes dropped EXE
PID:1116 -
\??\c:\ppjdv.exec:\ppjdv.exe54⤵
- Executes dropped EXE
PID:1100 -
\??\c:\xflxxff.exec:\xflxxff.exe55⤵
- Executes dropped EXE
PID:112 -
\??\c:\9llrlxf.exec:\9llrlxf.exe56⤵
- Executes dropped EXE
PID:1312 -
\??\c:\9tbhbn.exec:\9tbhbn.exe57⤵
- Executes dropped EXE
PID:2172 -
\??\c:\5pjjd.exec:\5pjjd.exe58⤵
- Executes dropped EXE
PID:2052 -
\??\c:\rllrffr.exec:\rllrffr.exe59⤵
- Executes dropped EXE
PID:2108 -
\??\c:\llfrfrf.exec:\llfrfrf.exe60⤵
- Executes dropped EXE
PID:1616 -
\??\c:\hbtbnn.exec:\hbtbnn.exe61⤵
- Executes dropped EXE
PID:2588 -
\??\c:\jjdjv.exec:\jjdjv.exe62⤵
- Executes dropped EXE
PID:1700 -
\??\c:\ddvvd.exec:\ddvvd.exe63⤵
- Executes dropped EXE
PID:1464 -
\??\c:\xrlrxfx.exec:\xrlrxfx.exe64⤵
- Executes dropped EXE
PID:1284 -
\??\c:\tthhnn.exec:\tthhnn.exe65⤵
- Executes dropped EXE
PID:2188 -
\??\c:\thbnbb.exec:\thbnbb.exe66⤵PID:2248
-
\??\c:\jjppp.exec:\jjppp.exe67⤵PID:2484
-
\??\c:\fxxfllr.exec:\fxxfllr.exe68⤵PID:2148
-
\??\c:\frxxfxx.exec:\frxxfxx.exe69⤵PID:3008
-
\??\c:\nttnbh.exec:\nttnbh.exe70⤵PID:992
-
\??\c:\5vpvv.exec:\5vpvv.exe71⤵PID:1424
-
\??\c:\pdjpj.exec:\pdjpj.exe72⤵PID:2132
-
\??\c:\7rrfrfl.exec:\7rrfrfl.exe73⤵PID:1640
-
\??\c:\hhttnn.exec:\hhttnn.exe74⤵PID:2476
-
\??\c:\vpddp.exec:\vpddp.exe75⤵PID:1500
-
\??\c:\1dvvp.exec:\1dvvp.exe76⤵PID:2096
-
\??\c:\3lxxlff.exec:\3lxxlff.exe77⤵PID:2412
-
\??\c:\rrxfrrr.exec:\rrxfrrr.exe78⤵PID:2228
-
\??\c:\7nhhnh.exec:\7nhhnh.exe79⤵PID:2552
-
\??\c:\vvpvj.exec:\vvpvj.exe80⤵PID:2928
-
\??\c:\frffrlr.exec:\frffrlr.exe81⤵PID:1184
-
\??\c:\ttnthh.exec:\ttnthh.exe82⤵PID:2816
-
\??\c:\htnnnn.exec:\htnnnn.exe83⤵PID:2744
-
\??\c:\vjddj.exec:\vjddj.exe84⤵
- System Location Discovery: System Language Discovery
PID:2760 -
\??\c:\7lxrxxf.exec:\7lxrxxf.exe85⤵PID:2620
-
\??\c:\3lxrflx.exec:\3lxrflx.exe86⤵PID:2872
-
\??\c:\jpjdj.exec:\jpjdj.exe87⤵PID:2116
-
\??\c:\ppjpd.exec:\ppjpd.exe88⤵PID:2680
-
\??\c:\xxlrfxf.exec:\xxlrfxf.exe89⤵PID:2720
-
\??\c:\fxllxxf.exec:\fxllxxf.exe90⤵
- System Location Discovery: System Language Discovery
PID:628 -
\??\c:\hhbhtt.exec:\hhbhtt.exe91⤵PID:1400
-
\??\c:\jvjpv.exec:\jvjpv.exe92⤵PID:1456
-
\??\c:\5lxrllx.exec:\5lxrllx.exe93⤵PID:1992
-
\??\c:\fflfxll.exec:\fflfxll.exe94⤵PID:2836
-
\??\c:\bnhhhh.exec:\bnhhhh.exe95⤵PID:2844
-
\??\c:\vjvjj.exec:\vjvjj.exe96⤵PID:2664
-
\??\c:\xxrxllf.exec:\xxrxllf.exe97⤵PID:1984
-
\??\c:\rrrxxfx.exec:\rrrxxfx.exe98⤵PID:1952
-
\??\c:\tthnnt.exec:\tthnnt.exe99⤵PID:1312
-
\??\c:\pjppj.exec:\pjppj.exe100⤵PID:2952
-
\??\c:\jjddd.exec:\jjddd.exe101⤵PID:2160
-
\??\c:\9xrfrxl.exec:\9xrfrxl.exe102⤵PID:2108
-
\??\c:\bbtbtb.exec:\bbtbtb.exe103⤵PID:2252
-
\??\c:\nnbhnt.exec:\nnbhnt.exe104⤵PID:844
-
\??\c:\pjvvj.exec:\pjvvj.exe105⤵PID:448
-
\??\c:\rllflxl.exec:\rllflxl.exe106⤵PID:2992
-
\??\c:\rrlfrrr.exec:\rrlfrrr.exe107⤵PID:2780
-
\??\c:\hbtnnt.exec:\hbtnnt.exe108⤵PID:2188
-
\??\c:\dvddp.exec:\dvddp.exe109⤵PID:2216
-
\??\c:\vvpvp.exec:\vvpvp.exe110⤵PID:1676
-
\??\c:\lfxfrrx.exec:\lfxfrrx.exe111⤵PID:344
-
\??\c:\bbtbnn.exec:\bbtbnn.exe112⤵PID:2480
-
\??\c:\vvpvd.exec:\vvpvd.exe113⤵PID:1204
-
\??\c:\ddvvj.exec:\ddvvj.exe114⤵PID:1724
-
\??\c:\xrllrrx.exec:\xrllrrx.exe115⤵PID:2300
-
\??\c:\nnhhbb.exec:\nnhhbb.exe116⤵PID:2960
-
\??\c:\tnbbnt.exec:\tnbbnt.exe117⤵PID:2340
-
\??\c:\jjdpd.exec:\jjdpd.exe118⤵PID:2684
-
\??\c:\fxrfffr.exec:\fxrfffr.exe119⤵PID:2516
-
\??\c:\rrlrrxl.exec:\rrlrrxl.exe120⤵PID:2840
-
\??\c:\hbbtbb.exec:\hbbtbb.exe121⤵PID:2828
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-