Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 11:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7c2b46f50968a84485d51357c6c87f94bc69a6ab5f75927aef308c032b07fa02N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
7c2b46f50968a84485d51357c6c87f94bc69a6ab5f75927aef308c032b07fa02N.exe
-
Size
454KB
-
MD5
5db897e4c7d22614fd9383802f491330
-
SHA1
8bff6c547acac65881a8525109c7cf119b4219d9
-
SHA256
7c2b46f50968a84485d51357c6c87f94bc69a6ab5f75927aef308c032b07fa02
-
SHA512
0cd5f773ee55a79b4b99408e714140aa92752117d6b67b026391fe9c548b5e0d58688fb7eaff2d9974dbf8c213dcfeeef005c690c3cfade0eccb14818b4eac5b
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbet:q7Tc2NYHUrAwfMp3CDt
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/2444-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2196-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2316-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2100-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3040-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2948-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1348-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-94-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2640-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-103-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2640-108-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2296-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1288-123-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1288-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1180-133-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2472-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2180-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-193-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2104-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/496-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1144-233-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1680-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1680-256-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1928-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3060-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3060-266-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2916-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1200-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1288-426-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-446-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-447-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2256-460-0x0000000001C80000-0x0000000001CAA000-memory.dmp family_blackmoon behavioral1/memory/2096-486-0x00000000001C0000-0x00000000001EA000-memory.dmp family_blackmoon behavioral1/memory/3068-501-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-500-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1712-522-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/236-529-0x00000000001C0000-0x00000000001EA000-memory.dmp family_blackmoon behavioral1/memory/236-549-0x00000000001C0000-0x00000000001EA000-memory.dmp family_blackmoon behavioral1/memory/2252-593-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1628-613-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2148-763-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-771-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-778-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-785-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2196 dpjvd.exe 2316 tthhhh.exe 2568 pjvjd.exe 2100 jpvdp.exe 3040 ddvvd.exe 2948 ddpvj.exe 2968 hbbnhb.exe 1348 1vvdp.exe 2796 xxxflrf.exe 2640 bbntnn.exe 2296 jpvpv.exe 1288 dvppv.exe 1180 jjvdp.exe 2472 3pddd.exe 2872 vddpj.exe 2708 ntntnb.exe 3016 djvdj.exe 2180 ppjjd.exe 2344 7pvvp.exe 2104 7pjpj.exe 496 9rrrflx.exe 1920 dvpdd.exe 304 3pjpd.exe 1144 tttttt.exe 1552 vvppv.exe 1680 hhnbhn.exe 3060 jddjv.exe 1928 3rlrlrx.exe 2536 5hhnnt.exe 1796 9btnhn.exe 2412 jjjjd.exe 2292 ttnbnt.exe 1588 7ttnnb.exe 2284 dpddj.exe 2328 5ffffrx.exe 1748 nhbnhb.exe 2484 jjdjv.exe 580 rrlfllr.exe 2920 1lfflrx.exe 2916 bhbbnt.exe 2752 bbntnn.exe 2648 jjdjd.exe 1396 ffxflrx.exe 2612 9bttnt.exe 2696 tthntt.exe 2404 jdvvp.exe 1028 7xxrflx.exe 1200 fxrxffr.exe 1288 tnthnt.exe 2992 jjddj.exe 1996 xfxxlrl.exe 2836 flxrfrx.exe 2604 thtttt.exe 2256 jjjjv.exe 2832 jddjp.exe 1936 3xffflr.exe 2368 bhtbhh.exe 2096 nntbnt.exe 2248 pjpvp.exe 3068 xllxlrl.exe 708 hbnntt.exe 1088 pjdjp.exe 1712 dddjv.exe 236 5rrxfrr.exe -
resource yara_rule behavioral1/memory/2444-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-76-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/1348-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-94-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2640-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-96-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1288-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1288-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-160-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2180-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/496-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1928-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1200-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1288-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-446-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-479-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-486-0x00000000001C0000-0x00000000001EA000-memory.dmp upx behavioral1/memory/2248-487-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-501-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1088-508-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-522-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/912-530-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/556-562-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-632-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-663-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-763-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-764-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-771-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-778-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-785-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-792-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/596-823-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-848-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1548-867-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ttthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrffffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttttbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrxxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfflll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rflrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lxrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ttntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnthnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2444 wrote to memory of 2196 2444 7c2b46f50968a84485d51357c6c87f94bc69a6ab5f75927aef308c032b07fa02N.exe 30 PID 2444 wrote to memory of 2196 2444 7c2b46f50968a84485d51357c6c87f94bc69a6ab5f75927aef308c032b07fa02N.exe 30 PID 2444 wrote to memory of 2196 2444 7c2b46f50968a84485d51357c6c87f94bc69a6ab5f75927aef308c032b07fa02N.exe 30 PID 2444 wrote to memory of 2196 2444 7c2b46f50968a84485d51357c6c87f94bc69a6ab5f75927aef308c032b07fa02N.exe 30 PID 2196 wrote to memory of 2316 2196 dpjvd.exe 31 PID 2196 wrote to memory of 2316 2196 dpjvd.exe 31 PID 2196 wrote to memory of 2316 2196 dpjvd.exe 31 PID 2196 wrote to memory of 2316 2196 dpjvd.exe 31 PID 2316 wrote to memory of 2568 2316 tthhhh.exe 32 PID 2316 wrote to memory of 2568 2316 tthhhh.exe 32 PID 2316 wrote to memory of 2568 2316 tthhhh.exe 32 PID 2316 wrote to memory of 2568 2316 tthhhh.exe 32 PID 2568 wrote to memory of 2100 2568 pjvjd.exe 33 PID 2568 wrote to memory of 2100 2568 pjvjd.exe 33 PID 2568 wrote to memory of 2100 2568 pjvjd.exe 33 PID 2568 wrote to memory of 2100 2568 pjvjd.exe 33 PID 2100 wrote to memory of 3040 2100 jpvdp.exe 34 PID 2100 wrote to memory of 3040 2100 jpvdp.exe 34 PID 2100 wrote to memory of 3040 2100 jpvdp.exe 34 PID 2100 wrote to memory of 3040 2100 jpvdp.exe 34 PID 3040 wrote to memory of 2948 3040 ddvvd.exe 35 PID 3040 wrote to memory of 2948 3040 ddvvd.exe 35 PID 3040 wrote to memory of 2948 3040 ddvvd.exe 35 PID 3040 wrote to memory of 2948 3040 ddvvd.exe 35 PID 2948 wrote to memory of 2968 2948 ddpvj.exe 36 PID 2948 wrote to memory of 2968 2948 ddpvj.exe 36 PID 2948 wrote to memory of 2968 2948 ddpvj.exe 36 PID 2948 wrote to memory of 2968 2948 ddpvj.exe 36 PID 2968 wrote to memory of 1348 2968 hbbnhb.exe 37 PID 2968 wrote to memory of 1348 2968 hbbnhb.exe 37 PID 2968 wrote to memory of 1348 2968 hbbnhb.exe 37 PID 2968 wrote to memory of 1348 2968 hbbnhb.exe 37 PID 1348 wrote to memory of 2796 1348 1vvdp.exe 38 PID 1348 wrote to memory of 2796 1348 1vvdp.exe 38 PID 1348 wrote to memory of 2796 1348 1vvdp.exe 38 PID 1348 wrote to memory of 2796 1348 1vvdp.exe 38 PID 2796 wrote to memory of 2640 2796 xxxflrf.exe 39 PID 2796 wrote to memory of 2640 2796 xxxflrf.exe 39 PID 2796 wrote to memory of 2640 2796 xxxflrf.exe 39 PID 2796 wrote to memory of 2640 2796 xxxflrf.exe 39 PID 2640 wrote to memory of 2296 2640 bbntnn.exe 40 PID 2640 wrote to memory of 2296 2640 bbntnn.exe 40 PID 2640 wrote to memory of 2296 2640 bbntnn.exe 40 PID 2640 wrote to memory of 2296 2640 bbntnn.exe 40 PID 2296 wrote to memory of 1288 2296 jpvpv.exe 41 PID 2296 wrote to memory of 1288 2296 jpvpv.exe 41 PID 2296 wrote to memory of 1288 2296 jpvpv.exe 41 PID 2296 wrote to memory of 1288 2296 jpvpv.exe 41 PID 1288 wrote to memory of 1180 1288 dvppv.exe 42 PID 1288 wrote to memory of 1180 1288 dvppv.exe 42 PID 1288 wrote to memory of 1180 1288 dvppv.exe 42 PID 1288 wrote to memory of 1180 1288 dvppv.exe 42 PID 1180 wrote to memory of 2472 1180 jjvdp.exe 43 PID 1180 wrote to memory of 2472 1180 jjvdp.exe 43 PID 1180 wrote to memory of 2472 1180 jjvdp.exe 43 PID 1180 wrote to memory of 2472 1180 jjvdp.exe 43 PID 2472 wrote to memory of 2872 2472 3pddd.exe 44 PID 2472 wrote to memory of 2872 2472 3pddd.exe 44 PID 2472 wrote to memory of 2872 2472 3pddd.exe 44 PID 2472 wrote to memory of 2872 2472 3pddd.exe 44 PID 2872 wrote to memory of 2708 2872 vddpj.exe 45 PID 2872 wrote to memory of 2708 2872 vddpj.exe 45 PID 2872 wrote to memory of 2708 2872 vddpj.exe 45 PID 2872 wrote to memory of 2708 2872 vddpj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c2b46f50968a84485d51357c6c87f94bc69a6ab5f75927aef308c032b07fa02N.exe"C:\Users\Admin\AppData\Local\Temp\7c2b46f50968a84485d51357c6c87f94bc69a6ab5f75927aef308c032b07fa02N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\dpjvd.exec:\dpjvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\tthhhh.exec:\tthhhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\pjvjd.exec:\pjvjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\jpvdp.exec:\jpvdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\ddvvd.exec:\ddvvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\ddpvj.exec:\ddpvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\hbbnhb.exec:\hbbnhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\1vvdp.exec:\1vvdp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
\??\c:\xxxflrf.exec:\xxxflrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\bbntnn.exec:\bbntnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\jpvpv.exec:\jpvpv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\dvppv.exec:\dvppv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
\??\c:\jjvdp.exec:\jjvdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
\??\c:\3pddd.exec:\3pddd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\vddpj.exec:\vddpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\ntntnb.exec:\ntntnb.exe17⤵
- Executes dropped EXE
PID:2708 -
\??\c:\djvdj.exec:\djvdj.exe18⤵
- Executes dropped EXE
PID:3016 -
\??\c:\ppjjd.exec:\ppjjd.exe19⤵
- Executes dropped EXE
PID:2180 -
\??\c:\7pvvp.exec:\7pvvp.exe20⤵
- Executes dropped EXE
PID:2344 -
\??\c:\7pjpj.exec:\7pjpj.exe21⤵
- Executes dropped EXE
PID:2104 -
\??\c:\9rrrflx.exec:\9rrrflx.exe22⤵
- Executes dropped EXE
PID:496 -
\??\c:\dvpdd.exec:\dvpdd.exe23⤵
- Executes dropped EXE
PID:1920 -
\??\c:\3pjpd.exec:\3pjpd.exe24⤵
- Executes dropped EXE
PID:304 -
\??\c:\tttttt.exec:\tttttt.exe25⤵
- Executes dropped EXE
PID:1144 -
\??\c:\vvppv.exec:\vvppv.exe26⤵
- Executes dropped EXE
PID:1552 -
\??\c:\hhnbhn.exec:\hhnbhn.exe27⤵
- Executes dropped EXE
PID:1680 -
\??\c:\jddjv.exec:\jddjv.exe28⤵
- Executes dropped EXE
PID:3060 -
\??\c:\3rlrlrx.exec:\3rlrlrx.exe29⤵
- Executes dropped EXE
PID:1928 -
\??\c:\5hhnnt.exec:\5hhnnt.exe30⤵
- Executes dropped EXE
PID:2536 -
\??\c:\9btnhn.exec:\9btnhn.exe31⤵
- Executes dropped EXE
PID:1796 -
\??\c:\jjjjd.exec:\jjjjd.exe32⤵
- Executes dropped EXE
PID:2412 -
\??\c:\ttnbnt.exec:\ttnbnt.exe33⤵
- Executes dropped EXE
PID:2292 -
\??\c:\7ttnnb.exec:\7ttnnb.exe34⤵
- Executes dropped EXE
PID:1588 -
\??\c:\dpddj.exec:\dpddj.exe35⤵
- Executes dropped EXE
PID:2284 -
\??\c:\5ffffrx.exec:\5ffffrx.exe36⤵
- Executes dropped EXE
PID:2328 -
\??\c:\nhbnhb.exec:\nhbnhb.exe37⤵
- Executes dropped EXE
PID:1748 -
\??\c:\jjdjv.exec:\jjdjv.exe38⤵
- Executes dropped EXE
PID:2484 -
\??\c:\rrlfllr.exec:\rrlfllr.exe39⤵
- Executes dropped EXE
PID:580 -
\??\c:\1lfflrx.exec:\1lfflrx.exe40⤵
- Executes dropped EXE
PID:2920 -
\??\c:\bhbbnt.exec:\bhbbnt.exe41⤵
- Executes dropped EXE
PID:2916 -
\??\c:\bbntnn.exec:\bbntnn.exe42⤵
- Executes dropped EXE
PID:2752 -
\??\c:\jjdjd.exec:\jjdjd.exe43⤵
- Executes dropped EXE
PID:2648 -
\??\c:\ffxflrx.exec:\ffxflrx.exe44⤵
- Executes dropped EXE
PID:1396 -
\??\c:\9bttnt.exec:\9bttnt.exe45⤵
- Executes dropped EXE
PID:2612 -
\??\c:\tthntt.exec:\tthntt.exe46⤵
- Executes dropped EXE
PID:2696 -
\??\c:\jdvvp.exec:\jdvvp.exe47⤵
- Executes dropped EXE
PID:2404 -
\??\c:\7xxrflx.exec:\7xxrflx.exe48⤵
- Executes dropped EXE
PID:1028 -
\??\c:\fxrxffr.exec:\fxrxffr.exe49⤵
- Executes dropped EXE
PID:1200 -
\??\c:\tnthnt.exec:\tnthnt.exe50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1288 -
\??\c:\jjddj.exec:\jjddj.exe51⤵
- Executes dropped EXE
PID:2992 -
\??\c:\xfxxlrl.exec:\xfxxlrl.exe52⤵
- Executes dropped EXE
PID:1996 -
\??\c:\flxrfrx.exec:\flxrfrx.exe53⤵
- Executes dropped EXE
PID:2836 -
\??\c:\thtttt.exec:\thtttt.exe54⤵
- Executes dropped EXE
PID:2604 -
\??\c:\jjjjv.exec:\jjjjv.exe55⤵
- Executes dropped EXE
PID:2256 -
\??\c:\jddjp.exec:\jddjp.exe56⤵
- Executes dropped EXE
PID:2832 -
\??\c:\3xffflr.exec:\3xffflr.exe57⤵
- Executes dropped EXE
PID:1936 -
\??\c:\bhtbhh.exec:\bhtbhh.exe58⤵
- Executes dropped EXE
PID:2368 -
\??\c:\nntbnt.exec:\nntbnt.exe59⤵
- Executes dropped EXE
PID:2096 -
\??\c:\pjpvp.exec:\pjpvp.exe60⤵
- Executes dropped EXE
PID:2248 -
\??\c:\xllxlrl.exec:\xllxlrl.exe61⤵
- Executes dropped EXE
PID:3068 -
\??\c:\hbnntt.exec:\hbnntt.exe62⤵
- Executes dropped EXE
PID:708 -
\??\c:\pjdjp.exec:\pjdjp.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1088 -
\??\c:\dddjv.exec:\dddjv.exe64⤵
- Executes dropped EXE
PID:1712 -
\??\c:\5rrxfrr.exec:\5rrxfrr.exe65⤵
- Executes dropped EXE
PID:236 -
\??\c:\tnhntn.exec:\tnhntn.exe66⤵PID:912
-
\??\c:\vvpvp.exec:\vvpvp.exe67⤵PID:952
-
\??\c:\rlxrxxl.exec:\rlxrxxl.exe68⤵PID:2084
-
\??\c:\xlrxlll.exec:\xlrxlll.exe69⤵PID:1784
-
\??\c:\hthntt.exec:\hthntt.exe70⤵PID:2032
-
\??\c:\pjvdp.exec:\pjvdp.exe71⤵PID:556
-
\??\c:\pjvpv.exec:\pjvpv.exe72⤵PID:1688
-
\??\c:\xrllxfr.exec:\xrllxfr.exe73⤵PID:888
-
\??\c:\3tnhnn.exec:\3tnhnn.exe74⤵PID:1796
-
\??\c:\5nhhhh.exec:\5nhhhh.exe75⤵PID:2252
-
\??\c:\1ppvp.exec:\1ppvp.exe76⤵PID:2280
-
\??\c:\rfrflrx.exec:\rfrflrx.exe77⤵PID:2564
-
\??\c:\rrlxrxr.exec:\rrlxrxr.exe78⤵PID:1628
-
\??\c:\nhttbh.exec:\nhttbh.exe79⤵PID:3028
-
\??\c:\jpjvv.exec:\jpjvv.exe80⤵PID:1044
-
\??\c:\dvjjp.exec:\dvjjp.exe81⤵PID:2900
-
\??\c:\frlxlxl.exec:\frlxlxl.exe82⤵PID:2912
-
\??\c:\bhbhtb.exec:\bhbhtb.exe83⤵PID:3040
-
\??\c:\ddppd.exec:\ddppd.exe84⤵PID:2956
-
\??\c:\vvvjp.exec:\vvvjp.exe85⤵PID:2784
-
\??\c:\5flflrl.exec:\5flflrl.exe86⤵PID:2660
-
\??\c:\hnhnth.exec:\hnhnth.exe87⤵PID:2676
-
\??\c:\1htnbh.exec:\1htnbh.exe88⤵PID:2796
-
\??\c:\jjdpd.exec:\jjdpd.exe89⤵PID:2160
-
\??\c:\frfflrl.exec:\frfflrl.exe90⤵PID:2696
-
\??\c:\btnhbn.exec:\btnhbn.exe91⤵PID:2296
-
\??\c:\nhbnhb.exec:\nhbnhb.exe92⤵PID:2020
-
\??\c:\3jjjj.exec:\3jjjj.exe93⤵PID:2940
-
\??\c:\dvjpp.exec:\dvjpp.exe94⤵PID:1332
-
\??\c:\3xfrflr.exec:\3xfrflr.exe95⤵PID:2848
-
\??\c:\hbnttt.exec:\hbnttt.exe96⤵PID:2952
-
\??\c:\1bthht.exec:\1bthht.exe97⤵PID:2988
-
\??\c:\3jvjj.exec:\3jvjj.exe98⤵PID:2008
-
\??\c:\xlrlxrr.exec:\xlrlxrr.exe99⤵PID:1880
-
\??\c:\tttbtt.exec:\tttbtt.exe100⤵PID:2184
-
\??\c:\hbntbb.exec:\hbntbb.exe101⤵PID:2372
-
\??\c:\vvjvd.exec:\vvjvd.exe102⤵PID:2148
-
\??\c:\dpdvv.exec:\dpdvv.exe103⤵PID:2816
-
\??\c:\5xlllrx.exec:\5xlllrx.exe104⤵PID:2596
-
\??\c:\tntntn.exec:\tntntn.exe105⤵PID:2504
-
\??\c:\7pddp.exec:\7pddp.exe106⤵PID:2424
-
\??\c:\pdvvv.exec:\pdvvv.exe107⤵PID:2024
-
\??\c:\fxlrllf.exec:\fxlrllf.exe108⤵PID:1876
-
\??\c:\1thhnt.exec:\1thhnt.exe109⤵PID:2156
-
\??\c:\tnnbtb.exec:\tnnbtb.exe110⤵PID:276
-
\??\c:\jjdjv.exec:\jjdjv.exe111⤵PID:2276
-
\??\c:\vpddj.exec:\vpddj.exe112⤵PID:596
-
\??\c:\1rxxrrr.exec:\1rxxrrr.exe113⤵PID:1172
-
\??\c:\5bnntt.exec:\5bnntt.exe114⤵PID:2588
-
\??\c:\hhhthh.exec:\hhhthh.exe115⤵PID:536
-
\??\c:\9vvvj.exec:\9vvvj.exe116⤵PID:1732
-
\??\c:\rlfrxxx.exec:\rlfrxxx.exe117⤵PID:1872
-
\??\c:\lxrxlrf.exec:\lxrxlrf.exe118⤵PID:2192
-
\??\c:\nbnntn.exec:\nbnntn.exe119⤵PID:1548
-
\??\c:\7vvpv.exec:\7vvpv.exe120⤵PID:1124
-
\??\c:\lxrrrlr.exec:\lxrrrlr.exe121⤵PID:2552
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-