Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
27/12/2024, 03:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d805e4a1b0a00bc755b5221f54d1e1b0a3d352bcbb987b833cff1f618d787559.exe
Resource
win7-20240729-en
7 signatures
150 seconds
General
-
Target
d805e4a1b0a00bc755b5221f54d1e1b0a3d352bcbb987b833cff1f618d787559.exe
-
Size
453KB
-
MD5
753e78eb26b54a8d471d347345294786
-
SHA1
020f2bb342784d9937dc914f976f96cc763c3117
-
SHA256
d805e4a1b0a00bc755b5221f54d1e1b0a3d352bcbb987b833cff1f618d787559
-
SHA512
ba519fa5e6c919f1672e8f6032fdb9376647bc21fef68abade486b7ea93acf47e0600d86a41c44c400286c78222d2cd42872630f65428957a83ad95f254c2ea9
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe9:q7Tc2NYHUrAwfMp3CD9
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 51 IoCs
resource yara_rule behavioral1/memory/2112-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2336-16-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1920-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2336-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2464-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/792-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2464-37-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2908-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2496-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-77-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1976-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1156-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1356-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-151-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2128-149-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1636-169-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1528-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-189-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2956-187-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2568-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1096-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/904-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/736-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1092-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2508-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2492-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2492-333-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2716-378-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2656-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-400-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/668-443-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/836-450-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1772-469-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-488-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1244-524-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2520-564-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1644-566-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-743-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1472-756-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-807-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2276-828-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-937-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1156-994-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1536-1104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-1133-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2240-1243-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2336 vpddp.exe 1920 5jvpd.exe 2464 rrlxfrf.exe 792 nnbbhn.exe 2908 pvjjp.exe 2496 llrlllr.exe 2716 vvdjv.exe 2788 xffxlll.exe 1976 vdppv.exe 2620 ddjjp.exe 2024 1djdd.exe 1156 xxlfrrr.exe 2816 pdpvd.exe 988 5nhhhn.exe 2128 hhnnnt.exe 1356 5vddj.exe 1636 rxrrlxx.exe 1528 1bntbh.exe 2956 nnthtb.exe 1472 hhtntb.exe 2136 lxxlflf.exe 3036 pjpjp.exe 1056 llxxrrf.exe 2824 ddpjj.exe 2568 lxllrrx.exe 1096 nhnnnn.exe 904 djdjp.exe 2456 9thhhn.exe 2520 nnbbnn.exe 736 5vvvj.exe 1092 ttbbbb.exe 2508 frfllrf.exe 2564 tttthh.exe 1592 9pvdj.exe 1916 7lfflll.exe 2312 9rffllr.exe 2492 ntbbnt.exe 2148 dddvv.exe 2868 1flfffl.exe 2884 xflfrrr.exe 2708 nnhhnt.exe 1932 jjjdj.exe 3016 vpddv.exe 2716 lffxxxr.exe 2656 nnbbbb.exe 2596 9dpdp.exe 2676 pdjpv.exe 2228 rrrllff.exe 2024 hhnntt.exe 2800 htbbnh.exe 588 3pdjp.exe 2828 7lfllll.exe 2420 rrxxflx.exe 668 tnnhhh.exe 836 dpdjv.exe 1520 dvppp.exe 1868 1lrxxfx.exe 1772 hbnnhh.exe 2972 dpppv.exe 2956 jpdjv.exe 2116 lrfxfff.exe 2060 9htttn.exe 688 hthhnt.exe 1420 5dvjj.exe -
resource yara_rule behavioral1/memory/2112-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/792-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1976-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1156-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1156-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/988-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1356-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1096-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/904-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/736-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1092-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-333-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/3016-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/668-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/836-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1772-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-489-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-539-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-566-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-743-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1472-756-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-782-0x00000000002A0000-0x00000000002CA000-memory.dmp upx behavioral1/memory/2976-795-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-809-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2276-828-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-847-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-893-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-1079-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1536-1104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-1105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-1133-0x0000000000430000-0x000000000045A000-memory.dmp upx behavioral1/memory/1212-1159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-1196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-1221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2240-1243-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1144-1266-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hthnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfxxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxflflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3htntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrllfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2112 wrote to memory of 2336 2112 d805e4a1b0a00bc755b5221f54d1e1b0a3d352bcbb987b833cff1f618d787559.exe 30 PID 2112 wrote to memory of 2336 2112 d805e4a1b0a00bc755b5221f54d1e1b0a3d352bcbb987b833cff1f618d787559.exe 30 PID 2112 wrote to memory of 2336 2112 d805e4a1b0a00bc755b5221f54d1e1b0a3d352bcbb987b833cff1f618d787559.exe 30 PID 2112 wrote to memory of 2336 2112 d805e4a1b0a00bc755b5221f54d1e1b0a3d352bcbb987b833cff1f618d787559.exe 30 PID 2336 wrote to memory of 1920 2336 vpddp.exe 31 PID 2336 wrote to memory of 1920 2336 vpddp.exe 31 PID 2336 wrote to memory of 1920 2336 vpddp.exe 31 PID 2336 wrote to memory of 1920 2336 vpddp.exe 31 PID 1920 wrote to memory of 2464 1920 5jvpd.exe 32 PID 1920 wrote to memory of 2464 1920 5jvpd.exe 32 PID 1920 wrote to memory of 2464 1920 5jvpd.exe 32 PID 1920 wrote to memory of 2464 1920 5jvpd.exe 32 PID 2464 wrote to memory of 792 2464 rrlxfrf.exe 33 PID 2464 wrote to memory of 792 2464 rrlxfrf.exe 33 PID 2464 wrote to memory of 792 2464 rrlxfrf.exe 33 PID 2464 wrote to memory of 792 2464 rrlxfrf.exe 33 PID 792 wrote to memory of 2908 792 nnbbhn.exe 34 PID 792 wrote to memory of 2908 792 nnbbhn.exe 34 PID 792 wrote to memory of 2908 792 nnbbhn.exe 34 PID 792 wrote to memory of 2908 792 nnbbhn.exe 34 PID 2908 wrote to memory of 2496 2908 pvjjp.exe 35 PID 2908 wrote to memory of 2496 2908 pvjjp.exe 35 PID 2908 wrote to memory of 2496 2908 pvjjp.exe 35 PID 2908 wrote to memory of 2496 2908 pvjjp.exe 35 PID 2496 wrote to memory of 2716 2496 llrlllr.exe 36 PID 2496 wrote to memory of 2716 2496 llrlllr.exe 36 PID 2496 wrote to memory of 2716 2496 llrlllr.exe 36 PID 2496 wrote to memory of 2716 2496 llrlllr.exe 36 PID 2716 wrote to memory of 2788 2716 vvdjv.exe 37 PID 2716 wrote to memory of 2788 2716 vvdjv.exe 37 PID 2716 wrote to memory of 2788 2716 vvdjv.exe 37 PID 2716 wrote to memory of 2788 2716 vvdjv.exe 37 PID 2788 wrote to memory of 1976 2788 xffxlll.exe 38 PID 2788 wrote to memory of 1976 2788 xffxlll.exe 38 PID 2788 wrote to memory of 1976 2788 xffxlll.exe 38 PID 2788 wrote to memory of 1976 2788 xffxlll.exe 38 PID 1976 wrote to memory of 2620 1976 vdppv.exe 39 PID 1976 wrote to memory of 2620 1976 vdppv.exe 39 PID 1976 wrote to memory of 2620 1976 vdppv.exe 39 PID 1976 wrote to memory of 2620 1976 vdppv.exe 39 PID 2620 wrote to memory of 2024 2620 ddjjp.exe 40 PID 2620 wrote to memory of 2024 2620 ddjjp.exe 40 PID 2620 wrote to memory of 2024 2620 ddjjp.exe 40 PID 2620 wrote to memory of 2024 2620 ddjjp.exe 40 PID 2024 wrote to memory of 1156 2024 1djdd.exe 41 PID 2024 wrote to memory of 1156 2024 1djdd.exe 41 PID 2024 wrote to memory of 1156 2024 1djdd.exe 41 PID 2024 wrote to memory of 1156 2024 1djdd.exe 41 PID 1156 wrote to memory of 2816 1156 xxlfrrr.exe 42 PID 1156 wrote to memory of 2816 1156 xxlfrrr.exe 42 PID 1156 wrote to memory of 2816 1156 xxlfrrr.exe 42 PID 1156 wrote to memory of 2816 1156 xxlfrrr.exe 42 PID 2816 wrote to memory of 988 2816 pdpvd.exe 43 PID 2816 wrote to memory of 988 2816 pdpvd.exe 43 PID 2816 wrote to memory of 988 2816 pdpvd.exe 43 PID 2816 wrote to memory of 988 2816 pdpvd.exe 43 PID 988 wrote to memory of 2128 988 5nhhhn.exe 44 PID 988 wrote to memory of 2128 988 5nhhhn.exe 44 PID 988 wrote to memory of 2128 988 5nhhhn.exe 44 PID 988 wrote to memory of 2128 988 5nhhhn.exe 44 PID 2128 wrote to memory of 1356 2128 hhnnnt.exe 45 PID 2128 wrote to memory of 1356 2128 hhnnnt.exe 45 PID 2128 wrote to memory of 1356 2128 hhnnnt.exe 45 PID 2128 wrote to memory of 1356 2128 hhnnnt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\d805e4a1b0a00bc755b5221f54d1e1b0a3d352bcbb987b833cff1f618d787559.exe"C:\Users\Admin\AppData\Local\Temp\d805e4a1b0a00bc755b5221f54d1e1b0a3d352bcbb987b833cff1f618d787559.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\vpddp.exec:\vpddp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\5jvpd.exec:\5jvpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\rrlxfrf.exec:\rrlxfrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\nnbbhn.exec:\nnbbhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:792 -
\??\c:\pvjjp.exec:\pvjjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\llrlllr.exec:\llrlllr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\vvdjv.exec:\vvdjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\xffxlll.exec:\xffxlll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\vdppv.exec:\vdppv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\ddjjp.exec:\ddjjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\1djdd.exec:\1djdd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\xxlfrrr.exec:\xxlfrrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
\??\c:\pdpvd.exec:\pdpvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\5nhhhn.exec:\5nhhhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
\??\c:\hhnnnt.exec:\hhnnnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\5vddj.exec:\5vddj.exe17⤵
- Executes dropped EXE
PID:1356 -
\??\c:\rxrrlxx.exec:\rxrrlxx.exe18⤵
- Executes dropped EXE
PID:1636 -
\??\c:\1bntbh.exec:\1bntbh.exe19⤵
- Executes dropped EXE
PID:1528 -
\??\c:\nnthtb.exec:\nnthtb.exe20⤵
- Executes dropped EXE
PID:2956 -
\??\c:\hhtntb.exec:\hhtntb.exe21⤵
- Executes dropped EXE
PID:1472 -
\??\c:\lxxlflf.exec:\lxxlflf.exe22⤵
- Executes dropped EXE
PID:2136 -
\??\c:\pjpjp.exec:\pjpjp.exe23⤵
- Executes dropped EXE
PID:3036 -
\??\c:\llxxrrf.exec:\llxxrrf.exe24⤵
- Executes dropped EXE
PID:1056 -
\??\c:\ddpjj.exec:\ddpjj.exe25⤵
- Executes dropped EXE
PID:2824 -
\??\c:\lxllrrx.exec:\lxllrrx.exe26⤵
- Executes dropped EXE
PID:2568 -
\??\c:\nhnnnn.exec:\nhnnnn.exe27⤵
- Executes dropped EXE
PID:1096 -
\??\c:\djdjp.exec:\djdjp.exe28⤵
- Executes dropped EXE
PID:904 -
\??\c:\9thhhn.exec:\9thhhn.exe29⤵
- Executes dropped EXE
PID:2456 -
\??\c:\nnbbnn.exec:\nnbbnn.exe30⤵
- Executes dropped EXE
PID:2520 -
\??\c:\5vvvj.exec:\5vvvj.exe31⤵
- Executes dropped EXE
PID:736 -
\??\c:\ttbbbb.exec:\ttbbbb.exe32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1092 -
\??\c:\frfllrf.exec:\frfllrf.exe33⤵
- Executes dropped EXE
PID:2508 -
\??\c:\tttthh.exec:\tttthh.exe34⤵
- Executes dropped EXE
PID:2564 -
\??\c:\9pvdj.exec:\9pvdj.exe35⤵
- Executes dropped EXE
PID:1592 -
\??\c:\7lfflll.exec:\7lfflll.exe36⤵
- Executes dropped EXE
PID:1916 -
\??\c:\9rffllr.exec:\9rffllr.exe37⤵
- Executes dropped EXE
PID:2312 -
\??\c:\ntbbnt.exec:\ntbbnt.exe38⤵
- Executes dropped EXE
PID:2492 -
\??\c:\dddvv.exec:\dddvv.exe39⤵
- Executes dropped EXE
PID:2148 -
\??\c:\1flfffl.exec:\1flfffl.exe40⤵
- Executes dropped EXE
PID:2868 -
\??\c:\xflfrrr.exec:\xflfrrr.exe41⤵
- Executes dropped EXE
PID:2884 -
\??\c:\nnhhnt.exec:\nnhhnt.exe42⤵
- Executes dropped EXE
PID:2708 -
\??\c:\jjjdj.exec:\jjjdj.exe43⤵
- Executes dropped EXE
PID:1932 -
\??\c:\vpddv.exec:\vpddv.exe44⤵
- Executes dropped EXE
PID:3016 -
\??\c:\lffxxxr.exec:\lffxxxr.exe45⤵
- Executes dropped EXE
PID:2716 -
\??\c:\nnbbbb.exec:\nnbbbb.exe46⤵
- Executes dropped EXE
PID:2656 -
\??\c:\9dpdp.exec:\9dpdp.exe47⤵
- Executes dropped EXE
PID:2596 -
\??\c:\pdjpv.exec:\pdjpv.exe48⤵
- Executes dropped EXE
PID:2676 -
\??\c:\rrrllff.exec:\rrrllff.exe49⤵
- Executes dropped EXE
PID:2228 -
\??\c:\hhnntt.exec:\hhnntt.exe50⤵
- Executes dropped EXE
PID:2024 -
\??\c:\htbbnh.exec:\htbbnh.exe51⤵
- Executes dropped EXE
PID:2800 -
\??\c:\3pdjp.exec:\3pdjp.exe52⤵
- Executes dropped EXE
PID:588 -
\??\c:\7lfllll.exec:\7lfllll.exe53⤵
- Executes dropped EXE
PID:2828 -
\??\c:\rrxxflx.exec:\rrxxflx.exe54⤵
- Executes dropped EXE
PID:2420 -
\??\c:\tnnhhh.exec:\tnnhhh.exe55⤵
- Executes dropped EXE
PID:668 -
\??\c:\dpdjv.exec:\dpdjv.exe56⤵
- Executes dropped EXE
PID:836 -
\??\c:\dvppp.exec:\dvppp.exe57⤵
- Executes dropped EXE
PID:1520 -
\??\c:\1lrxxfx.exec:\1lrxxfx.exe58⤵
- Executes dropped EXE
PID:1868 -
\??\c:\hbnnhh.exec:\hbnnhh.exe59⤵
- Executes dropped EXE
PID:1772 -
\??\c:\dpppv.exec:\dpppv.exe60⤵
- Executes dropped EXE
PID:2972 -
\??\c:\jpdjv.exec:\jpdjv.exe61⤵
- Executes dropped EXE
PID:2956 -
\??\c:\lrfxfff.exec:\lrfxfff.exe62⤵
- Executes dropped EXE
PID:2116 -
\??\c:\9htttn.exec:\9htttn.exe63⤵
- Executes dropped EXE
PID:2060 -
\??\c:\hthhnt.exec:\hthhnt.exe64⤵
- Executes dropped EXE
PID:688 -
\??\c:\5dvjj.exec:\5dvjj.exe65⤵
- Executes dropped EXE
PID:1420 -
\??\c:\rrflxfl.exec:\rrflxfl.exe66⤵PID:2976
-
\??\c:\frxllff.exec:\frxllff.exe67⤵PID:1612
-
\??\c:\bbhhnt.exec:\bbhhnt.exe68⤵PID:1244
-
\??\c:\vvvvp.exec:\vvvvp.exe69⤵PID:1492
-
\??\c:\7rxxlll.exec:\7rxxlll.exe70⤵PID:2460
-
\??\c:\rllllxx.exec:\rllllxx.exe71⤵PID:2088
-
\??\c:\9hbnbh.exec:\9hbnbh.exe72⤵PID:3048
-
\??\c:\vvddv.exec:\vvddv.exe73⤵PID:556
-
\??\c:\vvjjp.exec:\vvjjp.exe74⤵PID:2520
-
\??\c:\frrllll.exec:\frrllll.exe75⤵PID:1644
-
\??\c:\tbhhnn.exec:\tbhhnn.exe76⤵PID:876
-
\??\c:\pddvd.exec:\pddvd.exe77⤵PID:2040
-
\??\c:\vvdjd.exec:\vvdjd.exe78⤵PID:2084
-
\??\c:\1rlllrr.exec:\1rlllrr.exe79⤵PID:1596
-
\??\c:\bbhhnn.exec:\bbhhnn.exe80⤵PID:1828
-
\??\c:\7hnhbb.exec:\7hnhbb.exe81⤵
- System Location Discovery: System Language Discovery
PID:2264 -
\??\c:\vpddj.exec:\vpddj.exe82⤵PID:2284
-
\??\c:\ppjjp.exec:\ppjjp.exe83⤵PID:2272
-
\??\c:\xxflrlx.exec:\xxflrlx.exe84⤵PID:2148
-
\??\c:\5thttn.exec:\5thttn.exe85⤵PID:2748
-
\??\c:\hbtbnn.exec:\hbtbnn.exe86⤵PID:2884
-
\??\c:\jjvvj.exec:\jjvvj.exe87⤵PID:2708
-
\??\c:\xxfllrx.exec:\xxfllrx.exe88⤵PID:1932
-
\??\c:\nnbbbb.exec:\nnbbbb.exe89⤵PID:2608
-
\??\c:\9httbb.exec:\9httbb.exe90⤵PID:2624
-
\??\c:\djvjj.exec:\djvjj.exe91⤵PID:2648
-
\??\c:\vvvdd.exec:\vvvdd.exe92⤵PID:2664
-
\??\c:\fxxrrll.exec:\fxxrrll.exe93⤵PID:2720
-
\??\c:\thnttt.exec:\thnttt.exe94⤵PID:2348
-
\??\c:\pjjjj.exec:\pjjjj.exe95⤵PID:2588
-
\??\c:\ppddj.exec:\ppddj.exe96⤵PID:2660
-
\??\c:\rrrrrxf.exec:\rrrrrxf.exe97⤵PID:2820
-
\??\c:\tttthh.exec:\tttthh.exe98⤵PID:2424
-
\??\c:\tbhbbh.exec:\tbhbbh.exe99⤵PID:1736
-
\??\c:\ddjdj.exec:\ddjdj.exe100⤵PID:1168
-
\??\c:\fxfflll.exec:\fxfflll.exe101⤵PID:1192
-
\??\c:\3fxflxf.exec:\3fxflxf.exe102⤵PID:2840
-
\??\c:\5ntttb.exec:\5ntttb.exe103⤵PID:1484
-
\??\c:\bbnhnn.exec:\bbnhnn.exe104⤵PID:2992
-
\??\c:\7pvvd.exec:\7pvvd.exe105⤵
- System Location Discovery: System Language Discovery
PID:1472 -
\??\c:\xxrrllr.exec:\xxrrllr.exe106⤵PID:2956
-
\??\c:\3lxflxx.exec:\3lxflxx.exe107⤵PID:1268
-
\??\c:\3hbhtb.exec:\3hbhtb.exe108⤵PID:2060
-
\??\c:\vpvpp.exec:\vpvpp.exe109⤵PID:1872
-
\??\c:\pvjjv.exec:\pvjjv.exe110⤵PID:1420
-
\??\c:\3rfxxxx.exec:\3rfxxxx.exe111⤵PID:2976
-
\??\c:\5htbbb.exec:\5htbbb.exe112⤵PID:2544
-
\??\c:\ttbbbb.exec:\ttbbbb.exe113⤵PID:1692
-
\??\c:\pdjpv.exec:\pdjpv.exe114⤵PID:1488
-
\??\c:\fffxffl.exec:\fffxffl.exe115⤵PID:2276
-
\??\c:\xxxffxf.exec:\xxxffxf.exe116⤵PID:1912
-
\??\c:\htbnhb.exec:\htbnhb.exe117⤵PID:3012
-
\??\c:\dvddv.exec:\dvddv.exe118⤵PID:2028
-
\??\c:\vvpjp.exec:\vvpjp.exe119⤵PID:2520
-
\??\c:\7fxrrxf.exec:\7fxrrxf.exe120⤵PID:1644
-
\??\c:\nnhttn.exec:\nnhttn.exe121⤵PID:2404
-
\??\c:\nnhhnn.exec:\nnhhnn.exe122⤵PID:2040
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-