Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 10:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e48a0616b2f93e7ad470d52ab0acb422880293c23422c4c175bfd883992ce755.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
e48a0616b2f93e7ad470d52ab0acb422880293c23422c4c175bfd883992ce755.exe
-
Size
454KB
-
MD5
538f1a1627e2e404679d394911cc605a
-
SHA1
5b95f9a85b78128dd96a90b9193dab5dbf58ee51
-
SHA256
e48a0616b2f93e7ad470d52ab0acb422880293c23422c4c175bfd883992ce755
-
SHA512
e0b0c461a6667db735d66dbcb701caa09bff71acc147adb1059434fefc6aa68b6b3aaa4e8e6e37cf909e14255276e6096038d083a6e5e74aa725fa005bc12bac
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe1J:q7Tc2NYHUrAwfMp3CD1J
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 51 IoCs
resource yara_rule behavioral1/memory/1800-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1076-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2532-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1252-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-56-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2844-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-65-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2968-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-84-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2620-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2036-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1656-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-200-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2640-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-190-0x00000000001C0000-0x00000000001EA000-memory.dmp family_blackmoon behavioral1/memory/2076-209-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1760-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1672-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2024-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/572-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2056-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2520-319-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2512-325-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/1252-333-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2692-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/588-437-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1916-463-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2992-517-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1928-542-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2276-551-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1612-581-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2732-634-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-665-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/604-707-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1852-770-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1932-808-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/996-815-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2200-840-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1664-847-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/572-848-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1076 ttttbb.exe 2532 9frxllx.exe 1252 nnbhtt.exe 2692 fxllffx.exe 2744 fllxxll.exe 2844 dvjpd.exe 2968 pjjpv.exe 2872 hhbbtt.exe 2776 pjdpv.exe 2620 fxlrxrl.exe 2036 5xxrxxf.exe 2344 htbhbb.exe 1656 pdvdp.exe 604 7rllffl.exe 2660 vppvd.exe 2000 xrllrxl.exe 2128 thbthh.exe 1644 rxxlxxl.exe 2924 ttnbbn.exe 2640 rlflrrf.exe 2076 5ffflrf.exe 1760 5jdjp.exe 1624 9frxfrf.exe 2024 vvjpv.exe 1672 1pdpv.exe 1932 rlrxlxl.exe 3020 btnbhn.exe 572 hhtbnn.exe 2056 xrflxfl.exe 1664 1hntbt.exe 2416 vppdp.exe 1608 vjvvd.exe 2548 3fxxffl.exe 2520 hbntbb.exe 2512 thbnbb.exe 1252 7rlxflr.exe 2692 bnbbtt.exe 2788 jvppd.exe 2728 1xxxflr.exe 2808 nhttbt.exe 2968 9vppj.exe 2888 llfxxxf.exe 1168 nnbhhh.exe 2672 tnhthn.exe 2632 djvdv.exe 2568 rrflxxl.exe 2084 1hbtbh.exe 1976 pvdjd.exe 1656 vpjpd.exe 1964 xrllrxf.exe 588 rrllxxf.exe 596 9btttt.exe 2904 vpddj.exe 1640 xrflffr.exe 1916 1xrfllr.exe 2900 5nhbbb.exe 2908 hbntbn.exe 2352 vpjvj.exe 2360 xrllrxf.exe 2076 ffrrffr.exe 1212 7hhtbb.exe 1552 vjvvv.exe 2992 jdpvp.exe 1864 rfxrxxl.exe -
resource yara_rule behavioral1/memory/1800-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1076-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1252-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1252-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-223-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/3020-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/572-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1976-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/588-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1212-498-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-517-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-530-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-544-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-551-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/828-596-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-634-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-665-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/604-707-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2588-709-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-722-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-730-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-752-0x00000000003D0000-0x00000000003FA000-memory.dmp upx behavioral1/memory/2164-763-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/2552-861-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btttth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfxxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfrfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thntnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrlfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btntbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hbhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1800 wrote to memory of 1076 1800 e48a0616b2f93e7ad470d52ab0acb422880293c23422c4c175bfd883992ce755.exe 30 PID 1800 wrote to memory of 1076 1800 e48a0616b2f93e7ad470d52ab0acb422880293c23422c4c175bfd883992ce755.exe 30 PID 1800 wrote to memory of 1076 1800 e48a0616b2f93e7ad470d52ab0acb422880293c23422c4c175bfd883992ce755.exe 30 PID 1800 wrote to memory of 1076 1800 e48a0616b2f93e7ad470d52ab0acb422880293c23422c4c175bfd883992ce755.exe 30 PID 1076 wrote to memory of 2532 1076 ttttbb.exe 31 PID 1076 wrote to memory of 2532 1076 ttttbb.exe 31 PID 1076 wrote to memory of 2532 1076 ttttbb.exe 31 PID 1076 wrote to memory of 2532 1076 ttttbb.exe 31 PID 2532 wrote to memory of 1252 2532 9frxllx.exe 32 PID 2532 wrote to memory of 1252 2532 9frxllx.exe 32 PID 2532 wrote to memory of 1252 2532 9frxllx.exe 32 PID 2532 wrote to memory of 1252 2532 9frxllx.exe 32 PID 1252 wrote to memory of 2692 1252 nnbhtt.exe 33 PID 1252 wrote to memory of 2692 1252 nnbhtt.exe 33 PID 1252 wrote to memory of 2692 1252 nnbhtt.exe 33 PID 1252 wrote to memory of 2692 1252 nnbhtt.exe 33 PID 2692 wrote to memory of 2744 2692 fxllffx.exe 34 PID 2692 wrote to memory of 2744 2692 fxllffx.exe 34 PID 2692 wrote to memory of 2744 2692 fxllffx.exe 34 PID 2692 wrote to memory of 2744 2692 fxllffx.exe 34 PID 2744 wrote to memory of 2844 2744 fllxxll.exe 35 PID 2744 wrote to memory of 2844 2744 fllxxll.exe 35 PID 2744 wrote to memory of 2844 2744 fllxxll.exe 35 PID 2744 wrote to memory of 2844 2744 fllxxll.exe 35 PID 2844 wrote to memory of 2968 2844 dvjpd.exe 36 PID 2844 wrote to memory of 2968 2844 dvjpd.exe 36 PID 2844 wrote to memory of 2968 2844 dvjpd.exe 36 PID 2844 wrote to memory of 2968 2844 dvjpd.exe 36 PID 2968 wrote to memory of 2872 2968 pjjpv.exe 37 PID 2968 wrote to memory of 2872 2968 pjjpv.exe 37 PID 2968 wrote to memory of 2872 2968 pjjpv.exe 37 PID 2968 wrote to memory of 2872 2968 pjjpv.exe 37 PID 2872 wrote to memory of 2776 2872 hhbbtt.exe 38 PID 2872 wrote to memory of 2776 2872 hhbbtt.exe 38 PID 2872 wrote to memory of 2776 2872 hhbbtt.exe 38 PID 2872 wrote to memory of 2776 2872 hhbbtt.exe 38 PID 2776 wrote to memory of 2620 2776 pjdpv.exe 39 PID 2776 wrote to memory of 2620 2776 pjdpv.exe 39 PID 2776 wrote to memory of 2620 2776 pjdpv.exe 39 PID 2776 wrote to memory of 2620 2776 pjdpv.exe 39 PID 2620 wrote to memory of 2036 2620 fxlrxrl.exe 40 PID 2620 wrote to memory of 2036 2620 fxlrxrl.exe 40 PID 2620 wrote to memory of 2036 2620 fxlrxrl.exe 40 PID 2620 wrote to memory of 2036 2620 fxlrxrl.exe 40 PID 2036 wrote to memory of 2344 2036 5xxrxxf.exe 41 PID 2036 wrote to memory of 2344 2036 5xxrxxf.exe 41 PID 2036 wrote to memory of 2344 2036 5xxrxxf.exe 41 PID 2036 wrote to memory of 2344 2036 5xxrxxf.exe 41 PID 2344 wrote to memory of 1656 2344 htbhbb.exe 42 PID 2344 wrote to memory of 1656 2344 htbhbb.exe 42 PID 2344 wrote to memory of 1656 2344 htbhbb.exe 42 PID 2344 wrote to memory of 1656 2344 htbhbb.exe 42 PID 1656 wrote to memory of 604 1656 pdvdp.exe 43 PID 1656 wrote to memory of 604 1656 pdvdp.exe 43 PID 1656 wrote to memory of 604 1656 pdvdp.exe 43 PID 1656 wrote to memory of 604 1656 pdvdp.exe 43 PID 604 wrote to memory of 2660 604 7rllffl.exe 44 PID 604 wrote to memory of 2660 604 7rllffl.exe 44 PID 604 wrote to memory of 2660 604 7rllffl.exe 44 PID 604 wrote to memory of 2660 604 7rllffl.exe 44 PID 2660 wrote to memory of 2000 2660 vppvd.exe 45 PID 2660 wrote to memory of 2000 2660 vppvd.exe 45 PID 2660 wrote to memory of 2000 2660 vppvd.exe 45 PID 2660 wrote to memory of 2000 2660 vppvd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\e48a0616b2f93e7ad470d52ab0acb422880293c23422c4c175bfd883992ce755.exe"C:\Users\Admin\AppData\Local\Temp\e48a0616b2f93e7ad470d52ab0acb422880293c23422c4c175bfd883992ce755.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\ttttbb.exec:\ttttbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
\??\c:\9frxllx.exec:\9frxllx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\nnbhtt.exec:\nnbhtt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\fxllffx.exec:\fxllffx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\fllxxll.exec:\fllxxll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\dvjpd.exec:\dvjpd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\pjjpv.exec:\pjjpv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\hhbbtt.exec:\hhbbtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\pjdpv.exec:\pjdpv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\fxlrxrl.exec:\fxlrxrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\5xxrxxf.exec:\5xxrxxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\htbhbb.exec:\htbhbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\pdvdp.exec:\pdvdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\7rllffl.exec:\7rllffl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:604 -
\??\c:\vppvd.exec:\vppvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\xrllrxl.exec:\xrllrxl.exe17⤵
- Executes dropped EXE
PID:2000 -
\??\c:\thbthh.exec:\thbthh.exe18⤵
- Executes dropped EXE
PID:2128 -
\??\c:\rxxlxxl.exec:\rxxlxxl.exe19⤵
- Executes dropped EXE
PID:1644 -
\??\c:\ttnbbn.exec:\ttnbbn.exe20⤵
- Executes dropped EXE
PID:2924 -
\??\c:\rlflrrf.exec:\rlflrrf.exe21⤵
- Executes dropped EXE
PID:2640 -
\??\c:\5ffflrf.exec:\5ffflrf.exe22⤵
- Executes dropped EXE
PID:2076 -
\??\c:\5jdjp.exec:\5jdjp.exe23⤵
- Executes dropped EXE
PID:1760 -
\??\c:\9frxfrf.exec:\9frxfrf.exe24⤵
- Executes dropped EXE
PID:1624 -
\??\c:\vvjpv.exec:\vvjpv.exe25⤵
- Executes dropped EXE
PID:2024 -
\??\c:\1pdpv.exec:\1pdpv.exe26⤵
- Executes dropped EXE
PID:1672 -
\??\c:\rlrxlxl.exec:\rlrxlxl.exe27⤵
- Executes dropped EXE
PID:1932 -
\??\c:\btnbhn.exec:\btnbhn.exe28⤵
- Executes dropped EXE
PID:3020 -
\??\c:\hhtbnn.exec:\hhtbnn.exe29⤵
- Executes dropped EXE
PID:572 -
\??\c:\xrflxfl.exec:\xrflxfl.exe30⤵
- Executes dropped EXE
PID:2056 -
\??\c:\1hntbt.exec:\1hntbt.exe31⤵
- Executes dropped EXE
PID:1664 -
\??\c:\vppdp.exec:\vppdp.exe32⤵
- Executes dropped EXE
PID:2416 -
\??\c:\vjvvd.exec:\vjvvd.exe33⤵
- Executes dropped EXE
PID:1608 -
\??\c:\3fxxffl.exec:\3fxxffl.exe34⤵
- Executes dropped EXE
PID:2548 -
\??\c:\hbntbb.exec:\hbntbb.exe35⤵
- Executes dropped EXE
PID:2520 -
\??\c:\thbnbb.exec:\thbnbb.exe36⤵
- Executes dropped EXE
PID:2512 -
\??\c:\7rlxflr.exec:\7rlxflr.exe37⤵
- Executes dropped EXE
PID:1252 -
\??\c:\bnbbtt.exec:\bnbbtt.exe38⤵
- Executes dropped EXE
PID:2692 -
\??\c:\jvppd.exec:\jvppd.exe39⤵
- Executes dropped EXE
PID:2788 -
\??\c:\1xxxflr.exec:\1xxxflr.exe40⤵
- Executes dropped EXE
PID:2728 -
\??\c:\nhttbt.exec:\nhttbt.exe41⤵
- Executes dropped EXE
PID:2808 -
\??\c:\9vppj.exec:\9vppj.exe42⤵
- Executes dropped EXE
PID:2968 -
\??\c:\llfxxxf.exec:\llfxxxf.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2888 -
\??\c:\nnbhhh.exec:\nnbhhh.exe44⤵
- Executes dropped EXE
PID:1168 -
\??\c:\tnhthn.exec:\tnhthn.exe45⤵
- Executes dropped EXE
PID:2672 -
\??\c:\djvdv.exec:\djvdv.exe46⤵
- Executes dropped EXE
PID:2632 -
\??\c:\rrflxxl.exec:\rrflxxl.exe47⤵
- Executes dropped EXE
PID:2568 -
\??\c:\1hbtbh.exec:\1hbtbh.exe48⤵
- Executes dropped EXE
PID:2084 -
\??\c:\pvdjd.exec:\pvdjd.exe49⤵
- Executes dropped EXE
PID:1976 -
\??\c:\vpjpd.exec:\vpjpd.exe50⤵
- Executes dropped EXE
PID:1656 -
\??\c:\xrllrxf.exec:\xrllrxf.exe51⤵
- Executes dropped EXE
PID:1964 -
\??\c:\rrllxxf.exec:\rrllxxf.exe52⤵
- Executes dropped EXE
PID:588 -
\??\c:\9btttt.exec:\9btttt.exe53⤵
- Executes dropped EXE
PID:596 -
\??\c:\vpddj.exec:\vpddj.exe54⤵
- Executes dropped EXE
PID:2904 -
\??\c:\xrflffr.exec:\xrflffr.exe55⤵
- Executes dropped EXE
PID:1640 -
\??\c:\1xrfllr.exec:\1xrfllr.exe56⤵
- Executes dropped EXE
PID:1916 -
\??\c:\5nhbbb.exec:\5nhbbb.exe57⤵
- Executes dropped EXE
PID:2900 -
\??\c:\hbntbn.exec:\hbntbn.exe58⤵
- Executes dropped EXE
PID:2908 -
\??\c:\vpjvj.exec:\vpjvj.exe59⤵
- Executes dropped EXE
PID:2352 -
\??\c:\xrllrxf.exec:\xrllrxf.exe60⤵
- Executes dropped EXE
PID:2360 -
\??\c:\ffrrffr.exec:\ffrrffr.exe61⤵
- Executes dropped EXE
PID:2076 -
\??\c:\7hhtbb.exec:\7hhtbb.exe62⤵
- Executes dropped EXE
PID:1212 -
\??\c:\vjvvv.exec:\vjvvv.exe63⤵
- Executes dropped EXE
PID:1552 -
\??\c:\jdpvp.exec:\jdpvp.exe64⤵
- Executes dropped EXE
PID:2992 -
\??\c:\rfxrxxl.exec:\rfxrxxl.exe65⤵
- Executes dropped EXE
PID:1864 -
\??\c:\rlrrxfl.exec:\rlrrxfl.exe66⤵PID:1920
-
\??\c:\bttbhn.exec:\bttbhn.exe67⤵PID:2244
-
\??\c:\pjpvj.exec:\pjpvj.exe68⤵PID:1928
-
\??\c:\3jpjj.exec:\3jpjj.exe69⤵PID:2276
-
\??\c:\lxllrrx.exec:\lxllrrx.exe70⤵PID:2468
-
\??\c:\nbnhnn.exec:\nbnhnn.exe71⤵PID:2056
-
\??\c:\pjvpd.exec:\pjvpd.exe72⤵PID:2288
-
\??\c:\vjdvv.exec:\vjdvv.exe73⤵PID:2376
-
\??\c:\jdjpp.exec:\jdjpp.exe74⤵PID:1612
-
\??\c:\llfrrxf.exec:\llfrrxf.exe75⤵PID:2384
-
\??\c:\htthhh.exec:\htthhh.exe76⤵PID:2536
-
\??\c:\bnhhhn.exec:\bnhhhn.exe77⤵PID:828
-
\??\c:\vjvvp.exec:\vjvvp.exe78⤵PID:2532
-
\??\c:\xlflrrr.exec:\xlflrrr.exe79⤵PID:2260
-
\??\c:\bthntt.exec:\bthntt.exe80⤵PID:2224
-
\??\c:\bnhbbb.exec:\bnhbbb.exe81⤵PID:2812
-
\??\c:\9pjjj.exec:\9pjjj.exe82⤵PID:2732
-
\??\c:\rfxxffr.exec:\rfxxffr.exe83⤵PID:2832
-
\??\c:\lflrrxl.exec:\lflrrxl.exe84⤵PID:2836
-
\??\c:\hthntt.exec:\hthntt.exe85⤵PID:2968
-
\??\c:\1dddd.exec:\1dddd.exe86⤵PID:2616
-
\??\c:\vjpvv.exec:\vjpvv.exe87⤵PID:2676
-
\??\c:\flffffl.exec:\flffffl.exe88⤵PID:2672
-
\??\c:\bthhnn.exec:\bthhnn.exe89⤵PID:2632
-
\??\c:\5vvjp.exec:\5vvjp.exe90⤵PID:2612
-
\??\c:\1pdjp.exec:\1pdjp.exe91⤵PID:2084
-
\??\c:\lfxxfxf.exec:\lfxxfxf.exe92⤵PID:484
-
\??\c:\xrrrxxf.exec:\xrrrxxf.exe93⤵PID:2884
-
\??\c:\htbhtb.exec:\htbhtb.exe94⤵PID:604
-
\??\c:\9dpjj.exec:\9dpjj.exe95⤵PID:2588
-
\??\c:\jvppp.exec:\jvppp.exe96⤵PID:2508
-
\??\c:\xlxfllf.exec:\xlxfllf.exe97⤵PID:1744
-
\??\c:\3bnbhn.exec:\3bnbhn.exe98⤵PID:2128
-
\??\c:\tnbnnn.exec:\tnbnnn.exe99⤵PID:2912
-
\??\c:\dvvdp.exec:\dvvdp.exe100⤵PID:2944
-
\??\c:\1xllxfl.exec:\1xllxfl.exe101⤵PID:2328
-
\??\c:\rfrxllr.exec:\rfrxllr.exe102⤵PID:2164
-
\??\c:\7nhbhh.exec:\7nhbhh.exe103⤵PID:1852
-
\??\c:\pvjvv.exec:\pvjvv.exe104⤵PID:1844
-
\??\c:\5fxlrrx.exec:\5fxlrrx.exe105⤵PID:280
-
\??\c:\lfrxfll.exec:\lfrxfll.exe106⤵PID:2052
-
\??\c:\nbhnnn.exec:\nbhnnn.exe107⤵PID:1672
-
\??\c:\djjpd.exec:\djjpd.exe108⤵
- System Location Discovery: System Language Discovery
PID:3060 -
\??\c:\dvddj.exec:\dvddj.exe109⤵PID:1932
-
\??\c:\fffrlxl.exec:\fffrlxl.exe110⤵PID:996
-
\??\c:\xffxrll.exec:\xffxrll.exe111⤵PID:2200
-
\??\c:\bhhbhb.exec:\bhhbhb.exe112⤵PID:572
-
\??\c:\jdppv.exec:\jdppv.exe113⤵PID:1036
-
\??\c:\frfxlrr.exec:\frfxlrr.exe114⤵PID:2492
-
\??\c:\frllrrx.exec:\frllrrx.exe115⤵PID:1664
-
\??\c:\hbhnnn.exec:\hbhnnn.exe116⤵
- System Location Discovery: System Language Discovery
PID:2416 -
\??\c:\3jvjp.exec:\3jvjp.exe117⤵PID:2092
-
\??\c:\xlxrrrx.exec:\xlxrrrx.exe118⤵PID:2552
-
\??\c:\1lflrrr.exec:\1lflrrr.exe119⤵PID:1224
-
\??\c:\3hbbnt.exec:\3hbbnt.exe120⤵PID:2104
-
\??\c:\pvpvv.exec:\pvpvv.exe121⤵PID:2448
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-