Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 11:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e658cb75b345b3d2c305584cf1ffcf89d973e1c38dbba453dd4a542fbe3a0658.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
e658cb75b345b3d2c305584cf1ffcf89d973e1c38dbba453dd4a542fbe3a0658.exe
-
Size
456KB
-
MD5
e1f5a0b036747158ae6eb5ac7a1c80db
-
SHA1
b46969295a89bb547ec7cb54543f67b5c2aacf05
-
SHA256
e658cb75b345b3d2c305584cf1ffcf89d973e1c38dbba453dd4a542fbe3a0658
-
SHA512
a869d688d19a9fd63563a4df52201aaffda00ebc6c58948af8f263fceb7feeef065b91f88cc66a622c097e9e273cf6d0b3e20c758d74fc5e54c05c5e337c9cb8
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRE:q7Tc2NYHUrAwfMp3CDRE
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/1656-0-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2288-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1916-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1676-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1612-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1676-83-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2588-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-159-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2340-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-215-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2392-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1644-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2460-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/352-514-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2120-545-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-637-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/1440-433-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/616-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/352-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-225-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2724-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2340-205-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2004-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1044-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/680-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-139-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2512-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-121-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1536-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-70-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1676-54-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2848-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1276-750-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2460-952-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2436-964-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-1040-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/636-1293-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2848 5frlffl.exe 2260 htbttt.exe 1916 dvjvj.exe 2288 dpjjv.exe 1676 xrxxfff.exe 1612 1lxxfrx.exe 2932 nhhhbb.exe 2624 ddpvj.exe 2588 vdpvv.exe 1536 rfrrfxf.exe 2620 pjdpv.exe 2696 jvjdj.exe 2512 lfrlrrx.exe 2880 bthhhb.exe 680 pjddv.exe 2364 xxflrlx.exe 1044 1xlfxrr.exe 1424 hbhbbt.exe 2212 5vpvd.exe 2004 xrxflfl.exe 2340 1vvvv.exe 2724 7lflllx.exe 2760 3bttbt.exe 1808 5jddd.exe 352 9rxlrlr.exe 2748 btbbnn.exe 616 pdvjp.exe 2100 xrffrrx.exe 2960 nbthtb.exe 1500 9htbtn.exe 3024 jdvdd.exe 2392 7rfxrlf.exe 2908 rxlfffl.exe 2316 btnttt.exe 1644 pjvvd.exe 1628 xrllrrr.exe 2384 9frrlll.exe 1856 ntbtth.exe 2308 pdppp.exe 2200 xrfxxxf.exe 2324 rxrlfxf.exe 3036 hntttn.exe 2568 hbnntt.exe 2704 7pppp.exe 2584 pjjdj.exe 2572 frrlrrx.exe 2460 thnhht.exe 864 thtthh.exe 1844 jvdvp.exe 2688 5lrrrlx.exe 1244 1flfxxf.exe 1440 9hnnnn.exe 1560 3thbhb.exe 2352 vppjj.exe 2016 vpddd.exe 2456 rfrrrrr.exe 1264 xflxxrr.exe 2276 1tthhb.exe 2372 thnnnh.exe 2424 dppjd.exe 1604 djpjj.exe 2036 rfrxxxf.exe 284 bhnnnh.exe 572 1hnhhn.exe -
resource yara_rule behavioral1/memory/1656-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1916-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1676-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/352-514-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-545-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1536-656-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-637-0x00000000003D0000-0x00000000003FA000-memory.dmp upx behavioral1/memory/2316-576-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1440-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1500-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/616-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/352-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1044-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/680-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1536-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1044-712-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1276-750-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/1184-815-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-937-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-952-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2436-964-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-1013-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1216-1026-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-1033-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-1040-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/352-1072-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-1091-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-1104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-1235-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2364-1262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-1275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-1327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-1365-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxxlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxrrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ttnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxfllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rfxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1656 wrote to memory of 2848 1656 e658cb75b345b3d2c305584cf1ffcf89d973e1c38dbba453dd4a542fbe3a0658.exe 101 PID 1656 wrote to memory of 2848 1656 e658cb75b345b3d2c305584cf1ffcf89d973e1c38dbba453dd4a542fbe3a0658.exe 101 PID 1656 wrote to memory of 2848 1656 e658cb75b345b3d2c305584cf1ffcf89d973e1c38dbba453dd4a542fbe3a0658.exe 101 PID 1656 wrote to memory of 2848 1656 e658cb75b345b3d2c305584cf1ffcf89d973e1c38dbba453dd4a542fbe3a0658.exe 101 PID 2848 wrote to memory of 2260 2848 5frlffl.exe 29 PID 2848 wrote to memory of 2260 2848 5frlffl.exe 29 PID 2848 wrote to memory of 2260 2848 5frlffl.exe 29 PID 2848 wrote to memory of 2260 2848 5frlffl.exe 29 PID 2260 wrote to memory of 1916 2260 htbttt.exe 30 PID 2260 wrote to memory of 1916 2260 htbttt.exe 30 PID 2260 wrote to memory of 1916 2260 htbttt.exe 30 PID 2260 wrote to memory of 1916 2260 htbttt.exe 30 PID 1916 wrote to memory of 2288 1916 dvjvj.exe 31 PID 1916 wrote to memory of 2288 1916 dvjvj.exe 31 PID 1916 wrote to memory of 2288 1916 dvjvj.exe 31 PID 1916 wrote to memory of 2288 1916 dvjvj.exe 31 PID 2288 wrote to memory of 1676 2288 dpjjv.exe 32 PID 2288 wrote to memory of 1676 2288 dpjjv.exe 32 PID 2288 wrote to memory of 1676 2288 dpjjv.exe 32 PID 2288 wrote to memory of 1676 2288 dpjjv.exe 32 PID 1676 wrote to memory of 1612 1676 xrxxfff.exe 33 PID 1676 wrote to memory of 1612 1676 xrxxfff.exe 33 PID 1676 wrote to memory of 1612 1676 xrxxfff.exe 33 PID 1676 wrote to memory of 1612 1676 xrxxfff.exe 33 PID 1612 wrote to memory of 2932 1612 1lxxfrx.exe 34 PID 1612 wrote to memory of 2932 1612 1lxxfrx.exe 34 PID 1612 wrote to memory of 2932 1612 1lxxfrx.exe 34 PID 1612 wrote to memory of 2932 1612 1lxxfrx.exe 34 PID 2932 wrote to memory of 2624 2932 nhhhbb.exe 35 PID 2932 wrote to memory of 2624 2932 nhhhbb.exe 35 PID 2932 wrote to memory of 2624 2932 nhhhbb.exe 35 PID 2932 wrote to memory of 2624 2932 nhhhbb.exe 35 PID 2624 wrote to memory of 2588 2624 ddpvj.exe 36 PID 2624 wrote to memory of 2588 2624 ddpvj.exe 36 PID 2624 wrote to memory of 2588 2624 ddpvj.exe 36 PID 2624 wrote to memory of 2588 2624 ddpvj.exe 36 PID 2588 wrote to memory of 1536 2588 vdpvv.exe 37 PID 2588 wrote to memory of 1536 2588 vdpvv.exe 37 PID 2588 wrote to memory of 1536 2588 vdpvv.exe 37 PID 2588 wrote to memory of 1536 2588 vdpvv.exe 37 PID 1536 wrote to memory of 2620 1536 rfrrfxf.exe 38 PID 1536 wrote to memory of 2620 1536 rfrrfxf.exe 38 PID 1536 wrote to memory of 2620 1536 rfrrfxf.exe 38 PID 1536 wrote to memory of 2620 1536 rfrrfxf.exe 38 PID 2620 wrote to memory of 2696 2620 pjdpv.exe 39 PID 2620 wrote to memory of 2696 2620 pjdpv.exe 39 PID 2620 wrote to memory of 2696 2620 pjdpv.exe 39 PID 2620 wrote to memory of 2696 2620 pjdpv.exe 39 PID 2696 wrote to memory of 2512 2696 jvjdj.exe 40 PID 2696 wrote to memory of 2512 2696 jvjdj.exe 40 PID 2696 wrote to memory of 2512 2696 jvjdj.exe 40 PID 2696 wrote to memory of 2512 2696 jvjdj.exe 40 PID 2512 wrote to memory of 2880 2512 lfrlrrx.exe 41 PID 2512 wrote to memory of 2880 2512 lfrlrrx.exe 41 PID 2512 wrote to memory of 2880 2512 lfrlrrx.exe 41 PID 2512 wrote to memory of 2880 2512 lfrlrrx.exe 41 PID 2880 wrote to memory of 680 2880 bthhhb.exe 42 PID 2880 wrote to memory of 680 2880 bthhhb.exe 42 PID 2880 wrote to memory of 680 2880 bthhhb.exe 42 PID 2880 wrote to memory of 680 2880 bthhhb.exe 42 PID 680 wrote to memory of 2364 680 pjddv.exe 43 PID 680 wrote to memory of 2364 680 pjddv.exe 43 PID 680 wrote to memory of 2364 680 pjddv.exe 43 PID 680 wrote to memory of 2364 680 pjddv.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\e658cb75b345b3d2c305584cf1ffcf89d973e1c38dbba453dd4a542fbe3a0658.exe"C:\Users\Admin\AppData\Local\Temp\e658cb75b345b3d2c305584cf1ffcf89d973e1c38dbba453dd4a542fbe3a0658.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\5frlffl.exec:\5frlffl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\htbttt.exec:\htbttt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\dvjvj.exec:\dvjvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\dpjjv.exec:\dpjjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\xrxxfff.exec:\xrxxfff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\1lxxfrx.exec:\1lxxfrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\nhhhbb.exec:\nhhhbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\ddpvj.exec:\ddpvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\vdpvv.exec:\vdpvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\rfrrfxf.exec:\rfrrfxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\pjdpv.exec:\pjdpv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\jvjdj.exec:\jvjdj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\lfrlrrx.exec:\lfrlrrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\bthhhb.exec:\bthhhb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\pjddv.exec:\pjddv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:680 -
\??\c:\xxflrlx.exec:\xxflrlx.exe17⤵
- Executes dropped EXE
PID:2364 -
\??\c:\1xlfxrr.exec:\1xlfxrr.exe18⤵
- Executes dropped EXE
PID:1044 -
\??\c:\hbhbbt.exec:\hbhbbt.exe19⤵
- Executes dropped EXE
PID:1424 -
\??\c:\5vpvd.exec:\5vpvd.exe20⤵
- Executes dropped EXE
PID:2212 -
\??\c:\xrxflfl.exec:\xrxflfl.exe21⤵
- Executes dropped EXE
PID:2004 -
\??\c:\1vvvv.exec:\1vvvv.exe22⤵
- Executes dropped EXE
PID:2340 -
\??\c:\7lflllx.exec:\7lflllx.exe23⤵
- Executes dropped EXE
PID:2724 -
\??\c:\3bttbt.exec:\3bttbt.exe24⤵
- Executes dropped EXE
PID:2760 -
\??\c:\5jddd.exec:\5jddd.exe25⤵
- Executes dropped EXE
PID:1808 -
\??\c:\9rxlrlr.exec:\9rxlrlr.exe26⤵
- Executes dropped EXE
PID:352 -
\??\c:\btbbnn.exec:\btbbnn.exe27⤵
- Executes dropped EXE
PID:2748 -
\??\c:\pdvjp.exec:\pdvjp.exe28⤵
- Executes dropped EXE
PID:616 -
\??\c:\xrffrrx.exec:\xrffrrx.exe29⤵
- Executes dropped EXE
PID:2100 -
\??\c:\nbthtb.exec:\nbthtb.exe30⤵
- Executes dropped EXE
PID:2960 -
\??\c:\9htbtn.exec:\9htbtn.exe31⤵
- Executes dropped EXE
PID:1500 -
\??\c:\jdvdd.exec:\jdvdd.exe32⤵
- Executes dropped EXE
PID:3024 -
\??\c:\7rfxrlf.exec:\7rfxrlf.exe33⤵
- Executes dropped EXE
PID:2392 -
\??\c:\rxlfffl.exec:\rxlfffl.exe34⤵
- Executes dropped EXE
PID:2908 -
\??\c:\btnttt.exec:\btnttt.exe35⤵
- Executes dropped EXE
PID:2316 -
\??\c:\pjvvd.exec:\pjvvd.exe36⤵
- Executes dropped EXE
PID:1644 -
\??\c:\xrllrrr.exec:\xrllrrr.exe37⤵
- Executes dropped EXE
PID:1628 -
\??\c:\9frrlll.exec:\9frrlll.exe38⤵
- Executes dropped EXE
PID:2384 -
\??\c:\ntbtth.exec:\ntbtth.exe39⤵
- Executes dropped EXE
PID:1856 -
\??\c:\pdppp.exec:\pdppp.exe40⤵
- Executes dropped EXE
PID:2308 -
\??\c:\xrfxxxf.exec:\xrfxxxf.exe41⤵
- Executes dropped EXE
PID:2200 -
\??\c:\rxrlfxf.exec:\rxrlfxf.exe42⤵
- Executes dropped EXE
PID:2324 -
\??\c:\hntttn.exec:\hntttn.exe43⤵
- Executes dropped EXE
PID:3036 -
\??\c:\hbnntt.exec:\hbnntt.exe44⤵
- Executes dropped EXE
PID:2568 -
\??\c:\7pppp.exec:\7pppp.exe45⤵
- Executes dropped EXE
PID:2704 -
\??\c:\pjjdj.exec:\pjjdj.exe46⤵
- Executes dropped EXE
PID:2584 -
\??\c:\frrlrrx.exec:\frrlrrx.exe47⤵
- Executes dropped EXE
PID:2572 -
\??\c:\thnhht.exec:\thnhht.exe48⤵
- Executes dropped EXE
PID:2460 -
\??\c:\thtthh.exec:\thtthh.exe49⤵
- Executes dropped EXE
PID:864 -
\??\c:\jvdvp.exec:\jvdvp.exe50⤵
- Executes dropped EXE
PID:1844 -
\??\c:\5lrrrlx.exec:\5lrrrlx.exe51⤵
- Executes dropped EXE
PID:2688 -
\??\c:\1flfxxf.exec:\1flfxxf.exe52⤵
- Executes dropped EXE
PID:1244 -
\??\c:\9hnnnn.exec:\9hnnnn.exe53⤵
- Executes dropped EXE
PID:1440 -
\??\c:\3thbhb.exec:\3thbhb.exe54⤵
- Executes dropped EXE
PID:1560 -
\??\c:\vppjj.exec:\vppjj.exe55⤵
- Executes dropped EXE
PID:2352 -
\??\c:\vpddd.exec:\vpddd.exe56⤵
- Executes dropped EXE
PID:2016 -
\??\c:\rfrrrrr.exec:\rfrrrrr.exe57⤵
- Executes dropped EXE
PID:2456 -
\??\c:\xflxxrr.exec:\xflxxrr.exe58⤵
- Executes dropped EXE
PID:1264 -
\??\c:\1tthhb.exec:\1tthhb.exe59⤵
- Executes dropped EXE
PID:2276 -
\??\c:\thnnnh.exec:\thnnnh.exe60⤵
- Executes dropped EXE
PID:2372 -
\??\c:\dppjd.exec:\dppjd.exe61⤵
- Executes dropped EXE
PID:2424 -
\??\c:\djpjj.exec:\djpjj.exe62⤵
- Executes dropped EXE
PID:1604 -
\??\c:\rfrxxxf.exec:\rfrxxxf.exe63⤵
- Executes dropped EXE
PID:2036 -
\??\c:\bhnnnh.exec:\bhnnnh.exe64⤵
- Executes dropped EXE
PID:284 -
\??\c:\1hnhhn.exec:\1hnhhn.exe65⤵
- Executes dropped EXE
PID:572 -
\??\c:\dpdvp.exec:\dpdvp.exe66⤵PID:352
-
\??\c:\jvpjp.exec:\jvpjp.exe67⤵PID:652
-
\??\c:\rfxxfxl.exec:\rfxxfxl.exe68⤵PID:316
-
\??\c:\lxrrxxx.exec:\lxrrxxx.exe69⤵PID:2980
-
\??\c:\thhhhh.exec:\thhhhh.exe70⤵PID:1672
-
\??\c:\bnbtnn.exec:\bnbtnn.exe71⤵PID:2120
-
\??\c:\pdpjj.exec:\pdpjj.exe72⤵PID:1500
-
\??\c:\rlxrlfr.exec:\rlxrlfr.exe73⤵PID:3024
-
\??\c:\rrxxxff.exec:\rrxxxff.exe74⤵PID:2844
-
\??\c:\5httbh.exec:\5httbh.exe75⤵PID:2848
-
\??\c:\bbnnbb.exec:\bbnnbb.exe76⤵PID:2908
-
\??\c:\3ddjd.exec:\3ddjd.exe77⤵PID:2316
-
\??\c:\jjddj.exec:\jjddj.exe78⤵PID:2904
-
\??\c:\lxlrxxx.exec:\lxlrxxx.exe79⤵PID:2256
-
\??\c:\llfrxlr.exec:\llfrxlr.exe80⤵PID:1660
-
\??\c:\bnhhnt.exec:\bnhhnt.exe81⤵PID:1704
-
\??\c:\7nhhtt.exec:\7nhhtt.exe82⤵PID:1144
-
\??\c:\9vvvd.exec:\9vvvd.exe83⤵PID:2784
-
\??\c:\dpdjp.exec:\dpdjp.exe84⤵PID:2200
-
\??\c:\lxllrrf.exec:\lxllrrf.exe85⤵PID:2196
-
\??\c:\7rlrxfr.exec:\7rlrxfr.exe86⤵PID:2628
-
\??\c:\bhnnhh.exec:\bhnnhh.exe87⤵PID:2932
-
\??\c:\jpjvv.exec:\jpjvv.exe88⤵PID:2444
-
\??\c:\1jdjp.exec:\1jdjp.exe89⤵PID:2664
-
\??\c:\lxxfllx.exec:\lxxfllx.exe90⤵
- System Location Discovery: System Language Discovery
PID:1536 -
\??\c:\rfxlrrr.exec:\rfxlrrr.exe91⤵PID:2440
-
\??\c:\bbnbth.exec:\bbnbth.exe92⤵PID:1900
-
\??\c:\7hbtbt.exec:\7hbtbt.exe93⤵PID:2800
-
\??\c:\pjvdp.exec:\pjvdp.exe94⤵PID:2380
-
\??\c:\xxfrrrf.exec:\xxfrrrf.exe95⤵PID:1844
-
\??\c:\htbbbt.exec:\htbbbt.exe96⤵PID:2688
-
\??\c:\xrlfrxl.exec:\xrlfrxl.exe97⤵PID:2576
-
\??\c:\xllxflr.exec:\xllxflr.exe98⤵PID:2240
-
\??\c:\bnbhnt.exec:\bnbhnt.exe99⤵PID:1044
-
\??\c:\9dvvp.exec:\9dvvp.exe100⤵PID:464
-
\??\c:\nbttbb.exec:\nbttbb.exe101⤵PID:2212
-
\??\c:\1nbhhn.exec:\1nbhhn.exe102⤵PID:2000
-
\??\c:\3jpjp.exec:\3jpjp.exe103⤵PID:2368
-
\??\c:\fxlfxrx.exec:\fxlfxrx.exe104⤵PID:1276
-
\??\c:\lxfxrrx.exec:\lxfxrrx.exe105⤵PID:2780
-
\??\c:\bbthtt.exec:\bbthtt.exe106⤵PID:2772
-
\??\c:\1vvpp.exec:\1vvpp.exe107⤵PID:2852
-
\??\c:\jddjj.exec:\jddjj.exe108⤵PID:1268
-
\??\c:\httnnt.exec:\httnnt.exe109⤵PID:440
-
\??\c:\thtbtt.exec:\thtbtt.exe110⤵PID:2736
-
\??\c:\5jvvv.exec:\5jvvv.exe111⤵PID:1732
-
\??\c:\jvjpp.exec:\jvjpp.exe112⤵PID:1792
-
\??\c:\7fllrxf.exec:\7fllrxf.exe113⤵PID:1552
-
\??\c:\9hnhnh.exec:\9hnhnh.exe114⤵PID:3020
-
\??\c:\vvvdd.exec:\vvvdd.exe115⤵PID:1184
-
\??\c:\frfrxff.exec:\frfrxff.exe116⤵PID:1436
-
\??\c:\lfrxxxr.exec:\lfrxxxr.exe117⤵PID:1904
-
\??\c:\7tbhnt.exec:\7tbhnt.exe118⤵PID:2856
-
\??\c:\vpppv.exec:\vpppv.exe119⤵PID:1020
-
\??\c:\9ddvv.exec:\9ddvv.exe120⤵PID:2832
-
\??\c:\lfxrrrl.exec:\lfxrrrl.exe121⤵
- System Location Discovery: System Language Discovery
PID:1520
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-