Analysis
-
max time kernel
120s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 19:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f9e7379291507c5c5d8ce1fdf54566697fc1f4debf511928a5f0ff0a16e25136.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
f9e7379291507c5c5d8ce1fdf54566697fc1f4debf511928a5f0ff0a16e25136.exe
-
Size
347KB
-
MD5
41a40469aecb754b54f5d734d4fdefaf
-
SHA1
f37e7457487d325dd306c91de657c9d14af64f27
-
SHA256
f9e7379291507c5c5d8ce1fdf54566697fc1f4debf511928a5f0ff0a16e25136
-
SHA512
edeb2ca5c6821dfda7c52c384d7f53a16c02630fde7103df5d63a4b967910a86d632b84c1224df320cb83ccf7a7025a6bd24df6c5f230ab4fc2d08e5feb3da3b
-
SSDEEP
6144:Xcm7ImGddXgYW5fNZWB5hFfci3Add4kGYAv:l7TcbWXZshJX2VGdv
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/2228-7-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2908-19-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2832-36-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2908-13-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2528-40-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2524-58-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2500-54-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2444-71-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2444-73-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2900-78-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2444-75-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2156-97-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1068-93-0x0000000001B50000-0x0000000001B78000-memory.dmp family_blackmoon behavioral1/memory/1068-91-0x0000000001B50000-0x0000000001B78000-memory.dmp family_blackmoon behavioral1/memory/1628-114-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1628-111-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/852-123-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1440-134-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1932-155-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2804-179-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/3020-191-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2836-189-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1268-233-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2112-258-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1004-274-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2808-299-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2832-308-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2684-333-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2412-346-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/776-374-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2196-413-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2904-451-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1788-452-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1788-459-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1512-472-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2400-490-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2992-518-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2816-540-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/896-548-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2636-597-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2632-753-0x0000000000430000-0x0000000000458000-memory.dmp family_blackmoon behavioral1/memory/2632-754-0x0000000000430000-0x0000000000458000-memory.dmp family_blackmoon behavioral1/memory/1912-757-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2400-768-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2576-914-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1436-947-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2908 xrlxlxf.exe 2552 3nbhhh.exe 2832 ppddv.exe 2528 3pjpd.exe 2500 fxrfxlx.exe 2524 dvpvp.exe 2444 7fxlxlf.exe 2900 bthbtt.exe 1068 7lrrffl.exe 2156 3hthbh.exe 1628 9jdvd.exe 852 3lxxffl.exe 1440 ppjvd.exe 2320 jdpdp.exe 1796 3vjvd.exe 1932 tnhhtb.exe 308 vdvpd.exe 2804 5jdpd.exe 2836 nnbnbh.exe 3020 xrxlrxf.exe 1140 tnhhtn.exe 2480 9pjvp.exe 956 rrfrlxl.exe 1268 5pjpv.exe 1344 jppjv.exe 1328 bththh.exe 2112 vpvdj.exe 3068 bbbnbn.exe 1004 bthnbh.exe 2828 llxfrfr.exe 2272 bbtnhh.exe 2808 1pdvj.exe 1780 lfxflrf.exe 2832 3bthtb.exe 2636 3ppdp.exe 1580 rlxrflx.exe 2788 tnbhtb.exe 2684 tnhntt.exe 2412 7vjdd.exe 2484 xxrrffl.exe 2456 xrflrrl.exe 2052 7tbhth.exe 1336 ppjjd.exe 776 7jdpv.exe 2156 7fllflf.exe 1616 nnttnn.exe 1044 hhnhbt.exe 2020 vpdjp.exe 2164 xfrrxlx.exe 2196 bthhnt.exe 856 bhnntt.exe 2212 3djpp.exe 324 lfrflrf.exe 3024 7xrfxxf.exe 2904 nhtbhn.exe 1788 ppdjd.exe 1756 1lfrflx.exe 1512 9xfrllf.exe 2852 nhbhtb.exe 2472 7vpvd.exe 2400 xxxxrxl.exe 2388 frlrlrf.exe 956 bnbbtn.exe 1752 ppdjj.exe -
resource yara_rule behavioral1/memory/2228-7-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2908-19-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2832-36-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2528-40-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2524-58-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2500-54-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2900-78-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2444-75-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2156-97-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/852-115-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1628-114-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/852-123-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1440-134-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1932-155-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2804-179-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/3020-191-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2836-189-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1268-233-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2112-258-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1004-274-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2808-299-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2832-308-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1580-320-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2684-333-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2412-346-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2052-359-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/776-374-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2196-413-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2904-451-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1788-452-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1512-472-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2816-533-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2816-540-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2636-597-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/3024-714-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1696-782-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2452-868-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2532-881-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1364-894-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2576-914-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/576-915-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1036-922-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1436-947-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1368-960-0x0000000000400000-0x0000000000428000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xrfxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hhntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bhnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrlxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lxxlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlxlxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xlllxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2228 wrote to memory of 2908 2228 f9e7379291507c5c5d8ce1fdf54566697fc1f4debf511928a5f0ff0a16e25136.exe 29 PID 2228 wrote to memory of 2908 2228 f9e7379291507c5c5d8ce1fdf54566697fc1f4debf511928a5f0ff0a16e25136.exe 29 PID 2228 wrote to memory of 2908 2228 f9e7379291507c5c5d8ce1fdf54566697fc1f4debf511928a5f0ff0a16e25136.exe 29 PID 2228 wrote to memory of 2908 2228 f9e7379291507c5c5d8ce1fdf54566697fc1f4debf511928a5f0ff0a16e25136.exe 29 PID 2908 wrote to memory of 2552 2908 xrlxlxf.exe 30 PID 2908 wrote to memory of 2552 2908 xrlxlxf.exe 30 PID 2908 wrote to memory of 2552 2908 xrlxlxf.exe 30 PID 2908 wrote to memory of 2552 2908 xrlxlxf.exe 30 PID 2552 wrote to memory of 2832 2552 3nbhhh.exe 31 PID 2552 wrote to memory of 2832 2552 3nbhhh.exe 31 PID 2552 wrote to memory of 2832 2552 3nbhhh.exe 31 PID 2552 wrote to memory of 2832 2552 3nbhhh.exe 31 PID 2832 wrote to memory of 2528 2832 ppddv.exe 32 PID 2832 wrote to memory of 2528 2832 ppddv.exe 32 PID 2832 wrote to memory of 2528 2832 ppddv.exe 32 PID 2832 wrote to memory of 2528 2832 ppddv.exe 32 PID 2528 wrote to memory of 2500 2528 3pjpd.exe 33 PID 2528 wrote to memory of 2500 2528 3pjpd.exe 33 PID 2528 wrote to memory of 2500 2528 3pjpd.exe 33 PID 2528 wrote to memory of 2500 2528 3pjpd.exe 33 PID 2500 wrote to memory of 2524 2500 fxrfxlx.exe 34 PID 2500 wrote to memory of 2524 2500 fxrfxlx.exe 34 PID 2500 wrote to memory of 2524 2500 fxrfxlx.exe 34 PID 2500 wrote to memory of 2524 2500 fxrfxlx.exe 34 PID 2524 wrote to memory of 2444 2524 dvpvp.exe 35 PID 2524 wrote to memory of 2444 2524 dvpvp.exe 35 PID 2524 wrote to memory of 2444 2524 dvpvp.exe 35 PID 2524 wrote to memory of 2444 2524 dvpvp.exe 35 PID 2444 wrote to memory of 2900 2444 7fxlxlf.exe 36 PID 2444 wrote to memory of 2900 2444 7fxlxlf.exe 36 PID 2444 wrote to memory of 2900 2444 7fxlxlf.exe 36 PID 2444 wrote to memory of 2900 2444 7fxlxlf.exe 36 PID 2900 wrote to memory of 1068 2900 bthbtt.exe 37 PID 2900 wrote to memory of 1068 2900 bthbtt.exe 37 PID 2900 wrote to memory of 1068 2900 bthbtt.exe 37 PID 2900 wrote to memory of 1068 2900 bthbtt.exe 37 PID 1068 wrote to memory of 2156 1068 7lrrffl.exe 38 PID 1068 wrote to memory of 2156 1068 7lrrffl.exe 38 PID 1068 wrote to memory of 2156 1068 7lrrffl.exe 38 PID 1068 wrote to memory of 2156 1068 7lrrffl.exe 38 PID 2156 wrote to memory of 1628 2156 3hthbh.exe 39 PID 2156 wrote to memory of 1628 2156 3hthbh.exe 39 PID 2156 wrote to memory of 1628 2156 3hthbh.exe 39 PID 2156 wrote to memory of 1628 2156 3hthbh.exe 39 PID 1628 wrote to memory of 852 1628 9jdvd.exe 40 PID 1628 wrote to memory of 852 1628 9jdvd.exe 40 PID 1628 wrote to memory of 852 1628 9jdvd.exe 40 PID 1628 wrote to memory of 852 1628 9jdvd.exe 40 PID 852 wrote to memory of 1440 852 3lxxffl.exe 41 PID 852 wrote to memory of 1440 852 3lxxffl.exe 41 PID 852 wrote to memory of 1440 852 3lxxffl.exe 41 PID 852 wrote to memory of 1440 852 3lxxffl.exe 41 PID 1440 wrote to memory of 2320 1440 ppjvd.exe 42 PID 1440 wrote to memory of 2320 1440 ppjvd.exe 42 PID 1440 wrote to memory of 2320 1440 ppjvd.exe 42 PID 1440 wrote to memory of 2320 1440 ppjvd.exe 42 PID 2320 wrote to memory of 1796 2320 jdpdp.exe 43 PID 2320 wrote to memory of 1796 2320 jdpdp.exe 43 PID 2320 wrote to memory of 1796 2320 jdpdp.exe 43 PID 2320 wrote to memory of 1796 2320 jdpdp.exe 43 PID 1796 wrote to memory of 1932 1796 3vjvd.exe 44 PID 1796 wrote to memory of 1932 1796 3vjvd.exe 44 PID 1796 wrote to memory of 1932 1796 3vjvd.exe 44 PID 1796 wrote to memory of 1932 1796 3vjvd.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9e7379291507c5c5d8ce1fdf54566697fc1f4debf511928a5f0ff0a16e25136.exe"C:\Users\Admin\AppData\Local\Temp\f9e7379291507c5c5d8ce1fdf54566697fc1f4debf511928a5f0ff0a16e25136.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\xrlxlxf.exec:\xrlxlxf.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\3nbhhh.exec:\3nbhhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\ppddv.exec:\ppddv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\3pjpd.exec:\3pjpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\fxrfxlx.exec:\fxrfxlx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\dvpvp.exec:\dvpvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\7fxlxlf.exec:\7fxlxlf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\bthbtt.exec:\bthbtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\7lrrffl.exec:\7lrrffl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
\??\c:\3hthbh.exec:\3hthbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\9jdvd.exec:\9jdvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\3lxxffl.exec:\3lxxffl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
\??\c:\ppjvd.exec:\ppjvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
\??\c:\jdpdp.exec:\jdpdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\3vjvd.exec:\3vjvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\tnhhtb.exec:\tnhhtb.exe17⤵
- Executes dropped EXE
PID:1932 -
\??\c:\vdvpd.exec:\vdvpd.exe18⤵
- Executes dropped EXE
PID:308 -
\??\c:\5jdpd.exec:\5jdpd.exe19⤵
- Executes dropped EXE
PID:2804 -
\??\c:\nnbnbh.exec:\nnbnbh.exe20⤵
- Executes dropped EXE
PID:2836 -
\??\c:\xrxlrxf.exec:\xrxlrxf.exe21⤵
- Executes dropped EXE
PID:3020 -
\??\c:\tnhhtn.exec:\tnhhtn.exe22⤵
- Executes dropped EXE
PID:1140 -
\??\c:\9pjvp.exec:\9pjvp.exe23⤵
- Executes dropped EXE
PID:2480 -
\??\c:\rrfrlxl.exec:\rrfrlxl.exe24⤵
- Executes dropped EXE
PID:956 -
\??\c:\5pjpv.exec:\5pjpv.exe25⤵
- Executes dropped EXE
PID:1268 -
\??\c:\jppjv.exec:\jppjv.exe26⤵
- Executes dropped EXE
PID:1344 -
\??\c:\bththh.exec:\bththh.exe27⤵
- Executes dropped EXE
PID:1328 -
\??\c:\vpvdj.exec:\vpvdj.exe28⤵
- Executes dropped EXE
PID:2112 -
\??\c:\bbbnbn.exec:\bbbnbn.exe29⤵
- Executes dropped EXE
PID:3068 -
\??\c:\bthnbh.exec:\bthnbh.exe30⤵
- Executes dropped EXE
PID:1004 -
\??\c:\llxfrfr.exec:\llxfrfr.exe31⤵
- Executes dropped EXE
PID:2828 -
\??\c:\bbtnhh.exec:\bbtnhh.exe32⤵
- Executes dropped EXE
PID:2272 -
\??\c:\1pdvj.exec:\1pdvj.exe33⤵
- Executes dropped EXE
PID:2808 -
\??\c:\lfxflrf.exec:\lfxflrf.exe34⤵
- Executes dropped EXE
PID:1780 -
\??\c:\3bthtb.exec:\3bthtb.exe35⤵
- Executes dropped EXE
PID:2832 -
\??\c:\3ppdp.exec:\3ppdp.exe36⤵
- Executes dropped EXE
PID:2636 -
\??\c:\rlxrflx.exec:\rlxrflx.exe37⤵
- Executes dropped EXE
PID:1580 -
\??\c:\tnbhtb.exec:\tnbhtb.exe38⤵
- Executes dropped EXE
PID:2788 -
\??\c:\tnhntt.exec:\tnhntt.exe39⤵
- Executes dropped EXE
PID:2684 -
\??\c:\7vjdd.exec:\7vjdd.exe40⤵
- Executes dropped EXE
PID:2412 -
\??\c:\xxrrffl.exec:\xxrrffl.exe41⤵
- Executes dropped EXE
PID:2484 -
\??\c:\xrflrrl.exec:\xrflrrl.exe42⤵
- Executes dropped EXE
PID:2456 -
\??\c:\7tbhth.exec:\7tbhth.exe43⤵
- Executes dropped EXE
PID:2052 -
\??\c:\ppjjd.exec:\ppjjd.exe44⤵
- Executes dropped EXE
PID:1336 -
\??\c:\7jdpv.exec:\7jdpv.exe45⤵
- Executes dropped EXE
PID:776 -
\??\c:\7fllflf.exec:\7fllflf.exe46⤵
- Executes dropped EXE
PID:2156 -
\??\c:\nnttnn.exec:\nnttnn.exe47⤵
- Executes dropped EXE
PID:1616 -
\??\c:\hhnhbt.exec:\hhnhbt.exe48⤵
- Executes dropped EXE
PID:1044 -
\??\c:\vpdjp.exec:\vpdjp.exe49⤵
- Executes dropped EXE
PID:2020 -
\??\c:\xfrrxlx.exec:\xfrrxlx.exe50⤵
- Executes dropped EXE
PID:2164 -
\??\c:\bthhnt.exec:\bthhnt.exe51⤵
- Executes dropped EXE
PID:2196 -
\??\c:\bhnntt.exec:\bhnntt.exe52⤵
- Executes dropped EXE
PID:856 -
\??\c:\3djpp.exec:\3djpp.exe53⤵
- Executes dropped EXE
PID:2212 -
\??\c:\lfrflrf.exec:\lfrflrf.exe54⤵
- Executes dropped EXE
PID:324 -
\??\c:\7xrfxxf.exec:\7xrfxxf.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3024 -
\??\c:\nhtbhn.exec:\nhtbhn.exe56⤵
- Executes dropped EXE
PID:2904 -
\??\c:\ppdjd.exec:\ppdjd.exe57⤵
- Executes dropped EXE
PID:1788 -
\??\c:\1lfrflx.exec:\1lfrflx.exe58⤵
- Executes dropped EXE
PID:1756 -
\??\c:\9xfrllf.exec:\9xfrllf.exe59⤵
- Executes dropped EXE
PID:1512 -
\??\c:\nhbhtb.exec:\nhbhtb.exe60⤵
- Executes dropped EXE
PID:2852 -
\??\c:\7vpvd.exec:\7vpvd.exe61⤵
- Executes dropped EXE
PID:2472 -
\??\c:\xxxxrxl.exec:\xxxxrxl.exe62⤵
- Executes dropped EXE
PID:2400 -
\??\c:\frlrlrf.exec:\frlrlrf.exe63⤵
- Executes dropped EXE
PID:2388 -
\??\c:\bnbbtn.exec:\bnbbtn.exe64⤵
- Executes dropped EXE
PID:956 -
\??\c:\ppdjj.exec:\ppdjj.exe65⤵
- Executes dropped EXE
PID:1752 -
\??\c:\jdppd.exec:\jdppd.exe66⤵PID:2992
-
\??\c:\frlrflx.exec:\frlrflx.exe67⤵PID:2996
-
\??\c:\5nbnbh.exec:\5nbnbh.exe68⤵PID:568
-
\??\c:\thtbtb.exec:\thtbtb.exe69⤵PID:2816
-
\??\c:\jjvdj.exec:\jjvdj.exe70⤵PID:896
-
\??\c:\xfrxlrf.exec:\xfrxlrf.exe71⤵PID:1968
-
\??\c:\rlrlxxl.exec:\rlrlxxl.exe72⤵PID:2932
-
\??\c:\hnbhtb.exec:\hnbhtb.exe73⤵PID:2264
-
\??\c:\dvdpj.exec:\dvdpj.exe74⤵PID:2664
-
\??\c:\lfrflrl.exec:\lfrflrl.exe75⤵PID:2700
-
\??\c:\1bnthh.exec:\1bnthh.exe76⤵PID:2704
-
\??\c:\9tnnbt.exec:\9tnnbt.exe77⤵PID:2832
-
\??\c:\dddvp.exec:\dddvp.exe78⤵PID:2636
-
\??\c:\1ddjp.exec:\1ddjp.exe79⤵PID:1640
-
\??\c:\xllfllr.exec:\xllfllr.exe80⤵PID:2788
-
\??\c:\nhnbhb.exec:\nhnbhb.exe81⤵PID:2684
-
\??\c:\hnbbnn.exec:\hnbbnn.exe82⤵PID:2412
-
\??\c:\pjpvv.exec:\pjpvv.exe83⤵PID:2484
-
\??\c:\3fxrrxr.exec:\3fxrrxr.exe84⤵PID:2456
-
\??\c:\3frxfll.exec:\3frxfll.exe85⤵PID:2052
-
\??\c:\nhhhtt.exec:\nhhhtt.exe86⤵PID:1936
-
\??\c:\vpvdv.exec:\vpvdv.exe87⤵PID:1068
-
\??\c:\3pjpv.exec:\3pjpv.exe88⤵PID:1012
-
\??\c:\lfrrflx.exec:\lfrrflx.exe89⤵PID:1628
-
\??\c:\lfrxlrf.exec:\lfrxlrf.exe90⤵PID:1812
-
\??\c:\3bhnth.exec:\3bhnth.exe91⤵PID:1160
-
\??\c:\pjdjv.exec:\pjdjv.exe92⤵PID:2148
-
\??\c:\rlxlrrf.exec:\rlxlrrf.exe93⤵PID:1444
-
\??\c:\llxrrxf.exec:\llxrrxf.exe94⤵PID:588
-
\??\c:\nnhnnt.exec:\nnhnnt.exe95⤵PID:316
-
\??\c:\thtbht.exec:\thtbht.exe96⤵PID:2736
-
\??\c:\jjvpp.exec:\jjvpp.exe97⤵PID:3024
-
\??\c:\xrffflx.exec:\xrffflx.exe98⤵PID:2800
-
\??\c:\hbnntt.exec:\hbnntt.exe99⤵PID:1316
-
\??\c:\5vpdp.exec:\5vpdp.exe100⤵PID:1684
-
\??\c:\pjvdj.exec:\pjvdj.exe101⤵PID:2284
-
\??\c:\xrlfllx.exec:\xrlfllx.exe102⤵PID:2632
-
\??\c:\1bnbhb.exec:\1bnbhb.exe103⤵PID:1912
-
\??\c:\ttnhtb.exec:\ttnhtb.exe104⤵PID:2400
-
\??\c:\7pvdj.exec:\7pvdj.exe105⤵PID:2388
-
\??\c:\ffrxlrr.exec:\ffrxlrr.exe106⤵PID:956
-
\??\c:\htnhbb.exec:\htnhbb.exe107⤵PID:1696
-
\??\c:\nbbtth.exec:\nbbtth.exe108⤵PID:2992
-
\??\c:\ddjpd.exec:\ddjpd.exe109⤵PID:1528
-
\??\c:\lxrlrrx.exec:\lxrlrrx.exe110⤵PID:2112
-
\??\c:\hhbhnt.exec:\hhbhnt.exe111⤵PID:900
-
\??\c:\bthhtn.exec:\bthhtn.exe112⤵PID:1672
-
\??\c:\9dppv.exec:\9dppv.exe113⤵PID:2828
-
\??\c:\rfrflrf.exec:\rfrflrf.exe114⤵PID:1544
-
\??\c:\fxllrxf.exec:\fxllrxf.exe115⤵PID:2592
-
\??\c:\btbbht.exec:\btbbht.exe116⤵PID:2964
-
\??\c:\hhttnt.exec:\hhttnt.exe117⤵PID:2652
-
\??\c:\5vpvd.exec:\5vpvd.exe118⤵PID:2544
-
\??\c:\rlllrxf.exec:\rlllrxf.exe119⤵PID:2640
-
\??\c:\rlxxllr.exec:\rlxxllr.exe120⤵PID:2572
-
\??\c:\tthhbh.exec:\tthhbh.exe121⤵PID:2452
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-