Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 08:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fb49eeb68b74d1fef0996b1b372ef3f0a95d99b5dda32b45e5f6b742c068976fN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
fb49eeb68b74d1fef0996b1b372ef3f0a95d99b5dda32b45e5f6b742c068976fN.exe
-
Size
456KB
-
MD5
8c85296322424b1822e455527b00f810
-
SHA1
5b28a5cdf7fd1cf4d2a2232e7d630ed2ca09b790
-
SHA256
fb49eeb68b74d1fef0996b1b372ef3f0a95d99b5dda32b45e5f6b742c068976f
-
SHA512
20b18eb82a65e9321197835e195ef670bb6146c3ba03d0fe06e671cd6284c4454edf87eecfba99f44c60e892edd016c4cba807887f7af642404badaa2af57640
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeLl:q7Tc2NYHUrAwfMp3CDLl
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/1924-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2064-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1404-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-34-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2924-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2288-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2240-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1524-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1496-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2384-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1316-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2028-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1060-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1960-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/844-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1916-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1680-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1968-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1584-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1260-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1888-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1684-394-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2976-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1072-432-0x0000000001C70000-0x0000000001C9A000-memory.dmp family_blackmoon behavioral1/memory/2460-440-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2460-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2496-491-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1680-529-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-729-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3052-814-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-975-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2284-1031-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1160-1125-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2640-1193-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2804-1262-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1512-1268-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2260-1383-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2064 bnthtn.exe 1404 vppdj.exe 2924 xrffrrf.exe 2288 ppjjv.exe 2844 lfllrxl.exe 2864 bthbhn.exe 2744 lxxllxr.exe 2808 9pdjp.exe 2908 xlxfffl.exe 2692 nbhbnt.exe 2240 vpdjp.exe 1524 rfrlrlr.exe 1028 1htttn.exe 1496 dvjjp.exe 2936 7rfxrrr.exe 2384 dpjdd.exe 1316 fxrxffl.exe 1512 bnthhb.exe 2028 rlrxflx.exe 2168 nhbbnt.exe 2392 1hbbtb.exe 1060 frfxxrr.exe 1960 vpddj.exe 844 xrffllx.exe 1916 9nhntt.exe 1680 pjdjv.exe 1256 frffrlf.exe 1968 ddjdp.exe 1928 lfxfxxl.exe 884 bttntt.exe 1748 1vjpv.exe 1584 rrlrxxr.exe 2388 tnhbbb.exe 1404 nbttht.exe 1724 1dvdj.exe 336 lfrrffl.exe 1260 ffrxlxl.exe 2832 hbnthh.exe 2856 vvppd.exe 2864 vpjpp.exe 2664 xlffrlf.exe 1888 tthbhh.exe 2640 nhhnnt.exe 2660 pjjjp.exe 2632 xrlrxfr.exe 1684 xxlflrx.exe 1200 7bbtbh.exe 3004 dvdvd.exe 580 9dvpp.exe 2976 rfrlxrf.exe 2036 nthhnb.exe 1072 vpdpp.exe 2460 5pjdd.exe 2804 7lfffff.exe 1580 tnbbhh.exe 1512 hhbtbb.exe 2028 vdvvj.exe 1792 fxflxfx.exe 2668 lfrxflr.exe 840 tnhnbh.exe 2496 9dppp.exe 2208 7vdjp.exe 276 lfxfrlx.exe 1384 nbbtbb.exe -
resource yara_rule behavioral1/memory/1924-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1404-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2240-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1496-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1316-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1060-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/844-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1916-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1916-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/336-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1260-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-355-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/1888-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/276-498-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-529-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-610-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-641-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1520-672-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-814-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1904-949-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-968-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1160-1122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-1149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-1176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-1190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-1270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1856-1295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-1332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-1352-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxlrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5flxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnttbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tnhbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrllxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1924 wrote to memory of 2064 1924 fb49eeb68b74d1fef0996b1b372ef3f0a95d99b5dda32b45e5f6b742c068976fN.exe 30 PID 1924 wrote to memory of 2064 1924 fb49eeb68b74d1fef0996b1b372ef3f0a95d99b5dda32b45e5f6b742c068976fN.exe 30 PID 1924 wrote to memory of 2064 1924 fb49eeb68b74d1fef0996b1b372ef3f0a95d99b5dda32b45e5f6b742c068976fN.exe 30 PID 1924 wrote to memory of 2064 1924 fb49eeb68b74d1fef0996b1b372ef3f0a95d99b5dda32b45e5f6b742c068976fN.exe 30 PID 2064 wrote to memory of 1404 2064 bnthtn.exe 31 PID 2064 wrote to memory of 1404 2064 bnthtn.exe 31 PID 2064 wrote to memory of 1404 2064 bnthtn.exe 31 PID 2064 wrote to memory of 1404 2064 bnthtn.exe 31 PID 1404 wrote to memory of 2924 1404 vppdj.exe 32 PID 1404 wrote to memory of 2924 1404 vppdj.exe 32 PID 1404 wrote to memory of 2924 1404 vppdj.exe 32 PID 1404 wrote to memory of 2924 1404 vppdj.exe 32 PID 2924 wrote to memory of 2288 2924 xrffrrf.exe 33 PID 2924 wrote to memory of 2288 2924 xrffrrf.exe 33 PID 2924 wrote to memory of 2288 2924 xrffrrf.exe 33 PID 2924 wrote to memory of 2288 2924 xrffrrf.exe 33 PID 2288 wrote to memory of 2844 2288 ppjjv.exe 34 PID 2288 wrote to memory of 2844 2288 ppjjv.exe 34 PID 2288 wrote to memory of 2844 2288 ppjjv.exe 34 PID 2288 wrote to memory of 2844 2288 ppjjv.exe 34 PID 2844 wrote to memory of 2864 2844 lfllrxl.exe 35 PID 2844 wrote to memory of 2864 2844 lfllrxl.exe 35 PID 2844 wrote to memory of 2864 2844 lfllrxl.exe 35 PID 2844 wrote to memory of 2864 2844 lfllrxl.exe 35 PID 2864 wrote to memory of 2744 2864 bthbhn.exe 36 PID 2864 wrote to memory of 2744 2864 bthbhn.exe 36 PID 2864 wrote to memory of 2744 2864 bthbhn.exe 36 PID 2864 wrote to memory of 2744 2864 bthbhn.exe 36 PID 2744 wrote to memory of 2808 2744 lxxllxr.exe 37 PID 2744 wrote to memory of 2808 2744 lxxllxr.exe 37 PID 2744 wrote to memory of 2808 2744 lxxllxr.exe 37 PID 2744 wrote to memory of 2808 2744 lxxllxr.exe 37 PID 2808 wrote to memory of 2908 2808 9pdjp.exe 38 PID 2808 wrote to memory of 2908 2808 9pdjp.exe 38 PID 2808 wrote to memory of 2908 2808 9pdjp.exe 38 PID 2808 wrote to memory of 2908 2808 9pdjp.exe 38 PID 2908 wrote to memory of 2692 2908 xlxfffl.exe 39 PID 2908 wrote to memory of 2692 2908 xlxfffl.exe 39 PID 2908 wrote to memory of 2692 2908 xlxfffl.exe 39 PID 2908 wrote to memory of 2692 2908 xlxfffl.exe 39 PID 2692 wrote to memory of 2240 2692 nbhbnt.exe 40 PID 2692 wrote to memory of 2240 2692 nbhbnt.exe 40 PID 2692 wrote to memory of 2240 2692 nbhbnt.exe 40 PID 2692 wrote to memory of 2240 2692 nbhbnt.exe 40 PID 2240 wrote to memory of 1524 2240 vpdjp.exe 41 PID 2240 wrote to memory of 1524 2240 vpdjp.exe 41 PID 2240 wrote to memory of 1524 2240 vpdjp.exe 41 PID 2240 wrote to memory of 1524 2240 vpdjp.exe 41 PID 1524 wrote to memory of 1028 1524 rfrlrlr.exe 42 PID 1524 wrote to memory of 1028 1524 rfrlrlr.exe 42 PID 1524 wrote to memory of 1028 1524 rfrlrlr.exe 42 PID 1524 wrote to memory of 1028 1524 rfrlrlr.exe 42 PID 1028 wrote to memory of 1496 1028 1htttn.exe 43 PID 1028 wrote to memory of 1496 1028 1htttn.exe 43 PID 1028 wrote to memory of 1496 1028 1htttn.exe 43 PID 1028 wrote to memory of 1496 1028 1htttn.exe 43 PID 1496 wrote to memory of 2936 1496 dvjjp.exe 44 PID 1496 wrote to memory of 2936 1496 dvjjp.exe 44 PID 1496 wrote to memory of 2936 1496 dvjjp.exe 44 PID 1496 wrote to memory of 2936 1496 dvjjp.exe 44 PID 2936 wrote to memory of 2384 2936 7rfxrrr.exe 45 PID 2936 wrote to memory of 2384 2936 7rfxrrr.exe 45 PID 2936 wrote to memory of 2384 2936 7rfxrrr.exe 45 PID 2936 wrote to memory of 2384 2936 7rfxrrr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb49eeb68b74d1fef0996b1b372ef3f0a95d99b5dda32b45e5f6b742c068976fN.exe"C:\Users\Admin\AppData\Local\Temp\fb49eeb68b74d1fef0996b1b372ef3f0a95d99b5dda32b45e5f6b742c068976fN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\bnthtn.exec:\bnthtn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\vppdj.exec:\vppdj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
\??\c:\xrffrrf.exec:\xrffrrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\ppjjv.exec:\ppjjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\lfllrxl.exec:\lfllrxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\bthbhn.exec:\bthbhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\lxxllxr.exec:\lxxllxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\9pdjp.exec:\9pdjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\xlxfffl.exec:\xlxfffl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\nbhbnt.exec:\nbhbnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\vpdjp.exec:\vpdjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\rfrlrlr.exec:\rfrlrlr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\1htttn.exec:\1htttn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
\??\c:\dvjjp.exec:\dvjjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\7rfxrrr.exec:\7rfxrrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\dpjdd.exec:\dpjdd.exe17⤵
- Executes dropped EXE
PID:2384 -
\??\c:\fxrxffl.exec:\fxrxffl.exe18⤵
- Executes dropped EXE
PID:1316 -
\??\c:\bnthhb.exec:\bnthhb.exe19⤵
- Executes dropped EXE
PID:1512 -
\??\c:\rlrxflx.exec:\rlrxflx.exe20⤵
- Executes dropped EXE
PID:2028 -
\??\c:\nhbbnt.exec:\nhbbnt.exe21⤵
- Executes dropped EXE
PID:2168 -
\??\c:\1hbbtb.exec:\1hbbtb.exe22⤵
- Executes dropped EXE
PID:2392 -
\??\c:\frfxxrr.exec:\frfxxrr.exe23⤵
- Executes dropped EXE
PID:1060 -
\??\c:\vpddj.exec:\vpddj.exe24⤵
- Executes dropped EXE
PID:1960 -
\??\c:\xrffllx.exec:\xrffllx.exe25⤵
- Executes dropped EXE
PID:844 -
\??\c:\9nhntt.exec:\9nhntt.exe26⤵
- Executes dropped EXE
PID:1916 -
\??\c:\pjdjv.exec:\pjdjv.exe27⤵
- Executes dropped EXE
PID:1680 -
\??\c:\frffrlf.exec:\frffrlf.exe28⤵
- Executes dropped EXE
PID:1256 -
\??\c:\ddjdp.exec:\ddjdp.exe29⤵
- Executes dropped EXE
PID:1968 -
\??\c:\lfxfxxl.exec:\lfxfxxl.exe30⤵
- Executes dropped EXE
PID:1928 -
\??\c:\bttntt.exec:\bttntt.exe31⤵
- Executes dropped EXE
PID:884 -
\??\c:\1vjpv.exec:\1vjpv.exe32⤵
- Executes dropped EXE
PID:1748 -
\??\c:\rrlrxxr.exec:\rrlrxxr.exe33⤵
- Executes dropped EXE
PID:1584 -
\??\c:\tnhbbb.exec:\tnhbbb.exe34⤵
- Executes dropped EXE
PID:2388 -
\??\c:\nbttht.exec:\nbttht.exe35⤵
- Executes dropped EXE
PID:1404 -
\??\c:\1dvdj.exec:\1dvdj.exe36⤵
- Executes dropped EXE
PID:1724 -
\??\c:\lfrrffl.exec:\lfrrffl.exe37⤵
- Executes dropped EXE
PID:336 -
\??\c:\ffrxlxl.exec:\ffrxlxl.exe38⤵
- Executes dropped EXE
PID:1260 -
\??\c:\hbnthh.exec:\hbnthh.exe39⤵
- Executes dropped EXE
PID:2832 -
\??\c:\vvppd.exec:\vvppd.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2856 -
\??\c:\vpjpp.exec:\vpjpp.exe41⤵
- Executes dropped EXE
PID:2864 -
\??\c:\xlffrlf.exec:\xlffrlf.exe42⤵
- Executes dropped EXE
PID:2664 -
\??\c:\tthbhh.exec:\tthbhh.exe43⤵
- Executes dropped EXE
PID:1888 -
\??\c:\nhhnnt.exec:\nhhnnt.exe44⤵
- Executes dropped EXE
PID:2640 -
\??\c:\pjjjp.exec:\pjjjp.exe45⤵
- Executes dropped EXE
PID:2660 -
\??\c:\xrlrxfr.exec:\xrlrxfr.exe46⤵
- Executes dropped EXE
PID:2632 -
\??\c:\xxlflrx.exec:\xxlflrx.exe47⤵
- Executes dropped EXE
PID:1684 -
\??\c:\7bbtbh.exec:\7bbtbh.exe48⤵
- Executes dropped EXE
PID:1200 -
\??\c:\dvdvd.exec:\dvdvd.exe49⤵
- Executes dropped EXE
PID:3004 -
\??\c:\9dvpp.exec:\9dvpp.exe50⤵
- Executes dropped EXE
PID:580 -
\??\c:\rfrlxrf.exec:\rfrlxrf.exe51⤵
- Executes dropped EXE
PID:2976 -
\??\c:\nthhnb.exec:\nthhnb.exe52⤵
- Executes dropped EXE
PID:2036 -
\??\c:\vpdpp.exec:\vpdpp.exe53⤵
- Executes dropped EXE
PID:1072 -
\??\c:\5pjdd.exec:\5pjdd.exe54⤵
- Executes dropped EXE
PID:2460 -
\??\c:\7lfffff.exec:\7lfffff.exe55⤵
- Executes dropped EXE
PID:2804 -
\??\c:\tnbbhh.exec:\tnbbhh.exe56⤵
- Executes dropped EXE
PID:1580 -
\??\c:\hhbtbb.exec:\hhbtbb.exe57⤵
- Executes dropped EXE
PID:1512 -
\??\c:\vdvvj.exec:\vdvvj.exe58⤵
- Executes dropped EXE
PID:2028 -
\??\c:\fxflxfx.exec:\fxflxfx.exe59⤵
- Executes dropped EXE
PID:1792 -
\??\c:\lfrxflr.exec:\lfrxflr.exe60⤵
- Executes dropped EXE
PID:2668 -
\??\c:\tnhnbh.exec:\tnhnbh.exe61⤵
- Executes dropped EXE
PID:840 -
\??\c:\9dppp.exec:\9dppp.exe62⤵
- Executes dropped EXE
PID:2496 -
\??\c:\7vdjp.exec:\7vdjp.exe63⤵
- Executes dropped EXE
PID:2208 -
\??\c:\lfxfrlx.exec:\lfxfrlx.exe64⤵
- Executes dropped EXE
PID:276 -
\??\c:\nbbtbb.exec:\nbbtbb.exe65⤵
- Executes dropped EXE
PID:1384 -
\??\c:\9jddj.exec:\9jddj.exe66⤵PID:1408
-
\??\c:\vpvvp.exec:\vpvvp.exe67⤵PID:2176
-
\??\c:\xrxflrx.exec:\xrxflrx.exe68⤵PID:1680
-
\??\c:\nbnntt.exec:\nbnntt.exe69⤵PID:2464
-
\??\c:\dvjpp.exec:\dvjpp.exe70⤵PID:2188
-
\??\c:\hhttnb.exec:\hhttnb.exe71⤵PID:1892
-
\??\c:\dvdjj.exec:\dvdjj.exe72⤵PID:2268
-
\??\c:\xxrrlrf.exec:\xxrrlrf.exe73⤵PID:1692
-
\??\c:\9llllrx.exec:\9llllrx.exe74⤵PID:852
-
\??\c:\1bbhtt.exec:\1bbhtt.exe75⤵PID:2572
-
\??\c:\pddjp.exec:\pddjp.exe76⤵PID:2560
-
\??\c:\dpppv.exec:\dpppv.exe77⤵PID:2388
-
\??\c:\3xrxxfr.exec:\3xrxxfr.exe78⤵PID:2080
-
\??\c:\9bnhbb.exec:\9bnhbb.exe79⤵PID:2324
-
\??\c:\jdvdd.exec:\jdvdd.exe80⤵PID:2900
-
\??\c:\jvjpp.exec:\jvjpp.exe81⤵PID:2824
-
\??\c:\lfxxffl.exec:\lfxxffl.exe82⤵
- System Location Discovery: System Language Discovery
PID:2636 -
\??\c:\1xxllff.exec:\1xxllff.exe83⤵PID:3056
-
\??\c:\hbhnnn.exec:\hbhnnn.exe84⤵PID:2916
-
\??\c:\jvjjp.exec:\jvjjp.exe85⤵PID:2912
-
\??\c:\pjppp.exec:\pjppp.exe86⤵PID:2628
-
\??\c:\llxlrrf.exec:\llxlrrf.exe87⤵PID:2676
-
\??\c:\5nhbnh.exec:\5nhbnh.exe88⤵PID:2640
-
\??\c:\thbnth.exec:\thbnth.exe89⤵PID:2396
-
\??\c:\vvvdj.exec:\vvvdj.exe90⤵PID:2728
-
\??\c:\1fxxflx.exec:\1fxxflx.exe91⤵PID:1040
-
\??\c:\lxrrffr.exec:\lxrrffr.exe92⤵PID:1520
-
\??\c:\ntntbb.exec:\ntntbb.exe93⤵PID:2968
-
\??\c:\vvpdj.exec:\vvpdj.exe94⤵PID:2972
-
\??\c:\dvdpj.exec:\dvdpj.exe95⤵PID:2936
-
\??\c:\rlrlxfl.exec:\rlrlxfl.exe96⤵PID:1272
-
\??\c:\nhtnnt.exec:\nhtnnt.exe97⤵PID:2120
-
\??\c:\9hnhhh.exec:\9hnhhh.exe98⤵PID:3028
-
\??\c:\jvppv.exec:\jvppv.exe99⤵PID:2044
-
\??\c:\rlrrllx.exec:\rlrrllx.exe100⤵PID:2504
-
\??\c:\xllfxrr.exec:\xllfxrr.exe101⤵PID:2596
-
\??\c:\nbhhtn.exec:\nbhhtn.exe102⤵PID:2112
-
\??\c:\pdvpp.exec:\pdvpp.exe103⤵PID:1656
-
\??\c:\rflfffl.exec:\rflfffl.exe104⤵PID:2668
-
\??\c:\xrlxlfx.exec:\xrlxlfx.exe105⤵PID:840
-
\??\c:\bttttn.exec:\bttttn.exe106⤵PID:444
-
\??\c:\ddjvd.exec:\ddjvd.exe107⤵PID:2200
-
\??\c:\vjjjp.exec:\vjjjp.exe108⤵PID:1644
-
\??\c:\xlfxrlr.exec:\xlfxrlr.exe109⤵PID:1356
-
\??\c:\9nbbbb.exec:\9nbbbb.exe110⤵PID:2516
-
\??\c:\thnhnn.exec:\thnhnn.exe111⤵PID:1696
-
\??\c:\7vjjj.exec:\7vjjj.exe112⤵PID:380
-
\??\c:\frxffxx.exec:\frxffxx.exe113⤵PID:1256
-
\??\c:\xrlxrrf.exec:\xrlxrrf.exe114⤵PID:3052
-
\??\c:\tbbbbt.exec:\tbbbbt.exe115⤵PID:2576
-
\??\c:\dpjpp.exec:\dpjpp.exe116⤵PID:584
-
\??\c:\pdddj.exec:\pdddj.exe117⤵PID:3048
-
\??\c:\5xrrxxl.exec:\5xrrxxl.exe118⤵PID:1592
-
\??\c:\nhbtbb.exec:\nhbtbb.exe119⤵PID:2920
-
\??\c:\jvppv.exec:\jvppv.exe120⤵PID:2020
-
\??\c:\vjvpp.exec:\vjvpp.exe121⤵PID:2708
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-