Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 10:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
793272852f504b6248acb6de136ca46f7bb729d14e67a27259c6e8b15f0014d3N.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
120 seconds
General
-
Target
793272852f504b6248acb6de136ca46f7bb729d14e67a27259c6e8b15f0014d3N.exe
-
Size
456KB
-
MD5
c8dba65a9ff1939406cae452018ac9a0
-
SHA1
71fb17fb6ba6c1c19f17ac4262d4faa8bc5a347f
-
SHA256
793272852f504b6248acb6de136ca46f7bb729d14e67a27259c6e8b15f0014d3
-
SHA512
2cd1e3d3ada80d953231e71cb366fbebc4d0069eb6f5d63cdba0ae70de19af3e5282bdbb09d0ed8346e1ce76247462aed4c8334402886f5599e7651528e99e31
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRs:q7Tc2NYHUrAwfMp3CDRs
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/2136-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/740-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2192-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2248-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-79-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2900-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-100-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1252-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1424-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1528-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/408-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/952-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1096-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2256-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1308-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1724-289-0x0000000077260000-0x000000007737F000-memory.dmp family_blackmoon behavioral1/memory/740-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1688-412-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/836-415-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1028-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2480-470-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2288-477-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1744-515-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1572-528-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2360-535-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-609-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2980-628-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-641-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/380-654-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-693-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1236-760-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/276-781-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2412-789-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/888-828-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2388-1010-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2044-1085-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2244-1154-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2676-1167-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2404 pvddj.exe 740 vdpdd.exe 2192 bnnntb.exe 2248 rxlllxr.exe 2840 vvjpd.exe 2760 htnbht.exe 2900 9jdpp.exe 2764 9tnnhn.exe 2640 pdpdv.exe 1252 vjvdv.exe 2932 1xllxlr.exe 1044 djvvj.exe 2960 fxrxlxx.exe 2920 ppddp.exe 1424 jjvpd.exe 1528 tnbbnt.exe 3032 dvpdp.exe 376 hhtbht.exe 3068 jjjpj.exe 1636 hhbhth.exe 408 ddvjd.exe 952 1tnbht.exe 1096 bhtthn.exe 1744 tbbbnn.exe 2264 3btbbn.exe 1572 5rrfrxr.exe 2440 tbhhhn.exe 1308 vvvjv.exe 2256 hhtbhn.exe 888 dvvjd.exe 1724 7nnbnt.exe 2532 hnbtnn.exe 2384 7pdjv.exe 740 ntbhbb.exe 2772 ntbthn.exe 2836 3djpj.exe 2204 lrflxfr.exe 2752 hnnbnb.exe 2788 nbtbth.exe 2760 jppvd.exe 2792 xfxfrlx.exe 2636 lrlrlrf.exe 2656 5tnbnb.exe 2684 vvdjv.exe 2028 lrxfrxl.exe 836 xxfllxl.exe 804 bbnbnt.exe 1688 jpdjv.exe 2904 xfflffl.exe 2012 hnthtt.exe 1892 bhhnbh.exe 2016 ddppv.exe 1756 xfrxfrf.exe 1028 tbnnbb.exe 1660 hnhhtt.exe 376 1vpjv.exe 2480 9rrxlxr.exe 2288 frfxxlx.exe 1684 ntbhtb.exe 408 djpdj.exe 3028 lrfxlrx.exe 552 xfflxxf.exe 1568 tbnttb.exe 1744 3jdjp.exe -
resource yara_rule behavioral1/memory/2136-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/740-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1252-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1424-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-160-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/1528-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/376-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/408-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/952-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1096-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1308-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-289-0x0000000077260000-0x000000007737F000-memory.dmp upx behavioral1/memory/740-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-412-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1028-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-477-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/552-496-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-515-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2360-535-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-628-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-641-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/380-654-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-686-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-693-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/276-774-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-789-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/888-828-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2584-918-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-991-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-1117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/644-1274-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfflrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlllfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1htbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlrlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrxfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrfrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrrxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2136 wrote to memory of 2404 2136 793272852f504b6248acb6de136ca46f7bb729d14e67a27259c6e8b15f0014d3N.exe 30 PID 2136 wrote to memory of 2404 2136 793272852f504b6248acb6de136ca46f7bb729d14e67a27259c6e8b15f0014d3N.exe 30 PID 2136 wrote to memory of 2404 2136 793272852f504b6248acb6de136ca46f7bb729d14e67a27259c6e8b15f0014d3N.exe 30 PID 2136 wrote to memory of 2404 2136 793272852f504b6248acb6de136ca46f7bb729d14e67a27259c6e8b15f0014d3N.exe 30 PID 2404 wrote to memory of 740 2404 pvddj.exe 31 PID 2404 wrote to memory of 740 2404 pvddj.exe 31 PID 2404 wrote to memory of 740 2404 pvddj.exe 31 PID 2404 wrote to memory of 740 2404 pvddj.exe 31 PID 740 wrote to memory of 2192 740 vdpdd.exe 32 PID 740 wrote to memory of 2192 740 vdpdd.exe 32 PID 740 wrote to memory of 2192 740 vdpdd.exe 32 PID 740 wrote to memory of 2192 740 vdpdd.exe 32 PID 2192 wrote to memory of 2248 2192 bnnntb.exe 33 PID 2192 wrote to memory of 2248 2192 bnnntb.exe 33 PID 2192 wrote to memory of 2248 2192 bnnntb.exe 33 PID 2192 wrote to memory of 2248 2192 bnnntb.exe 33 PID 2248 wrote to memory of 2840 2248 rxlllxr.exe 34 PID 2248 wrote to memory of 2840 2248 rxlllxr.exe 34 PID 2248 wrote to memory of 2840 2248 rxlllxr.exe 34 PID 2248 wrote to memory of 2840 2248 rxlllxr.exe 34 PID 2840 wrote to memory of 2760 2840 vvjpd.exe 35 PID 2840 wrote to memory of 2760 2840 vvjpd.exe 35 PID 2840 wrote to memory of 2760 2840 vvjpd.exe 35 PID 2840 wrote to memory of 2760 2840 vvjpd.exe 35 PID 2760 wrote to memory of 2900 2760 htnbht.exe 36 PID 2760 wrote to memory of 2900 2760 htnbht.exe 36 PID 2760 wrote to memory of 2900 2760 htnbht.exe 36 PID 2760 wrote to memory of 2900 2760 htnbht.exe 36 PID 2900 wrote to memory of 2764 2900 9jdpp.exe 37 PID 2900 wrote to memory of 2764 2900 9jdpp.exe 37 PID 2900 wrote to memory of 2764 2900 9jdpp.exe 37 PID 2900 wrote to memory of 2764 2900 9jdpp.exe 37 PID 2764 wrote to memory of 2640 2764 9tnnhn.exe 38 PID 2764 wrote to memory of 2640 2764 9tnnhn.exe 38 PID 2764 wrote to memory of 2640 2764 9tnnhn.exe 38 PID 2764 wrote to memory of 2640 2764 9tnnhn.exe 38 PID 2640 wrote to memory of 1252 2640 pdpdv.exe 39 PID 2640 wrote to memory of 1252 2640 pdpdv.exe 39 PID 2640 wrote to memory of 1252 2640 pdpdv.exe 39 PID 2640 wrote to memory of 1252 2640 pdpdv.exe 39 PID 1252 wrote to memory of 2932 1252 vjvdv.exe 40 PID 1252 wrote to memory of 2932 1252 vjvdv.exe 40 PID 1252 wrote to memory of 2932 1252 vjvdv.exe 40 PID 1252 wrote to memory of 2932 1252 vjvdv.exe 40 PID 2932 wrote to memory of 1044 2932 1xllxlr.exe 41 PID 2932 wrote to memory of 1044 2932 1xllxlr.exe 41 PID 2932 wrote to memory of 1044 2932 1xllxlr.exe 41 PID 2932 wrote to memory of 1044 2932 1xllxlr.exe 41 PID 1044 wrote to memory of 2960 1044 djvvj.exe 42 PID 1044 wrote to memory of 2960 1044 djvvj.exe 42 PID 1044 wrote to memory of 2960 1044 djvvj.exe 42 PID 1044 wrote to memory of 2960 1044 djvvj.exe 42 PID 2960 wrote to memory of 2920 2960 fxrxlxx.exe 43 PID 2960 wrote to memory of 2920 2960 fxrxlxx.exe 43 PID 2960 wrote to memory of 2920 2960 fxrxlxx.exe 43 PID 2960 wrote to memory of 2920 2960 fxrxlxx.exe 43 PID 2920 wrote to memory of 1424 2920 ppddp.exe 44 PID 2920 wrote to memory of 1424 2920 ppddp.exe 44 PID 2920 wrote to memory of 1424 2920 ppddp.exe 44 PID 2920 wrote to memory of 1424 2920 ppddp.exe 44 PID 1424 wrote to memory of 1528 1424 jjvpd.exe 45 PID 1424 wrote to memory of 1528 1424 jjvpd.exe 45 PID 1424 wrote to memory of 1528 1424 jjvpd.exe 45 PID 1424 wrote to memory of 1528 1424 jjvpd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\793272852f504b6248acb6de136ca46f7bb729d14e67a27259c6e8b15f0014d3N.exe"C:\Users\Admin\AppData\Local\Temp\793272852f504b6248acb6de136ca46f7bb729d14e67a27259c6e8b15f0014d3N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\pvddj.exec:\pvddj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\vdpdd.exec:\vdpdd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:740 -
\??\c:\bnnntb.exec:\bnnntb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\rxlllxr.exec:\rxlllxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\vvjpd.exec:\vvjpd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\htnbht.exec:\htnbht.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\9jdpp.exec:\9jdpp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\9tnnhn.exec:\9tnnhn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\pdpdv.exec:\pdpdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\vjvdv.exec:\vjvdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\1xllxlr.exec:\1xllxlr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\djvvj.exec:\djvvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
\??\c:\fxrxlxx.exec:\fxrxlxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\ppddp.exec:\ppddp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\jjvpd.exec:\jjvpd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
\??\c:\tnbbnt.exec:\tnbbnt.exe17⤵
- Executes dropped EXE
PID:1528 -
\??\c:\dvpdp.exec:\dvpdp.exe18⤵
- Executes dropped EXE
PID:3032 -
\??\c:\hhtbht.exec:\hhtbht.exe19⤵
- Executes dropped EXE
PID:376 -
\??\c:\jjjpj.exec:\jjjpj.exe20⤵
- Executes dropped EXE
PID:3068 -
\??\c:\hhbhth.exec:\hhbhth.exe21⤵
- Executes dropped EXE
PID:1636 -
\??\c:\ddvjd.exec:\ddvjd.exe22⤵
- Executes dropped EXE
PID:408 -
\??\c:\1tnbht.exec:\1tnbht.exe23⤵
- Executes dropped EXE
PID:952 -
\??\c:\bhtthn.exec:\bhtthn.exe24⤵
- Executes dropped EXE
PID:1096 -
\??\c:\tbbbnn.exec:\tbbbnn.exe25⤵
- Executes dropped EXE
PID:1744 -
\??\c:\3btbbn.exec:\3btbbn.exe26⤵
- Executes dropped EXE
PID:2264 -
\??\c:\5rrfrxr.exec:\5rrfrxr.exe27⤵
- Executes dropped EXE
PID:1572 -
\??\c:\tbhhhn.exec:\tbhhhn.exe28⤵
- Executes dropped EXE
PID:2440 -
\??\c:\vvvjv.exec:\vvvjv.exe29⤵
- Executes dropped EXE
PID:1308 -
\??\c:\hhtbhn.exec:\hhtbhn.exe30⤵
- Executes dropped EXE
PID:2256 -
\??\c:\dvvjd.exec:\dvvjd.exe31⤵
- Executes dropped EXE
PID:888 -
\??\c:\7nnbnt.exec:\7nnbnt.exe32⤵
- Executes dropped EXE
PID:1724 -
\??\c:\ppjvd.exec:\ppjvd.exe33⤵PID:1904
-
\??\c:\hnbtnn.exec:\hnbtnn.exe34⤵
- Executes dropped EXE
PID:2532 -
\??\c:\7pdjv.exec:\7pdjv.exe35⤵
- Executes dropped EXE
PID:2384 -
\??\c:\ntbhbb.exec:\ntbhbb.exe36⤵
- Executes dropped EXE
PID:740 -
\??\c:\ntbthn.exec:\ntbthn.exe37⤵
- Executes dropped EXE
PID:2772 -
\??\c:\3djpj.exec:\3djpj.exe38⤵
- Executes dropped EXE
PID:2836 -
\??\c:\lrflxfr.exec:\lrflxfr.exe39⤵
- Executes dropped EXE
PID:2204 -
\??\c:\hnnbnb.exec:\hnnbnb.exe40⤵
- Executes dropped EXE
PID:2752 -
\??\c:\nbtbth.exec:\nbtbth.exe41⤵
- Executes dropped EXE
PID:2788 -
\??\c:\jppvd.exec:\jppvd.exe42⤵
- Executes dropped EXE
PID:2760 -
\??\c:\xfxfrlx.exec:\xfxfrlx.exe43⤵
- Executes dropped EXE
PID:2792 -
\??\c:\lrlrlrf.exec:\lrlrlrf.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2636 -
\??\c:\5tnbnb.exec:\5tnbnb.exe45⤵
- Executes dropped EXE
PID:2656 -
\??\c:\vvdjv.exec:\vvdjv.exe46⤵
- Executes dropped EXE
PID:2684 -
\??\c:\lrxfrxl.exec:\lrxfrxl.exe47⤵
- Executes dropped EXE
PID:2028 -
\??\c:\xxfllxl.exec:\xxfllxl.exe48⤵
- Executes dropped EXE
PID:836 -
\??\c:\bbnbnt.exec:\bbnbnt.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:804 -
\??\c:\jpdjv.exec:\jpdjv.exe50⤵
- Executes dropped EXE
PID:1688 -
\??\c:\xfflffl.exec:\xfflffl.exe51⤵
- Executes dropped EXE
PID:2904 -
\??\c:\hnthtt.exec:\hnthtt.exe52⤵
- Executes dropped EXE
PID:2012 -
\??\c:\bhhnbh.exec:\bhhnbh.exe53⤵
- Executes dropped EXE
PID:1892 -
\??\c:\ddppv.exec:\ddppv.exe54⤵
- Executes dropped EXE
PID:2016 -
\??\c:\xfrxfrf.exec:\xfrxfrf.exe55⤵
- Executes dropped EXE
PID:1756 -
\??\c:\tbnnbb.exec:\tbnnbb.exe56⤵
- Executes dropped EXE
PID:1028 -
\??\c:\hnhhtt.exec:\hnhhtt.exe57⤵
- Executes dropped EXE
PID:1660 -
\??\c:\1vpjv.exec:\1vpjv.exe58⤵
- Executes dropped EXE
PID:376 -
\??\c:\9rrxlxr.exec:\9rrxlxr.exe59⤵
- Executes dropped EXE
PID:2480 -
\??\c:\frfxxlx.exec:\frfxxlx.exe60⤵
- Executes dropped EXE
PID:2288 -
\??\c:\ntbhtb.exec:\ntbhtb.exe61⤵
- Executes dropped EXE
PID:1684 -
\??\c:\djpdj.exec:\djpdj.exe62⤵
- Executes dropped EXE
PID:408 -
\??\c:\lrfxlrx.exec:\lrfxlrx.exe63⤵
- Executes dropped EXE
PID:3028 -
\??\c:\xfflxxf.exec:\xfflxxf.exe64⤵
- Executes dropped EXE
PID:552 -
\??\c:\tbnttb.exec:\tbnttb.exe65⤵
- Executes dropped EXE
PID:1568 -
\??\c:\3jdjp.exec:\3jdjp.exe66⤵
- Executes dropped EXE
PID:1744 -
\??\c:\dpdjp.exec:\dpdjp.exe67⤵PID:1816
-
\??\c:\lflrxrr.exec:\lflrxrr.exe68⤵PID:1572
-
\??\c:\bnttbh.exec:\bnttbh.exe69⤵PID:2360
-
\??\c:\vpdpv.exec:\vpdpv.exe70⤵PID:2716
-
\??\c:\jvjdd.exec:\jvjdd.exe71⤵PID:1132
-
\??\c:\xfrxfrf.exec:\xfrxfrf.exe72⤵PID:2400
-
\??\c:\7hnhbn.exec:\7hnhbn.exe73⤵PID:1064
-
\??\c:\5dvdd.exec:\5dvdd.exe74⤵PID:2136
-
\??\c:\3dddp.exec:\3dddp.exe75⤵PID:1712
-
\??\c:\fxlfrfr.exec:\fxlfrfr.exe76⤵PID:1656
-
\??\c:\bhthhn.exec:\bhthhn.exe77⤵PID:2084
-
\??\c:\vdpvd.exec:\vdpvd.exe78⤵PID:2812
-
\??\c:\djdpd.exec:\djdpd.exe79⤵PID:2192
-
\??\c:\xxlrflx.exec:\xxlrflx.exe80⤵PID:2844
-
\??\c:\5hbhnt.exec:\5hbhnt.exe81⤵PID:2784
-
\??\c:\pvjvd.exec:\pvjvd.exe82⤵PID:2204
-
\??\c:\djdjp.exec:\djdjp.exe83⤵PID:2752
-
\??\c:\flrlflx.exec:\flrlflx.exe84⤵PID:2980
-
\??\c:\nbbnhn.exec:\nbbnhn.exe85⤵PID:2900
-
\??\c:\3jpvd.exec:\3jpvd.exe86⤵PID:2804
-
\??\c:\3vvdj.exec:\3vvdj.exe87⤵PID:2704
-
\??\c:\flrrxfr.exec:\flrrxfr.exe88⤵PID:380
-
\??\c:\3lffxxl.exec:\3lffxxl.exe89⤵PID:2512
-
\??\c:\nnthtb.exec:\nnthtb.exe90⤵PID:1120
-
\??\c:\pvjpd.exec:\pvjpd.exe91⤵PID:2932
-
\??\c:\9lffrlx.exec:\9lffrlx.exe92⤵PID:2816
-
\??\c:\llflrxl.exec:\llflrxl.exe93⤵PID:2940
-
\??\c:\bhhnbh.exec:\bhhnbh.exe94⤵PID:2988
-
\??\c:\9jdpv.exec:\9jdpv.exe95⤵PID:2996
-
\??\c:\ppdjv.exec:\ppdjv.exe96⤵PID:1092
-
\??\c:\xxllrlf.exec:\xxllrlf.exe97⤵PID:1424
-
\??\c:\bbnbnt.exec:\bbnbnt.exe98⤵PID:348
-
\??\c:\pvdvd.exec:\pvdvd.exe99⤵PID:1028
-
\??\c:\vdvjj.exec:\vdvjj.exe100⤵PID:1180
-
\??\c:\xfrrxfr.exec:\xfrrxfr.exe101⤵PID:2388
-
\??\c:\nthhth.exec:\nthhth.exe102⤵PID:3068
-
\??\c:\9thhbb.exec:\9thhbb.exe103⤵PID:1636
-
\??\c:\vvjpv.exec:\vvjpv.exe104⤵
- System Location Discovery: System Language Discovery
PID:2664 -
\??\c:\xlxfllx.exec:\xlxfllx.exe105⤵PID:1236
-
\??\c:\rxfrfll.exec:\rxfrfll.exe106⤵PID:2708
-
\??\c:\hthhbb.exec:\hthhbb.exe107⤵PID:236
-
\??\c:\vjvdj.exec:\vjvdj.exe108⤵PID:276
-
\??\c:\lrffrxl.exec:\lrffrxl.exe109⤵PID:2412
-
\??\c:\rxllxxf.exec:\rxllxxf.exe110⤵PID:1716
-
\??\c:\7bhtbn.exec:\7bhtbn.exe111⤵PID:1676
-
\??\c:\pppjv.exec:\pppjv.exe112⤵PID:2444
-
\??\c:\llxlxll.exec:\llxlxll.exe113⤵PID:1136
-
\??\c:\rxfflrx.exec:\rxfflrx.exe114⤵PID:2260
-
\??\c:\ttbhhn.exec:\ttbhhn.exe115⤵PID:760
-
\??\c:\7nhhnt.exec:\7nhhnt.exe116⤵PID:888
-
\??\c:\jvjpv.exec:\jvjpv.exe117⤵PID:1620
-
\??\c:\rfxfrxf.exec:\rfxfrxf.exe118⤵PID:2492
-
\??\c:\tntbnt.exec:\tntbnt.exe119⤵PID:1376
-
\??\c:\tbhhtt.exec:\tbhhtt.exe120⤵PID:2384
-
\??\c:\jjpvd.exec:\jjpvd.exe121⤵PID:740
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-