Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 11:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3cc3a7def4554796bd9efce69a0cbecf8be5c0308d3f26099331b9cd6b1e4574.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
3cc3a7def4554796bd9efce69a0cbecf8be5c0308d3f26099331b9cd6b1e4574.exe
-
Size
454KB
-
MD5
c08cae73261da112c1fa0bfd4111bd7d
-
SHA1
83f5e53605b13ad93454984445ebc1ed2dfed100
-
SHA256
3cc3a7def4554796bd9efce69a0cbecf8be5c0308d3f26099331b9cd6b1e4574
-
SHA512
19aea5ec0c69166999297c4a30d62a30cd755d1ba40898c47c59206bb400e569d2cd51509bcb72516bfd455d043f8409403c5f5cab2480b0a9abac101ab6be32
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeZ:q7Tc2NYHUrAwfMp3CDZ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/2508-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2528-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2076-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2536-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2332-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1652-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2020-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1948-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2020-149-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1796-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-202-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2152-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/972-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2460-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2476-264-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3060-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-318-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3064-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2416-332-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1580-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1580-339-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2848-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1832-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1596-437-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1084-476-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/612-492-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2208-607-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2052-794-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2292-812-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2292-817-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1696-974-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2352-1090-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2076 pdjpd.exe 2528 fxlrfll.exe 2380 jdpdj.exe 2880 nhbhtb.exe 2700 bbbhth.exe 2804 vjvvv.exe 2600 xrrrxxl.exe 2876 bnhhnt.exe 2552 dvjjp.exe 2596 hbnttn.exe 2996 vdppv.exe 2536 vvppv.exe 1652 3hnhhb.exe 2332 1djjp.exe 2020 ffxxfrf.exe 1948 hthhnn.exe 328 jdjvv.exe 2688 nhntht.exe 596 5dvvv.exe 2836 lfrfffl.exe 2944 5tbbhh.exe 1796 1vjjj.exe 2152 rxlxfrx.exe 756 lrrlflx.exe 1880 hbnttt.exe 972 5pdpd.exe 2460 xxflrxr.exe 2476 btnthb.exe 1028 dvdvd.exe 748 jjpvp.exe 3060 rlxxffr.exe 2988 hbnhhh.exe 1676 5vddj.exe 3024 ppdpj.exe 3064 lxllllx.exe 2380 pdppp.exe 2416 5dvpv.exe 1580 3flllfr.exe 2848 1tbtbb.exe 2752 vjpdj.exe 2908 dpvvd.exe 2856 rlrrxrr.exe 2692 5llxrrr.exe 2612 thnbhh.exe 1832 pdjjv.exe 3020 pvpjd.exe 1144 lflxlrf.exe 904 flrlxxf.exe 1652 hbnhnn.exe 1552 7vddj.exe 1772 jvjjp.exe 1948 xlrllff.exe 1596 3flllrl.exe 1624 3bhhnh.exe 1848 pjdpv.exe 2196 9rrrxff.exe 2296 rxffxll.exe 776 9thnhh.exe 1608 hthbhh.exe 1084 pdjdv.exe 612 jvjjj.exe 2904 frxxffr.exe 1668 nbbtnh.exe 1296 bnbnnh.exe -
resource yara_rule behavioral1/memory/2508-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1948-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1796-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1880-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/972-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1580-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1832-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1596-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1084-476-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/612-484-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/612-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-525-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1296-524-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1252-581-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-648-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-673-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-710-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1148-735-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-797-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-812-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2292-817-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-869-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-901-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-938-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-988-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-995-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/304-1026-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2136-1045-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-1083-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-1091-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1536-1098-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-1105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-1144-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2752-1152-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxxxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2508 wrote to memory of 2076 2508 3cc3a7def4554796bd9efce69a0cbecf8be5c0308d3f26099331b9cd6b1e4574.exe 30 PID 2508 wrote to memory of 2076 2508 3cc3a7def4554796bd9efce69a0cbecf8be5c0308d3f26099331b9cd6b1e4574.exe 30 PID 2508 wrote to memory of 2076 2508 3cc3a7def4554796bd9efce69a0cbecf8be5c0308d3f26099331b9cd6b1e4574.exe 30 PID 2508 wrote to memory of 2076 2508 3cc3a7def4554796bd9efce69a0cbecf8be5c0308d3f26099331b9cd6b1e4574.exe 30 PID 2076 wrote to memory of 2528 2076 pdjpd.exe 31 PID 2076 wrote to memory of 2528 2076 pdjpd.exe 31 PID 2076 wrote to memory of 2528 2076 pdjpd.exe 31 PID 2076 wrote to memory of 2528 2076 pdjpd.exe 31 PID 2528 wrote to memory of 2380 2528 fxlrfll.exe 32 PID 2528 wrote to memory of 2380 2528 fxlrfll.exe 32 PID 2528 wrote to memory of 2380 2528 fxlrfll.exe 32 PID 2528 wrote to memory of 2380 2528 fxlrfll.exe 32 PID 2380 wrote to memory of 2880 2380 jdpdj.exe 33 PID 2380 wrote to memory of 2880 2380 jdpdj.exe 33 PID 2380 wrote to memory of 2880 2380 jdpdj.exe 33 PID 2380 wrote to memory of 2880 2380 jdpdj.exe 33 PID 2880 wrote to memory of 2700 2880 nhbhtb.exe 34 PID 2880 wrote to memory of 2700 2880 nhbhtb.exe 34 PID 2880 wrote to memory of 2700 2880 nhbhtb.exe 34 PID 2880 wrote to memory of 2700 2880 nhbhtb.exe 34 PID 2700 wrote to memory of 2804 2700 bbbhth.exe 35 PID 2700 wrote to memory of 2804 2700 bbbhth.exe 35 PID 2700 wrote to memory of 2804 2700 bbbhth.exe 35 PID 2700 wrote to memory of 2804 2700 bbbhth.exe 35 PID 2804 wrote to memory of 2600 2804 vjvvv.exe 36 PID 2804 wrote to memory of 2600 2804 vjvvv.exe 36 PID 2804 wrote to memory of 2600 2804 vjvvv.exe 36 PID 2804 wrote to memory of 2600 2804 vjvvv.exe 36 PID 2600 wrote to memory of 2876 2600 xrrrxxl.exe 37 PID 2600 wrote to memory of 2876 2600 xrrrxxl.exe 37 PID 2600 wrote to memory of 2876 2600 xrrrxxl.exe 37 PID 2600 wrote to memory of 2876 2600 xrrrxxl.exe 37 PID 2876 wrote to memory of 2552 2876 bnhhnt.exe 38 PID 2876 wrote to memory of 2552 2876 bnhhnt.exe 38 PID 2876 wrote to memory of 2552 2876 bnhhnt.exe 38 PID 2876 wrote to memory of 2552 2876 bnhhnt.exe 38 PID 2552 wrote to memory of 2596 2552 dvjjp.exe 39 PID 2552 wrote to memory of 2596 2552 dvjjp.exe 39 PID 2552 wrote to memory of 2596 2552 dvjjp.exe 39 PID 2552 wrote to memory of 2596 2552 dvjjp.exe 39 PID 2596 wrote to memory of 2996 2596 hbnttn.exe 40 PID 2596 wrote to memory of 2996 2596 hbnttn.exe 40 PID 2596 wrote to memory of 2996 2596 hbnttn.exe 40 PID 2596 wrote to memory of 2996 2596 hbnttn.exe 40 PID 2996 wrote to memory of 2536 2996 vdppv.exe 41 PID 2996 wrote to memory of 2536 2996 vdppv.exe 41 PID 2996 wrote to memory of 2536 2996 vdppv.exe 41 PID 2996 wrote to memory of 2536 2996 vdppv.exe 41 PID 2536 wrote to memory of 1652 2536 vvppv.exe 42 PID 2536 wrote to memory of 1652 2536 vvppv.exe 42 PID 2536 wrote to memory of 1652 2536 vvppv.exe 42 PID 2536 wrote to memory of 1652 2536 vvppv.exe 42 PID 1652 wrote to memory of 2332 1652 3hnhhb.exe 43 PID 1652 wrote to memory of 2332 1652 3hnhhb.exe 43 PID 1652 wrote to memory of 2332 1652 3hnhhb.exe 43 PID 1652 wrote to memory of 2332 1652 3hnhhb.exe 43 PID 2332 wrote to memory of 2020 2332 1djjp.exe 44 PID 2332 wrote to memory of 2020 2332 1djjp.exe 44 PID 2332 wrote to memory of 2020 2332 1djjp.exe 44 PID 2332 wrote to memory of 2020 2332 1djjp.exe 44 PID 2020 wrote to memory of 1948 2020 ffxxfrf.exe 45 PID 2020 wrote to memory of 1948 2020 ffxxfrf.exe 45 PID 2020 wrote to memory of 1948 2020 ffxxfrf.exe 45 PID 2020 wrote to memory of 1948 2020 ffxxfrf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\3cc3a7def4554796bd9efce69a0cbecf8be5c0308d3f26099331b9cd6b1e4574.exe"C:\Users\Admin\AppData\Local\Temp\3cc3a7def4554796bd9efce69a0cbecf8be5c0308d3f26099331b9cd6b1e4574.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\pdjpd.exec:\pdjpd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\fxlrfll.exec:\fxlrfll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\jdpdj.exec:\jdpdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\nhbhtb.exec:\nhbhtb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\bbbhth.exec:\bbbhth.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\vjvvv.exec:\vjvvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\xrrrxxl.exec:\xrrrxxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\bnhhnt.exec:\bnhhnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\dvjjp.exec:\dvjjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\hbnttn.exec:\hbnttn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\vdppv.exec:\vdppv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\vvppv.exec:\vvppv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\3hnhhb.exec:\3hnhhb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\1djjp.exec:\1djjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\ffxxfrf.exec:\ffxxfrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\hthhnn.exec:\hthhnn.exe17⤵
- Executes dropped EXE
PID:1948 -
\??\c:\jdjvv.exec:\jdjvv.exe18⤵
- Executes dropped EXE
PID:328 -
\??\c:\nhntht.exec:\nhntht.exe19⤵
- Executes dropped EXE
PID:2688 -
\??\c:\5dvvv.exec:\5dvvv.exe20⤵
- Executes dropped EXE
PID:596 -
\??\c:\lfrfffl.exec:\lfrfffl.exe21⤵
- Executes dropped EXE
PID:2836 -
\??\c:\5tbbhh.exec:\5tbbhh.exe22⤵
- Executes dropped EXE
PID:2944 -
\??\c:\1vjjj.exec:\1vjjj.exe23⤵
- Executes dropped EXE
PID:1796 -
\??\c:\rxlxfrx.exec:\rxlxfrx.exe24⤵
- Executes dropped EXE
PID:2152 -
\??\c:\lrrlflx.exec:\lrrlflx.exe25⤵
- Executes dropped EXE
PID:756 -
\??\c:\hbnttt.exec:\hbnttt.exe26⤵
- Executes dropped EXE
PID:1880 -
\??\c:\5pdpd.exec:\5pdpd.exe27⤵
- Executes dropped EXE
PID:972 -
\??\c:\xxflrxr.exec:\xxflrxr.exe28⤵
- Executes dropped EXE
PID:2460 -
\??\c:\btnthb.exec:\btnthb.exe29⤵
- Executes dropped EXE
PID:2476 -
\??\c:\dvdvd.exec:\dvdvd.exe30⤵
- Executes dropped EXE
PID:1028 -
\??\c:\jjpvp.exec:\jjpvp.exe31⤵
- Executes dropped EXE
PID:748 -
\??\c:\rlxxffr.exec:\rlxxffr.exe32⤵
- Executes dropped EXE
PID:3060 -
\??\c:\hbnhhh.exec:\hbnhhh.exe33⤵
- Executes dropped EXE
PID:2988 -
\??\c:\5vddj.exec:\5vddj.exe34⤵
- Executes dropped EXE
PID:1676 -
\??\c:\ppdpj.exec:\ppdpj.exe35⤵
- Executes dropped EXE
PID:3024 -
\??\c:\lxllllx.exec:\lxllllx.exe36⤵
- Executes dropped EXE
PID:3064 -
\??\c:\pdppp.exec:\pdppp.exe37⤵
- Executes dropped EXE
PID:2380 -
\??\c:\5dvpv.exec:\5dvpv.exe38⤵
- Executes dropped EXE
PID:2416 -
\??\c:\3flllfr.exec:\3flllfr.exe39⤵
- Executes dropped EXE
PID:1580 -
\??\c:\1tbtbb.exec:\1tbtbb.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2848 -
\??\c:\vjpdj.exec:\vjpdj.exe41⤵
- Executes dropped EXE
PID:2752 -
\??\c:\dpvvd.exec:\dpvvd.exe42⤵
- Executes dropped EXE
PID:2908 -
\??\c:\rlrrxrr.exec:\rlrrxrr.exe43⤵
- Executes dropped EXE
PID:2856 -
\??\c:\5llxrrr.exec:\5llxrrr.exe44⤵
- Executes dropped EXE
PID:2692 -
\??\c:\thnbhh.exec:\thnbhh.exe45⤵
- Executes dropped EXE
PID:2612 -
\??\c:\pdjjv.exec:\pdjjv.exe46⤵
- Executes dropped EXE
PID:1832 -
\??\c:\pvpjd.exec:\pvpjd.exe47⤵
- Executes dropped EXE
PID:3020 -
\??\c:\lflxlrf.exec:\lflxlrf.exe48⤵
- Executes dropped EXE
PID:1144 -
\??\c:\flrlxxf.exec:\flrlxxf.exe49⤵
- Executes dropped EXE
PID:904 -
\??\c:\hbnhnn.exec:\hbnhnn.exe50⤵
- Executes dropped EXE
PID:1652 -
\??\c:\7vddj.exec:\7vddj.exe51⤵
- Executes dropped EXE
PID:1552 -
\??\c:\jvjjp.exec:\jvjjp.exe52⤵
- Executes dropped EXE
PID:1772 -
\??\c:\xlrllff.exec:\xlrllff.exe53⤵
- Executes dropped EXE
PID:1948 -
\??\c:\3flllrl.exec:\3flllrl.exe54⤵
- Executes dropped EXE
PID:1596 -
\??\c:\3bhhnh.exec:\3bhhnh.exe55⤵
- Executes dropped EXE
PID:1624 -
\??\c:\pjdpv.exec:\pjdpv.exe56⤵
- Executes dropped EXE
PID:1848 -
\??\c:\9rrrxff.exec:\9rrrxff.exe57⤵
- Executes dropped EXE
PID:2196 -
\??\c:\rxffxll.exec:\rxffxll.exe58⤵
- Executes dropped EXE
PID:2296 -
\??\c:\9thnhh.exec:\9thnhh.exe59⤵
- Executes dropped EXE
PID:776 -
\??\c:\hthbhh.exec:\hthbhh.exe60⤵
- Executes dropped EXE
PID:1608 -
\??\c:\pdjdv.exec:\pdjdv.exe61⤵
- Executes dropped EXE
PID:1084 -
\??\c:\jvjjj.exec:\jvjjj.exe62⤵
- Executes dropped EXE
PID:612 -
\??\c:\frxxffr.exec:\frxxffr.exe63⤵
- Executes dropped EXE
PID:2904 -
\??\c:\nbbtnh.exec:\nbbtnh.exe64⤵
- Executes dropped EXE
PID:1668 -
\??\c:\bnbnnh.exec:\bnbnnh.exe65⤵
- Executes dropped EXE
PID:1296 -
\??\c:\3ddvp.exec:\3ddvp.exe66⤵PID:1340
-
\??\c:\fxfxxrr.exec:\fxfxxrr.exe67⤵PID:2324
-
\??\c:\rxxxrll.exec:\rxxxrll.exe68⤵PID:2440
-
\??\c:\thhhbb.exec:\thhhbb.exe69⤵PID:2476
-
\??\c:\vvdjp.exec:\vvdjp.exe70⤵
- System Location Discovery: System Language Discovery
PID:916 -
\??\c:\9vvvj.exec:\9vvvj.exe71⤵PID:1492
-
\??\c:\3rffxxx.exec:\3rffxxx.exe72⤵PID:2508
-
\??\c:\btntbb.exec:\btntbb.exe73⤵PID:3060
-
\??\c:\vpddj.exec:\vpddj.exe74⤵PID:1560
-
\??\c:\pddpv.exec:\pddpv.exe75⤵PID:2912
-
\??\c:\rlxfrrf.exec:\rlxfrrf.exe76⤵PID:2504
-
\??\c:\thnnnn.exec:\thnnnn.exe77⤵PID:1252
-
\??\c:\5hnhbb.exec:\5hnhbb.exe78⤵PID:3064
-
\??\c:\vpjpj.exec:\vpjpj.exe79⤵PID:2732
-
\??\c:\7rfrxxf.exec:\7rfrxxf.exe80⤵PID:2208
-
\??\c:\3xrrxxf.exec:\3xrrxxf.exe81⤵PID:2936
-
\??\c:\hhtbnn.exec:\hhtbnn.exe82⤵PID:2852
-
\??\c:\7nhhhh.exec:\7nhhhh.exe83⤵PID:2600
-
\??\c:\5rffrlr.exec:\5rffrlr.exe84⤵PID:2876
-
\??\c:\9xxrxxf.exec:\9xxrxxf.exe85⤵PID:2704
-
\??\c:\7htbhn.exec:\7htbhn.exe86⤵PID:2608
-
\??\c:\vjdvv.exec:\vjdvv.exe87⤵PID:2596
-
\??\c:\5lflllr.exec:\5lflllr.exe88⤵PID:3048
-
\??\c:\xrflrrr.exec:\xrflrrr.exe89⤵PID:2668
-
\??\c:\hhnbhh.exec:\hhnbhh.exe90⤵PID:2760
-
\??\c:\3bhhbt.exec:\3bhhbt.exe91⤵PID:1712
-
\??\c:\vpvpp.exec:\vpvpp.exe92⤵PID:2024
-
\??\c:\fxxllfx.exec:\fxxllfx.exe93⤵PID:1960
-
\??\c:\frfxllr.exec:\frfxllr.exe94⤵PID:1972
-
\??\c:\hthnbh.exec:\hthnbh.exe95⤵PID:2116
-
\??\c:\9nnnhh.exec:\9nnnhh.exe96⤵PID:2424
-
\??\c:\pjvpd.exec:\pjvpd.exe97⤵PID:1944
-
\??\c:\xrxflff.exec:\xrxflff.exe98⤵PID:1528
-
\??\c:\xlfxfrx.exec:\xlfxfrx.exe99⤵PID:2980
-
\??\c:\hbnhhh.exec:\hbnhhh.exe100⤵PID:2072
-
\??\c:\pvdvv.exec:\pvdvv.exe101⤵PID:1148
-
\??\c:\jdpdv.exec:\jdpdv.exe102⤵PID:1360
-
\??\c:\lfrrrxl.exec:\lfrrrxl.exe103⤵PID:1584
-
\??\c:\9rflllx.exec:\9rflllx.exe104⤵PID:1872
-
\??\c:\bntttt.exec:\bntttt.exe105⤵PID:2304
-
\??\c:\bhnbbt.exec:\bhnbbt.exe106⤵PID:756
-
\??\c:\vpvjp.exec:\vpvjp.exe107⤵PID:1264
-
\??\c:\1flflfl.exec:\1flflfl.exe108⤵PID:1296
-
\??\c:\rflxrlf.exec:\rflxrlf.exe109⤵PID:1880
-
\??\c:\hntntn.exec:\hntntn.exe110⤵PID:2052
-
\??\c:\dpppp.exec:\dpppp.exe111⤵PID:3052
-
\??\c:\jvjjp.exec:\jvjjp.exe112⤵PID:2080
-
\??\c:\lfrrlfl.exec:\lfrrlfl.exe113⤵PID:2292
-
\??\c:\9rllrrr.exec:\9rllrrr.exe114⤵PID:2140
-
\??\c:\thnhtn.exec:\thnhtn.exe115⤵PID:1820
-
\??\c:\1vjjd.exec:\1vjjd.exe116⤵PID:2556
-
\??\c:\5fxxlfx.exec:\5fxxlfx.exe117⤵PID:3032
-
\??\c:\rlxxfxl.exec:\rlxxfxl.exe118⤵PID:2496
-
\??\c:\9nhbbh.exec:\9nhbbh.exe119⤵PID:1932
-
\??\c:\bnbbhb.exec:\bnbbhb.exe120⤵PID:2112
-
\??\c:\9jpdv.exec:\9jpdv.exe121⤵PID:2380
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-