Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 19:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e3e67322e09150befe40516ac35c5a1c42869816f1c1ba4d5a11a87e712c85fe.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
120 seconds
General
-
Target
e3e67322e09150befe40516ac35c5a1c42869816f1c1ba4d5a11a87e712c85fe.exe
-
Size
454KB
-
MD5
54cb98c4e0fa8937758db911dcb873bc
-
SHA1
0955f16650e83ab4f712d2112c59b7cd3555afb1
-
SHA256
e3e67322e09150befe40516ac35c5a1c42869816f1c1ba4d5a11a87e712c85fe
-
SHA512
98c9e4ac1941d7821898e98f7ebd1d9c0b12aee33bb0a53e00d3930d88edfc9fea42b6f1322204801af321b74eda0e70565566469ff9e140e33b6d7042bc063f
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbec:q7Tc2NYHUrAwfMp3CDc
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/2080-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1916-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2256-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2328-45-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2184-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1908-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2228-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2452-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/588-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-127-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2212-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1576-164-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2212-174-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2948-182-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2948-184-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1608-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1124-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2320-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2076-299-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/880-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1136-323-0x0000000077530000-0x000000007764F000-memory.dmp family_blackmoon behavioral1/memory/2884-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-356-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2844-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1908-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/380-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1868-456-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-519-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1968-562-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1764-569-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2312-596-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-644-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-643-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2228-693-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1140-701-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2972-745-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/1924-831-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-884-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-1001-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/2312-1190-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2708-1189-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2348-1236-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2564 1dppv.exe 1916 3rxxffr.exe 2256 tnbbhn.exe 2328 rlxxxrx.exe 2864 pjppv.exe 2184 bhtnnb.exe 2732 dpppv.exe 2892 btbtbb.exe 1908 7vpjv.exe 2772 vvvvp.exe 2452 hhnbhn.exe 2228 1xfffff.exe 2800 tnnttn.exe 588 9bhbhh.exe 2424 rlxxfff.exe 2668 xxrllrr.exe 1576 bthntb.exe 2212 nhhbhn.exe 2948 ffrllrx.exe 2940 jdppv.exe 2260 xlxfxxl.exe 1608 bbhbbh.exe 1124 jdppp.exe 2320 ppjpv.exe 2568 3lfflll.exe 1784 nhnnnn.exe 996 vpvdd.exe 2456 btnntb.exe 1728 jjpvd.exe 3012 lfffllr.exe 2792 hhntbn.exe 1892 djvdp.exe 2076 9bhtnb.exe 2564 jjpjp.exe 880 vpvpp.exe 2172 xxlxllx.exe 1136 3bhhnn.exe 2884 9jdvj.exe 2748 3httbb.exe 2752 5vppv.exe 2292 vddjp.exe 2716 rrfflrf.exe 2732 bbnntb.exe 2896 jvjpv.exe 2844 djpvd.exe 1908 5fxfrxr.exe 2768 1thhhh.exe 2720 bhnthn.exe 2288 7ppvd.exe 1680 rfrrrxl.exe 320 fflxllx.exe 380 7hnnnt.exe 468 jpvdj.exe 2420 dvdjj.exe 2668 fxfxxxx.exe 1636 5bttbh.exe 1868 bbnhnh.exe 3000 dpppp.exe 2932 xxffffl.exe 2428 9tbthb.exe 2116 hhbbhh.exe 2260 djppv.exe 448 rlfxxxx.exe 2500 rlrrxrf.exe -
resource yara_rule behavioral1/memory/2564-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1916-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-108-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/2228-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/588-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-129-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2668-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1124-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1784-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/880-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/380-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1868-456-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/448-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-519-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-562-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-569-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-576-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-596-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-644-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-693-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1244-791-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1924-831-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-884-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-922-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-1026-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-1104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-1190-0x0000000000220000-0x000000000024A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxxfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrxfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ffffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9htnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrfxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllfllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2080 wrote to memory of 2564 2080 e3e67322e09150befe40516ac35c5a1c42869816f1c1ba4d5a11a87e712c85fe.exe 30 PID 2080 wrote to memory of 2564 2080 e3e67322e09150befe40516ac35c5a1c42869816f1c1ba4d5a11a87e712c85fe.exe 30 PID 2080 wrote to memory of 2564 2080 e3e67322e09150befe40516ac35c5a1c42869816f1c1ba4d5a11a87e712c85fe.exe 30 PID 2080 wrote to memory of 2564 2080 e3e67322e09150befe40516ac35c5a1c42869816f1c1ba4d5a11a87e712c85fe.exe 30 PID 2564 wrote to memory of 1916 2564 1dppv.exe 31 PID 2564 wrote to memory of 1916 2564 1dppv.exe 31 PID 2564 wrote to memory of 1916 2564 1dppv.exe 31 PID 2564 wrote to memory of 1916 2564 1dppv.exe 31 PID 1916 wrote to memory of 2256 1916 3rxxffr.exe 32 PID 1916 wrote to memory of 2256 1916 3rxxffr.exe 32 PID 1916 wrote to memory of 2256 1916 3rxxffr.exe 32 PID 1916 wrote to memory of 2256 1916 3rxxffr.exe 32 PID 2256 wrote to memory of 2328 2256 tnbbhn.exe 33 PID 2256 wrote to memory of 2328 2256 tnbbhn.exe 33 PID 2256 wrote to memory of 2328 2256 tnbbhn.exe 33 PID 2256 wrote to memory of 2328 2256 tnbbhn.exe 33 PID 2328 wrote to memory of 2864 2328 rlxxxrx.exe 34 PID 2328 wrote to memory of 2864 2328 rlxxxrx.exe 34 PID 2328 wrote to memory of 2864 2328 rlxxxrx.exe 34 PID 2328 wrote to memory of 2864 2328 rlxxxrx.exe 34 PID 2864 wrote to memory of 2184 2864 pjppv.exe 35 PID 2864 wrote to memory of 2184 2864 pjppv.exe 35 PID 2864 wrote to memory of 2184 2864 pjppv.exe 35 PID 2864 wrote to memory of 2184 2864 pjppv.exe 35 PID 2184 wrote to memory of 2732 2184 bhtnnb.exe 36 PID 2184 wrote to memory of 2732 2184 bhtnnb.exe 36 PID 2184 wrote to memory of 2732 2184 bhtnnb.exe 36 PID 2184 wrote to memory of 2732 2184 bhtnnb.exe 36 PID 2732 wrote to memory of 2892 2732 dpppv.exe 37 PID 2732 wrote to memory of 2892 2732 dpppv.exe 37 PID 2732 wrote to memory of 2892 2732 dpppv.exe 37 PID 2732 wrote to memory of 2892 2732 dpppv.exe 37 PID 2892 wrote to memory of 1908 2892 btbtbb.exe 38 PID 2892 wrote to memory of 1908 2892 btbtbb.exe 38 PID 2892 wrote to memory of 1908 2892 btbtbb.exe 38 PID 2892 wrote to memory of 1908 2892 btbtbb.exe 38 PID 1908 wrote to memory of 2772 1908 7vpjv.exe 39 PID 1908 wrote to memory of 2772 1908 7vpjv.exe 39 PID 1908 wrote to memory of 2772 1908 7vpjv.exe 39 PID 1908 wrote to memory of 2772 1908 7vpjv.exe 39 PID 2772 wrote to memory of 2452 2772 vvvvp.exe 40 PID 2772 wrote to memory of 2452 2772 vvvvp.exe 40 PID 2772 wrote to memory of 2452 2772 vvvvp.exe 40 PID 2772 wrote to memory of 2452 2772 vvvvp.exe 40 PID 2452 wrote to memory of 2228 2452 hhnbhn.exe 41 PID 2452 wrote to memory of 2228 2452 hhnbhn.exe 41 PID 2452 wrote to memory of 2228 2452 hhnbhn.exe 41 PID 2452 wrote to memory of 2228 2452 hhnbhn.exe 41 PID 2228 wrote to memory of 2800 2228 1xfffff.exe 42 PID 2228 wrote to memory of 2800 2228 1xfffff.exe 42 PID 2228 wrote to memory of 2800 2228 1xfffff.exe 42 PID 2228 wrote to memory of 2800 2228 1xfffff.exe 42 PID 2800 wrote to memory of 588 2800 tnnttn.exe 43 PID 2800 wrote to memory of 588 2800 tnnttn.exe 43 PID 2800 wrote to memory of 588 2800 tnnttn.exe 43 PID 2800 wrote to memory of 588 2800 tnnttn.exe 43 PID 588 wrote to memory of 2424 588 9bhbhh.exe 44 PID 588 wrote to memory of 2424 588 9bhbhh.exe 44 PID 588 wrote to memory of 2424 588 9bhbhh.exe 44 PID 588 wrote to memory of 2424 588 9bhbhh.exe 44 PID 2424 wrote to memory of 2668 2424 rlxxfff.exe 45 PID 2424 wrote to memory of 2668 2424 rlxxfff.exe 45 PID 2424 wrote to memory of 2668 2424 rlxxfff.exe 45 PID 2424 wrote to memory of 2668 2424 rlxxfff.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\e3e67322e09150befe40516ac35c5a1c42869816f1c1ba4d5a11a87e712c85fe.exe"C:\Users\Admin\AppData\Local\Temp\e3e67322e09150befe40516ac35c5a1c42869816f1c1ba4d5a11a87e712c85fe.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\1dppv.exec:\1dppv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\3rxxffr.exec:\3rxxffr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\tnbbhn.exec:\tnbbhn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\rlxxxrx.exec:\rlxxxrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\pjppv.exec:\pjppv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\bhtnnb.exec:\bhtnnb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\dpppv.exec:\dpppv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\btbtbb.exec:\btbtbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\7vpjv.exec:\7vpjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\vvvvp.exec:\vvvvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\hhnbhn.exec:\hhnbhn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\1xfffff.exec:\1xfffff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\tnnttn.exec:\tnnttn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\9bhbhh.exec:\9bhbhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:588 -
\??\c:\rlxxfff.exec:\rlxxfff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\xxrllrr.exec:\xxrllrr.exe17⤵
- Executes dropped EXE
PID:2668 -
\??\c:\bthntb.exec:\bthntb.exe18⤵
- Executes dropped EXE
PID:1576 -
\??\c:\nhhbhn.exec:\nhhbhn.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2212 -
\??\c:\ffrllrx.exec:\ffrllrx.exe20⤵
- Executes dropped EXE
PID:2948 -
\??\c:\jdppv.exec:\jdppv.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2940 -
\??\c:\xlxfxxl.exec:\xlxfxxl.exe22⤵
- Executes dropped EXE
PID:2260 -
\??\c:\bbhbbh.exec:\bbhbbh.exe23⤵
- Executes dropped EXE
PID:1608 -
\??\c:\jdppp.exec:\jdppp.exe24⤵
- Executes dropped EXE
PID:1124 -
\??\c:\ppjpv.exec:\ppjpv.exe25⤵
- Executes dropped EXE
PID:2320 -
\??\c:\3lfflll.exec:\3lfflll.exe26⤵
- Executes dropped EXE
PID:2568 -
\??\c:\nhnnnn.exec:\nhnnnn.exe27⤵
- Executes dropped EXE
PID:1784 -
\??\c:\vpvdd.exec:\vpvdd.exe28⤵
- Executes dropped EXE
PID:996 -
\??\c:\btnntb.exec:\btnntb.exe29⤵
- Executes dropped EXE
PID:2456 -
\??\c:\jjpvd.exec:\jjpvd.exe30⤵
- Executes dropped EXE
PID:1728 -
\??\c:\lfffllr.exec:\lfffllr.exe31⤵
- Executes dropped EXE
PID:3012 -
\??\c:\hhntbn.exec:\hhntbn.exe32⤵
- Executes dropped EXE
PID:2792 -
\??\c:\djvdp.exec:\djvdp.exe33⤵
- Executes dropped EXE
PID:1892 -
\??\c:\9bhtnb.exec:\9bhtnb.exe34⤵
- Executes dropped EXE
PID:2076 -
\??\c:\jjpjp.exec:\jjpjp.exe35⤵
- Executes dropped EXE
PID:2564 -
\??\c:\vpvpp.exec:\vpvpp.exe36⤵
- Executes dropped EXE
PID:880 -
\??\c:\xxlxllx.exec:\xxlxllx.exe37⤵
- Executes dropped EXE
PID:2172 -
\??\c:\3bhhnn.exec:\3bhhnn.exe38⤵
- Executes dropped EXE
PID:1136 -
\??\c:\9pjjp.exec:\9pjjp.exe39⤵PID:2148
-
\??\c:\9jdvj.exec:\9jdvj.exe40⤵
- Executes dropped EXE
PID:2884 -
\??\c:\3httbb.exec:\3httbb.exe41⤵
- Executes dropped EXE
PID:2748 -
\??\c:\5vppv.exec:\5vppv.exe42⤵
- Executes dropped EXE
PID:2752 -
\??\c:\vddjp.exec:\vddjp.exe43⤵
- Executes dropped EXE
PID:2292 -
\??\c:\rrfflrf.exec:\rrfflrf.exe44⤵
- Executes dropped EXE
PID:2716 -
\??\c:\bbnntb.exec:\bbnntb.exe45⤵
- Executes dropped EXE
PID:2732 -
\??\c:\jvjpv.exec:\jvjpv.exe46⤵
- Executes dropped EXE
PID:2896 -
\??\c:\djpvd.exec:\djpvd.exe47⤵
- Executes dropped EXE
PID:2844 -
\??\c:\5fxfrxr.exec:\5fxfrxr.exe48⤵
- Executes dropped EXE
PID:1908 -
\??\c:\1thhhh.exec:\1thhhh.exe49⤵
- Executes dropped EXE
PID:2768 -
\??\c:\bhnthn.exec:\bhnthn.exe50⤵
- Executes dropped EXE
PID:2720 -
\??\c:\7ppvd.exec:\7ppvd.exe51⤵
- Executes dropped EXE
PID:2288 -
\??\c:\rfrrrxl.exec:\rfrrrxl.exe52⤵
- Executes dropped EXE
PID:1680 -
\??\c:\fflxllx.exec:\fflxllx.exe53⤵
- Executes dropped EXE
PID:320 -
\??\c:\7hnnnt.exec:\7hnnnt.exe54⤵
- Executes dropped EXE
PID:380 -
\??\c:\jpvdj.exec:\jpvdj.exe55⤵
- Executes dropped EXE
PID:468 -
\??\c:\dvdjj.exec:\dvdjj.exe56⤵
- Executes dropped EXE
PID:2420 -
\??\c:\fxfxxxx.exec:\fxfxxxx.exe57⤵
- Executes dropped EXE
PID:2668 -
\??\c:\5bttbh.exec:\5bttbh.exe58⤵
- Executes dropped EXE
PID:1636 -
\??\c:\bbnhnh.exec:\bbnhnh.exe59⤵
- Executes dropped EXE
PID:1868 -
\??\c:\dpppp.exec:\dpppp.exe60⤵
- Executes dropped EXE
PID:3000 -
\??\c:\xxffffl.exec:\xxffffl.exe61⤵
- Executes dropped EXE
PID:2932 -
\??\c:\9tbthb.exec:\9tbthb.exe62⤵
- Executes dropped EXE
PID:2428 -
\??\c:\hhbbhh.exec:\hhbbhh.exe63⤵
- Executes dropped EXE
PID:2116 -
\??\c:\djppv.exec:\djppv.exe64⤵
- Executes dropped EXE
PID:2260 -
\??\c:\rlfxxxx.exec:\rlfxxxx.exe65⤵
- Executes dropped EXE
PID:448 -
\??\c:\rlrrxrf.exec:\rlrrxrf.exe66⤵
- Executes dropped EXE
PID:2500 -
\??\c:\7bbhnt.exec:\7bbhnt.exe67⤵PID:2976
-
\??\c:\tnnnnt.exec:\tnnnnt.exe68⤵PID:1432
-
\??\c:\ddppd.exec:\ddppd.exe69⤵PID:3032
-
\??\c:\fxffxfl.exec:\fxffxfl.exe70⤵PID:1552
-
\??\c:\hhhbtt.exec:\hhhbtt.exe71⤵PID:936
-
\??\c:\btbnbt.exec:\btbnbt.exe72⤵PID:1008
-
\??\c:\jjvdp.exec:\jjvdp.exe73⤵PID:2536
-
\??\c:\rlllrrr.exec:\rlllrrr.exe74⤵PID:556
-
\??\c:\rxflffl.exec:\rxflffl.exe75⤵PID:2340
-
\??\c:\hhnttt.exec:\hhnttt.exe76⤵PID:1968
-
\??\c:\ppdvp.exec:\ppdvp.exe77⤵PID:1764
-
\??\c:\1jdjj.exec:\1jdjj.exe78⤵PID:1892
-
\??\c:\flxxrlr.exec:\flxxrlr.exe79⤵PID:2336
-
\??\c:\bntnnt.exec:\bntnnt.exe80⤵PID:2920
-
\??\c:\jjvvd.exec:\jjvvd.exe81⤵PID:2312
-
\??\c:\3djpv.exec:\3djpv.exe82⤵PID:2368
-
\??\c:\rrlxxxf.exec:\rrlxxxf.exe83⤵PID:2264
-
\??\c:\btbttn.exec:\btbttn.exe84⤵PID:1572
-
\??\c:\bbhhnb.exec:\bbhhnb.exe85⤵PID:2908
-
\??\c:\vjvdd.exec:\vjvdd.exe86⤵PID:2748
-
\??\c:\lfxrrll.exec:\lfxrrll.exe87⤵PID:2740
-
\??\c:\xrxxxff.exec:\xrxxxff.exe88⤵PID:2292
-
\??\c:\nnbtbh.exec:\nnbtbh.exe89⤵PID:2716
-
\??\c:\vpvvj.exec:\vpvvj.exe90⤵PID:2648
-
\??\c:\xrlxflr.exec:\xrlxflr.exe91⤵PID:2596
-
\??\c:\3xllllf.exec:\3xllllf.exe92⤵PID:2676
-
\??\c:\btbtbt.exec:\btbtbt.exe93⤵PID:2224
-
\??\c:\pvjjj.exec:\pvjjj.exe94⤵PID:1452
-
\??\c:\5lxflxx.exec:\5lxflxx.exe95⤵PID:2228
-
\??\c:\xxllllr.exec:\xxllllr.exe96⤵PID:1140
-
\??\c:\7nnnnt.exec:\7nnnnt.exe97⤵PID:2812
-
\??\c:\vvpvd.exec:\vvpvd.exe98⤵PID:1144
-
\??\c:\rxllrlf.exec:\rxllrlf.exe99⤵PID:1816
-
\??\c:\ffrlrlr.exec:\ffrlrlr.exe100⤵PID:2104
-
\??\c:\hntttb.exec:\hntttb.exe101⤵PID:1076
-
\??\c:\7pjvd.exec:\7pjvd.exe102⤵PID:1520
-
\??\c:\pvppv.exec:\pvppv.exe103⤵PID:2972
-
\??\c:\5fxxfff.exec:\5fxxfff.exe104⤵PID:3000
-
\??\c:\nhhhhh.exec:\nhhhhh.exe105⤵PID:1472
-
\??\c:\btbhnt.exec:\btbhnt.exe106⤵PID:2092
-
\??\c:\3dvvj.exec:\3dvvj.exe107⤵PID:2996
-
\??\c:\lffflrx.exec:\lffflrx.exe108⤵PID:1204
-
\??\c:\nntbhn.exec:\nntbhn.exe109⤵PID:1632
-
\??\c:\tnbbnn.exec:\tnbbnn.exe110⤵PID:2500
-
\??\c:\pjdvd.exec:\pjdvd.exe111⤵PID:1244
-
\??\c:\fxflrrx.exec:\fxflrrx.exe112⤵PID:1096
-
\??\c:\7lfxxxx.exec:\7lfxxxx.exe113⤵PID:2460
-
\??\c:\1hnhnh.exec:\1hnhnh.exe114⤵PID:1924
-
\??\c:\5pvvv.exec:\5pvvv.exe115⤵PID:3048
-
\??\c:\pdjdp.exec:\pdjdp.exe116⤵PID:2520
-
\??\c:\5fxfflr.exec:\5fxfflr.exe117⤵PID:1656
-
\??\c:\hbtbhh.exec:\hbtbhh.exe118⤵PID:1248
-
\??\c:\7ddjj.exec:\7ddjj.exe119⤵PID:1644
-
\??\c:\jpdpv.exec:\jpdpv.exe120⤵PID:3024
-
\??\c:\fflfrll.exec:\fflfrll.exe121⤵PID:2032
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-