Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 15:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5a31f7bd447684b6ac25c80cbf9ae5b2e9de8bc31fc4d3de7f8845ac54f2ca2b.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
5a31f7bd447684b6ac25c80cbf9ae5b2e9de8bc31fc4d3de7f8845ac54f2ca2b.exe
-
Size
454KB
-
MD5
71d15315b7e75d78da8bbc4bfc2daef2
-
SHA1
b69b8df734ed6321c5be9d9d6b570727e94a9df7
-
SHA256
5a31f7bd447684b6ac25c80cbf9ae5b2e9de8bc31fc4d3de7f8845ac54f2ca2b
-
SHA512
51584613d82ba8d0fe83b61ab0933a31cf40370978f96c997eae1cae2cc2fb36146194ddcded50a9aa5c1433f7b488a6f4c84e4e8e9fd77c5b2d9986345c3a65
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAber:q7Tc2NYHUrAwfMp3CDr
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/2176-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2528-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1624-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2452-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1592-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-98-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2456-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2432-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1748-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-181-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2288-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/788-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/836-209-0x0000000000260000-0x000000000028A000-memory.dmp family_blackmoon behavioral1/memory/448-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1540-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1792-246-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2888-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2096-260-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2096-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2148-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-432-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-431-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2780-439-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1284-446-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-536-0x0000000001C70000-0x0000000001C9A000-memory.dmp family_blackmoon behavioral1/memory/2556-574-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2428-691-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1896-710-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1756-725-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2060-737-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1112-794-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2752-899-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-979-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1712 jvppv.exe 2528 rfllffr.exe 2452 hhbhht.exe 1624 ppjjv.exe 2824 lfxxrlx.exe 1592 9djpv.exe 2720 lffrxfr.exe 2704 jdppd.exe 2788 3xrllrx.exe 2680 5rffxxx.exe 2456 ppjjv.exe 1132 fxllrrf.exe 1828 djdpv.exe 2432 3httbn.exe 2920 jjppv.exe 2844 rfllrll.exe 1748 htttnh.exe 1840 xlflxxl.exe 3004 thnntt.exe 2288 jvddj.exe 788 lxffxxx.exe 836 hbnntb.exe 448 pjpvv.exe 1540 bthhnt.exe 2888 htbnht.exe 1792 7jddp.exe 2116 hbhttn.exe 2096 9rxlfxx.exe 1816 xrlllfr.exe 1672 xrflrrx.exe 532 5flffxf.exe 1892 1djpp.exe 356 dpdvv.exe 1268 hbhhnt.exe 2876 thnntn.exe 2328 dpjpp.exe 444 frflxlr.exe 2156 3lrxllr.exe 2860 tnbntn.exe 2752 vdjjj.exe 2148 1djpv.exe 2840 lxlfrrr.exe 2904 7nbhnn.exe 2676 bbhbtt.exe 2716 vppjp.exe 1292 9fxrxxl.exe 1160 htbtbn.exe 1132 nbhbbh.exe 2928 pjpdv.exe 1716 djvjd.exe 2692 frffxxx.exe 2892 tnhnbb.exe 2780 5tbthb.exe 1284 jdpdv.exe 2016 lfrllfr.exe 2988 thbbhh.exe 2204 vjjdd.exe 316 vjvdj.exe 1152 rflrlff.exe 2332 thtnnn.exe 3068 hbnnbb.exe 948 dpddd.exe 1604 xrllllr.exe 1540 hbbnbh.exe -
resource yara_rule behavioral1/memory/2176-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1840-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/788-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/836-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/448-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1540-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1540-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1816-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1268-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1292-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1284-446-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-477-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/948-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1540-503-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1520-516-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-523-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-574-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/540-601-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-614-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-656-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1756-725-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/2060-730-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1508-751-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-880-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-899-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-900-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-913-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/236-1027-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrrxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbttbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lxrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lrfxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lffrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lxfffl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2176 wrote to memory of 1712 2176 5a31f7bd447684b6ac25c80cbf9ae5b2e9de8bc31fc4d3de7f8845ac54f2ca2b.exe 30 PID 2176 wrote to memory of 1712 2176 5a31f7bd447684b6ac25c80cbf9ae5b2e9de8bc31fc4d3de7f8845ac54f2ca2b.exe 30 PID 2176 wrote to memory of 1712 2176 5a31f7bd447684b6ac25c80cbf9ae5b2e9de8bc31fc4d3de7f8845ac54f2ca2b.exe 30 PID 2176 wrote to memory of 1712 2176 5a31f7bd447684b6ac25c80cbf9ae5b2e9de8bc31fc4d3de7f8845ac54f2ca2b.exe 30 PID 1712 wrote to memory of 2528 1712 jvppv.exe 31 PID 1712 wrote to memory of 2528 1712 jvppv.exe 31 PID 1712 wrote to memory of 2528 1712 jvppv.exe 31 PID 1712 wrote to memory of 2528 1712 jvppv.exe 31 PID 2528 wrote to memory of 2452 2528 rfllffr.exe 32 PID 2528 wrote to memory of 2452 2528 rfllffr.exe 32 PID 2528 wrote to memory of 2452 2528 rfllffr.exe 32 PID 2528 wrote to memory of 2452 2528 rfllffr.exe 32 PID 2452 wrote to memory of 1624 2452 hhbhht.exe 33 PID 2452 wrote to memory of 1624 2452 hhbhht.exe 33 PID 2452 wrote to memory of 1624 2452 hhbhht.exe 33 PID 2452 wrote to memory of 1624 2452 hhbhht.exe 33 PID 1624 wrote to memory of 2824 1624 ppjjv.exe 34 PID 1624 wrote to memory of 2824 1624 ppjjv.exe 34 PID 1624 wrote to memory of 2824 1624 ppjjv.exe 34 PID 1624 wrote to memory of 2824 1624 ppjjv.exe 34 PID 2824 wrote to memory of 1592 2824 lfxxrlx.exe 35 PID 2824 wrote to memory of 1592 2824 lfxxrlx.exe 35 PID 2824 wrote to memory of 1592 2824 lfxxrlx.exe 35 PID 2824 wrote to memory of 1592 2824 lfxxrlx.exe 35 PID 1592 wrote to memory of 2720 1592 9djpv.exe 36 PID 1592 wrote to memory of 2720 1592 9djpv.exe 36 PID 1592 wrote to memory of 2720 1592 9djpv.exe 36 PID 1592 wrote to memory of 2720 1592 9djpv.exe 36 PID 2720 wrote to memory of 2704 2720 lffrxfr.exe 37 PID 2720 wrote to memory of 2704 2720 lffrxfr.exe 37 PID 2720 wrote to memory of 2704 2720 lffrxfr.exe 37 PID 2720 wrote to memory of 2704 2720 lffrxfr.exe 37 PID 2704 wrote to memory of 2788 2704 jdppd.exe 38 PID 2704 wrote to memory of 2788 2704 jdppd.exe 38 PID 2704 wrote to memory of 2788 2704 jdppd.exe 38 PID 2704 wrote to memory of 2788 2704 jdppd.exe 38 PID 2788 wrote to memory of 2680 2788 3xrllrx.exe 39 PID 2788 wrote to memory of 2680 2788 3xrllrx.exe 39 PID 2788 wrote to memory of 2680 2788 3xrllrx.exe 39 PID 2788 wrote to memory of 2680 2788 3xrllrx.exe 39 PID 2680 wrote to memory of 2456 2680 5rffxxx.exe 40 PID 2680 wrote to memory of 2456 2680 5rffxxx.exe 40 PID 2680 wrote to memory of 2456 2680 5rffxxx.exe 40 PID 2680 wrote to memory of 2456 2680 5rffxxx.exe 40 PID 2456 wrote to memory of 1132 2456 ppjjv.exe 41 PID 2456 wrote to memory of 1132 2456 ppjjv.exe 41 PID 2456 wrote to memory of 1132 2456 ppjjv.exe 41 PID 2456 wrote to memory of 1132 2456 ppjjv.exe 41 PID 1132 wrote to memory of 1828 1132 fxllrrf.exe 42 PID 1132 wrote to memory of 1828 1132 fxllrrf.exe 42 PID 1132 wrote to memory of 1828 1132 fxllrrf.exe 42 PID 1132 wrote to memory of 1828 1132 fxllrrf.exe 42 PID 1828 wrote to memory of 2432 1828 djdpv.exe 43 PID 1828 wrote to memory of 2432 1828 djdpv.exe 43 PID 1828 wrote to memory of 2432 1828 djdpv.exe 43 PID 1828 wrote to memory of 2432 1828 djdpv.exe 43 PID 2432 wrote to memory of 2920 2432 3httbn.exe 44 PID 2432 wrote to memory of 2920 2432 3httbn.exe 44 PID 2432 wrote to memory of 2920 2432 3httbn.exe 44 PID 2432 wrote to memory of 2920 2432 3httbn.exe 44 PID 2920 wrote to memory of 2844 2920 jjppv.exe 45 PID 2920 wrote to memory of 2844 2920 jjppv.exe 45 PID 2920 wrote to memory of 2844 2920 jjppv.exe 45 PID 2920 wrote to memory of 2844 2920 jjppv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a31f7bd447684b6ac25c80cbf9ae5b2e9de8bc31fc4d3de7f8845ac54f2ca2b.exe"C:\Users\Admin\AppData\Local\Temp\5a31f7bd447684b6ac25c80cbf9ae5b2e9de8bc31fc4d3de7f8845ac54f2ca2b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\jvppv.exec:\jvppv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\rfllffr.exec:\rfllffr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\hhbhht.exec:\hhbhht.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\ppjjv.exec:\ppjjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\lfxxrlx.exec:\lfxxrlx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\9djpv.exec:\9djpv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
\??\c:\lffrxfr.exec:\lffrxfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\jdppd.exec:\jdppd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\3xrllrx.exec:\3xrllrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\5rffxxx.exec:\5rffxxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\ppjjv.exec:\ppjjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\fxllrrf.exec:\fxllrrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
\??\c:\djdpv.exec:\djdpv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
\??\c:\3httbn.exec:\3httbn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\jjppv.exec:\jjppv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\rfllrll.exec:\rfllrll.exe17⤵
- Executes dropped EXE
PID:2844 -
\??\c:\htttnh.exec:\htttnh.exe18⤵
- Executes dropped EXE
PID:1748 -
\??\c:\xlflxxl.exec:\xlflxxl.exe19⤵
- Executes dropped EXE
PID:1840 -
\??\c:\thnntt.exec:\thnntt.exe20⤵
- Executes dropped EXE
PID:3004 -
\??\c:\jvddj.exec:\jvddj.exe21⤵
- Executes dropped EXE
PID:2288 -
\??\c:\lxffxxx.exec:\lxffxxx.exe22⤵
- Executes dropped EXE
PID:788 -
\??\c:\hbnntb.exec:\hbnntb.exe23⤵
- Executes dropped EXE
PID:836 -
\??\c:\pjpvv.exec:\pjpvv.exe24⤵
- Executes dropped EXE
PID:448 -
\??\c:\bthhnt.exec:\bthhnt.exe25⤵
- Executes dropped EXE
PID:1540 -
\??\c:\htbnht.exec:\htbnht.exe26⤵
- Executes dropped EXE
PID:2888 -
\??\c:\7jddp.exec:\7jddp.exe27⤵
- Executes dropped EXE
PID:1792 -
\??\c:\hbhttn.exec:\hbhttn.exe28⤵
- Executes dropped EXE
PID:2116 -
\??\c:\9rxlfxx.exec:\9rxlfxx.exe29⤵
- Executes dropped EXE
PID:2096 -
\??\c:\xrlllfr.exec:\xrlllfr.exe30⤵
- Executes dropped EXE
PID:1816 -
\??\c:\xrflrrx.exec:\xrflrrx.exe31⤵
- Executes dropped EXE
PID:1672 -
\??\c:\5flffxf.exec:\5flffxf.exe32⤵
- Executes dropped EXE
PID:532 -
\??\c:\1djpp.exec:\1djpp.exe33⤵
- Executes dropped EXE
PID:1892 -
\??\c:\dpdvv.exec:\dpdvv.exe34⤵
- Executes dropped EXE
PID:356 -
\??\c:\hbhhnt.exec:\hbhhnt.exe35⤵
- Executes dropped EXE
PID:1268 -
\??\c:\thnntn.exec:\thnntn.exe36⤵
- Executes dropped EXE
PID:2876 -
\??\c:\dpjpp.exec:\dpjpp.exe37⤵
- Executes dropped EXE
PID:2328 -
\??\c:\frflxlr.exec:\frflxlr.exe38⤵
- Executes dropped EXE
PID:444 -
\??\c:\3lrxllr.exec:\3lrxllr.exe39⤵
- Executes dropped EXE
PID:2156 -
\??\c:\tnbntn.exec:\tnbntn.exe40⤵
- Executes dropped EXE
PID:2860 -
\??\c:\vdjjj.exec:\vdjjj.exe41⤵
- Executes dropped EXE
PID:2752 -
\??\c:\1djpv.exec:\1djpv.exe42⤵
- Executes dropped EXE
PID:2148 -
\??\c:\lxlfrrr.exec:\lxlfrrr.exe43⤵
- Executes dropped EXE
PID:2840 -
\??\c:\7nbhnn.exec:\7nbhnn.exe44⤵
- Executes dropped EXE
PID:2904 -
\??\c:\bbhbtt.exec:\bbhbtt.exe45⤵
- Executes dropped EXE
PID:2676 -
\??\c:\vppjp.exec:\vppjp.exe46⤵
- Executes dropped EXE
PID:2716 -
\??\c:\9fxrxxl.exec:\9fxrxxl.exe47⤵
- Executes dropped EXE
PID:1292 -
\??\c:\htbtbn.exec:\htbtbn.exe48⤵
- Executes dropped EXE
PID:1160 -
\??\c:\nbhbbh.exec:\nbhbbh.exe49⤵
- Executes dropped EXE
PID:1132 -
\??\c:\pjpdv.exec:\pjpdv.exe50⤵
- Executes dropped EXE
PID:2928 -
\??\c:\djvjd.exec:\djvjd.exe51⤵
- Executes dropped EXE
PID:1716 -
\??\c:\frffxxx.exec:\frffxxx.exe52⤵
- Executes dropped EXE
PID:2692 -
\??\c:\tnhnbb.exec:\tnhnbb.exe53⤵
- Executes dropped EXE
PID:2892 -
\??\c:\5tbthb.exec:\5tbthb.exe54⤵
- Executes dropped EXE
PID:2780 -
\??\c:\jdpdv.exec:\jdpdv.exe55⤵
- Executes dropped EXE
PID:1284 -
\??\c:\lfrllfr.exec:\lfrllfr.exe56⤵
- Executes dropped EXE
PID:2016 -
\??\c:\thbbhh.exec:\thbbhh.exe57⤵
- Executes dropped EXE
PID:2988 -
\??\c:\vjjdd.exec:\vjjdd.exe58⤵
- Executes dropped EXE
PID:2204 -
\??\c:\vjvdj.exec:\vjvdj.exe59⤵
- Executes dropped EXE
PID:316 -
\??\c:\rflrlff.exec:\rflrlff.exe60⤵
- Executes dropped EXE
PID:1152 -
\??\c:\thtnnn.exec:\thtnnn.exe61⤵
- Executes dropped EXE
PID:2332 -
\??\c:\hbnnbb.exec:\hbnnbb.exe62⤵
- Executes dropped EXE
PID:3068 -
\??\c:\dpddd.exec:\dpddd.exe63⤵
- Executes dropped EXE
PID:948 -
\??\c:\xrllllr.exec:\xrllllr.exe64⤵
- Executes dropped EXE
PID:1604 -
\??\c:\hbbnbh.exec:\hbbnbh.exe65⤵
- Executes dropped EXE
PID:1540 -
\??\c:\nnnntb.exec:\nnnntb.exe66⤵PID:332
-
\??\c:\5pjjj.exec:\5pjjj.exe67⤵PID:1520
-
\??\c:\9rfxfff.exec:\9rfxfff.exe68⤵PID:2568
-
\??\c:\rflfxrr.exec:\rflfxrr.exe69⤵PID:2292
-
\??\c:\tnbbnn.exec:\tnbbnn.exe70⤵PID:696
-
\??\c:\1jjdd.exec:\1jjdd.exe71⤵PID:2508
-
\??\c:\lxrrxxf.exec:\lxrrxxf.exe72⤵PID:2392
-
\??\c:\xlflllr.exec:\xlflllr.exe73⤵PID:2500
-
\??\c:\5nttbh.exec:\5nttbh.exe74⤵PID:2388
-
\??\c:\dpddd.exec:\dpddd.exe75⤵PID:2556
-
\??\c:\vjppv.exec:\vjppv.exe76⤵PID:1712
-
\??\c:\xlffrrr.exec:\xlffrrr.exe77⤵PID:1580
-
\??\c:\1hbbbt.exec:\1hbbbt.exe78⤵PID:2128
-
\??\c:\nbttbt.exec:\nbttbt.exe79⤵PID:2256
-
\??\c:\vpvjj.exec:\vpvjj.exe80⤵PID:540
-
\??\c:\7rfflfl.exec:\7rfflfl.exe81⤵PID:2712
-
\??\c:\1tbhnn.exec:\1tbhnn.exe82⤵PID:2612
-
\??\c:\tnbttt.exec:\tnbttt.exe83⤵PID:1592
-
\??\c:\jdvpv.exec:\jdvpv.exe84⤵PID:2632
-
\??\c:\rlrrxrr.exec:\rlrrxrr.exe85⤵PID:2200
-
\??\c:\rlxfflr.exec:\rlxfflr.exe86⤵PID:2600
-
\??\c:\1hnhhh.exec:\1hnhhh.exe87⤵PID:1908
-
\??\c:\bhtnnn.exec:\bhtnnn.exe88⤵PID:2648
-
\??\c:\jvddd.exec:\jvddd.exe89⤵PID:2456
-
\??\c:\fxlrxfr.exec:\fxlrxfr.exe90⤵PID:1868
-
\??\c:\1ntnhh.exec:\1ntnhh.exe91⤵PID:1328
-
\??\c:\3hbbbh.exec:\3hbbbh.exe92⤵PID:1900
-
\??\c:\7djvv.exec:\7djvv.exe93⤵PID:2428
-
\??\c:\7jddj.exec:\7jddj.exe94⤵PID:1288
-
\??\c:\1xrrrll.exec:\1xrrrll.exe95⤵PID:2796
-
\??\c:\nbntbb.exec:\nbntbb.exe96⤵PID:1896
-
\??\c:\vjvvv.exec:\vjvvv.exe97⤵PID:2780
-
\??\c:\vvpvd.exec:\vvpvd.exe98⤵PID:1284
-
\??\c:\7xxlrll.exec:\7xxlrll.exe99⤵PID:1756
-
\??\c:\frfxxfl.exec:\frfxxfl.exe100⤵PID:2060
-
\??\c:\nhhbbt.exec:\nhhbbt.exe101⤵PID:1952
-
\??\c:\dpjjv.exec:\dpjjv.exe102⤵PID:1824
-
\??\c:\xlllrrf.exec:\xlllrrf.exe103⤵PID:1508
-
\??\c:\nbnnnb.exec:\nbnnnb.exe104⤵PID:2028
-
\??\c:\hbbttt.exec:\hbbttt.exe105⤵PID:1880
-
\??\c:\pdppp.exec:\pdppp.exe106⤵PID:2588
-
\??\c:\1pdvj.exec:\1pdvj.exe107⤵PID:1604
-
\??\c:\rrffrrf.exec:\rrffrrf.exe108⤵PID:1540
-
\??\c:\thnhbh.exec:\thnhbh.exe109⤵PID:1112
-
\??\c:\thtbhh.exec:\thtbhh.exe110⤵PID:1812
-
\??\c:\jvjjd.exec:\jvjjd.exe111⤵PID:2568
-
\??\c:\1rffrrx.exec:\1rffrrx.exe112⤵PID:2292
-
\??\c:\xlfflll.exec:\xlfflll.exe113⤵PID:1736
-
\??\c:\hhnttt.exec:\hhnttt.exe114⤵PID:760
-
\??\c:\jjvpp.exec:\jjvpp.exe115⤵PID:1904
-
\??\c:\vjddd.exec:\vjddd.exe116⤵PID:1524
-
\??\c:\llfxffl.exec:\llfxffl.exe117⤵PID:2020
-
\??\c:\nhnnnn.exec:\nhnnnn.exe118⤵PID:1892
-
\??\c:\3jdjv.exec:\3jdjv.exe119⤵PID:1924
-
\??\c:\xrfflrr.exec:\xrfflrr.exe120⤵PID:1780
-
\??\c:\9nhtbh.exec:\9nhtbh.exe121⤵PID:2460
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-