Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/12/2024, 21:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3d6499912f468a47db7e51e1faaed536549bf16fe9447677acf6a195b58959c9.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
3d6499912f468a47db7e51e1faaed536549bf16fe9447677acf6a195b58959c9.exe
-
Size
453KB
-
MD5
92d1750356c64735661ee71df04d66f9
-
SHA1
480e5251c8173d28ffc15d2ceac092e7b3322636
-
SHA256
3d6499912f468a47db7e51e1faaed536549bf16fe9447677acf6a195b58959c9
-
SHA512
e8c15f73415434ec07d15c9999e09136102305f0a69cb32f09d3dc7f261d6cad7105f4276cf0e589c57bebadcd83b4da77ca54b6380061ffd6c351761074a1cf
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbep:q7Tc2NYHUrAwfMp3CDp
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/2524-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2528-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1992-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1992-28-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/2372-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-38-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1912-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-58-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2816-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2008-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1756-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1528-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2052-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2076-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1596-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/788-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2036-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1272-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1800-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3044-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1216-280-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2972-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1784-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1544-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-353-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2860-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2084-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2084-371-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2904-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-380-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2684-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-414-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1632-427-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1420-435-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-454-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2836-455-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2024-469-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-476-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2108-495-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-774-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/684-794-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/684-795-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2524 bbthnt.exe 1992 5dvdv.exe 2372 xrlrxfr.exe 1912 ddpvj.exe 2816 ffxlxxl.exe 2980 hbtbbh.exe 2724 pddjp.exe 2008 5lfflrx.exe 2600 btnhnn.exe 1756 ddvdv.exe 2884 rllxffr.exe 752 dvpvj.exe 1528 vpjvd.exe 1464 1ttbhh.exe 2052 5ntbhh.exe 1752 xrlfrlr.exe 1596 3nhhnt.exe 2076 xxllxlr.exe 1492 tnntbb.exe 788 1xlfxxf.exe 304 fflrffr.exe 2036 jdpdj.exe 1800 dvjjp.exe 1272 9ntnhn.exe 1184 vjppj.exe 1064 fxfrrrl.exe 1052 thtttt.exe 3044 thnhbt.exe 1216 vdpjj.exe 2204 lfrrxff.exe 1784 7bnbnh.exe 2972 rflrxxx.exe 1544 frxfllf.exe 2688 1vjdj.exe 2800 vddvp.exe 1552 1ffxxxl.exe 2736 thnttb.exe 2992 dpppp.exe 2612 ppvpv.exe 2860 3lxxrxl.exe 2084 1bbttt.exe 2904 ttnntb.exe 2804 5jvpj.exe 2664 rlxxlfl.exe 3056 ntbtbt.exe 2684 5pjdj.exe 2884 pdpjp.exe 752 xrlffff.exe 1632 nbntth.exe 1420 5vddd.exe 1424 3ppdv.exe 1984 xrllrlx.exe 2836 1xxxxrr.exe 3048 7btbbb.exe 2024 5dpdv.exe 2200 1dvvd.exe 584 fxfxfff.exe 2508 1ttthh.exe 2108 9nbhhh.exe 2588 ppjjp.exe 1308 rflfxrx.exe 1952 rxxlxxr.exe 1800 hbnntt.exe 1272 1dvjd.exe -
resource yara_rule behavioral1/memory/2528-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1992-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1992-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1912-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1756-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1596-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1596-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/788-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1272-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1064-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1784-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1544-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-371-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2904-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1420-435-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-456-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-495-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1536-580-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-655-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-680-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/532-693-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/684-794-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2436-834-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/940-837-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrxlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lflxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5djdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxflrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvvv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2528 wrote to memory of 2524 2528 3d6499912f468a47db7e51e1faaed536549bf16fe9447677acf6a195b58959c9.exe 30 PID 2528 wrote to memory of 2524 2528 3d6499912f468a47db7e51e1faaed536549bf16fe9447677acf6a195b58959c9.exe 30 PID 2528 wrote to memory of 2524 2528 3d6499912f468a47db7e51e1faaed536549bf16fe9447677acf6a195b58959c9.exe 30 PID 2528 wrote to memory of 2524 2528 3d6499912f468a47db7e51e1faaed536549bf16fe9447677acf6a195b58959c9.exe 30 PID 2524 wrote to memory of 1992 2524 bbthnt.exe 31 PID 2524 wrote to memory of 1992 2524 bbthnt.exe 31 PID 2524 wrote to memory of 1992 2524 bbthnt.exe 31 PID 2524 wrote to memory of 1992 2524 bbthnt.exe 31 PID 1992 wrote to memory of 2372 1992 5dvdv.exe 32 PID 1992 wrote to memory of 2372 1992 5dvdv.exe 32 PID 1992 wrote to memory of 2372 1992 5dvdv.exe 32 PID 1992 wrote to memory of 2372 1992 5dvdv.exe 32 PID 2372 wrote to memory of 1912 2372 xrlrxfr.exe 33 PID 2372 wrote to memory of 1912 2372 xrlrxfr.exe 33 PID 2372 wrote to memory of 1912 2372 xrlrxfr.exe 33 PID 2372 wrote to memory of 1912 2372 xrlrxfr.exe 33 PID 1912 wrote to memory of 2816 1912 ddpvj.exe 34 PID 1912 wrote to memory of 2816 1912 ddpvj.exe 34 PID 1912 wrote to memory of 2816 1912 ddpvj.exe 34 PID 1912 wrote to memory of 2816 1912 ddpvj.exe 34 PID 2816 wrote to memory of 2980 2816 ffxlxxl.exe 35 PID 2816 wrote to memory of 2980 2816 ffxlxxl.exe 35 PID 2816 wrote to memory of 2980 2816 ffxlxxl.exe 35 PID 2816 wrote to memory of 2980 2816 ffxlxxl.exe 35 PID 2980 wrote to memory of 2724 2980 hbtbbh.exe 36 PID 2980 wrote to memory of 2724 2980 hbtbbh.exe 36 PID 2980 wrote to memory of 2724 2980 hbtbbh.exe 36 PID 2980 wrote to memory of 2724 2980 hbtbbh.exe 36 PID 2724 wrote to memory of 2008 2724 pddjp.exe 37 PID 2724 wrote to memory of 2008 2724 pddjp.exe 37 PID 2724 wrote to memory of 2008 2724 pddjp.exe 37 PID 2724 wrote to memory of 2008 2724 pddjp.exe 37 PID 2008 wrote to memory of 2600 2008 5lfflrx.exe 38 PID 2008 wrote to memory of 2600 2008 5lfflrx.exe 38 PID 2008 wrote to memory of 2600 2008 5lfflrx.exe 38 PID 2008 wrote to memory of 2600 2008 5lfflrx.exe 38 PID 2600 wrote to memory of 1756 2600 btnhnn.exe 39 PID 2600 wrote to memory of 1756 2600 btnhnn.exe 39 PID 2600 wrote to memory of 1756 2600 btnhnn.exe 39 PID 2600 wrote to memory of 1756 2600 btnhnn.exe 39 PID 1756 wrote to memory of 2884 1756 ddvdv.exe 40 PID 1756 wrote to memory of 2884 1756 ddvdv.exe 40 PID 1756 wrote to memory of 2884 1756 ddvdv.exe 40 PID 1756 wrote to memory of 2884 1756 ddvdv.exe 40 PID 2884 wrote to memory of 752 2884 rllxffr.exe 41 PID 2884 wrote to memory of 752 2884 rllxffr.exe 41 PID 2884 wrote to memory of 752 2884 rllxffr.exe 41 PID 2884 wrote to memory of 752 2884 rllxffr.exe 41 PID 752 wrote to memory of 1528 752 dvpvj.exe 42 PID 752 wrote to memory of 1528 752 dvpvj.exe 42 PID 752 wrote to memory of 1528 752 dvpvj.exe 42 PID 752 wrote to memory of 1528 752 dvpvj.exe 42 PID 1528 wrote to memory of 1464 1528 vpjvd.exe 43 PID 1528 wrote to memory of 1464 1528 vpjvd.exe 43 PID 1528 wrote to memory of 1464 1528 vpjvd.exe 43 PID 1528 wrote to memory of 1464 1528 vpjvd.exe 43 PID 1464 wrote to memory of 2052 1464 1ttbhh.exe 44 PID 1464 wrote to memory of 2052 1464 1ttbhh.exe 44 PID 1464 wrote to memory of 2052 1464 1ttbhh.exe 44 PID 1464 wrote to memory of 2052 1464 1ttbhh.exe 44 PID 2052 wrote to memory of 1752 2052 5ntbhh.exe 45 PID 2052 wrote to memory of 1752 2052 5ntbhh.exe 45 PID 2052 wrote to memory of 1752 2052 5ntbhh.exe 45 PID 2052 wrote to memory of 1752 2052 5ntbhh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d6499912f468a47db7e51e1faaed536549bf16fe9447677acf6a195b58959c9.exe"C:\Users\Admin\AppData\Local\Temp\3d6499912f468a47db7e51e1faaed536549bf16fe9447677acf6a195b58959c9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\bbthnt.exec:\bbthnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\5dvdv.exec:\5dvdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\xrlrxfr.exec:\xrlrxfr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\ddpvj.exec:\ddpvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\ffxlxxl.exec:\ffxlxxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\hbtbbh.exec:\hbtbbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\pddjp.exec:\pddjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\5lfflrx.exec:\5lfflrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\btnhnn.exec:\btnhnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\ddvdv.exec:\ddvdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
\??\c:\rllxffr.exec:\rllxffr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\dvpvj.exec:\dvpvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
\??\c:\vpjvd.exec:\vpjvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\1ttbhh.exec:\1ttbhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
\??\c:\5ntbhh.exec:\5ntbhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\xrlfrlr.exec:\xrlfrlr.exe17⤵
- Executes dropped EXE
PID:1752 -
\??\c:\3nhhnt.exec:\3nhhnt.exe18⤵
- Executes dropped EXE
PID:1596 -
\??\c:\xxllxlr.exec:\xxllxlr.exe19⤵
- Executes dropped EXE
PID:2076 -
\??\c:\tnntbb.exec:\tnntbb.exe20⤵
- Executes dropped EXE
PID:1492 -
\??\c:\1xlfxxf.exec:\1xlfxxf.exe21⤵
- Executes dropped EXE
PID:788 -
\??\c:\fflrffr.exec:\fflrffr.exe22⤵
- Executes dropped EXE
PID:304 -
\??\c:\jdpdj.exec:\jdpdj.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2036 -
\??\c:\dvjjp.exec:\dvjjp.exe24⤵
- Executes dropped EXE
PID:1800 -
\??\c:\9ntnhn.exec:\9ntnhn.exe25⤵
- Executes dropped EXE
PID:1272 -
\??\c:\vjppj.exec:\vjppj.exe26⤵
- Executes dropped EXE
PID:1184 -
\??\c:\fxfrrrl.exec:\fxfrrrl.exe27⤵
- Executes dropped EXE
PID:1064 -
\??\c:\thtttt.exec:\thtttt.exe28⤵
- Executes dropped EXE
PID:1052 -
\??\c:\thnhbt.exec:\thnhbt.exe29⤵
- Executes dropped EXE
PID:3044 -
\??\c:\vdpjj.exec:\vdpjj.exe30⤵
- Executes dropped EXE
PID:1216 -
\??\c:\lfrrxff.exec:\lfrrxff.exe31⤵
- Executes dropped EXE
PID:2204 -
\??\c:\7bnbnh.exec:\7bnbnh.exe32⤵
- Executes dropped EXE
PID:1784 -
\??\c:\rflrxxx.exec:\rflrxxx.exe33⤵
- Executes dropped EXE
PID:2972 -
\??\c:\frxfllf.exec:\frxfllf.exe34⤵
- Executes dropped EXE
PID:1544 -
\??\c:\1vjdj.exec:\1vjdj.exe35⤵
- Executes dropped EXE
PID:2688 -
\??\c:\vddvp.exec:\vddvp.exe36⤵
- Executes dropped EXE
PID:2800 -
\??\c:\1ffxxxl.exec:\1ffxxxl.exe37⤵
- Executes dropped EXE
PID:1552 -
\??\c:\thnttb.exec:\thnttb.exe38⤵
- Executes dropped EXE
PID:2736 -
\??\c:\dpppp.exec:\dpppp.exe39⤵
- Executes dropped EXE
PID:2992 -
\??\c:\ppvpv.exec:\ppvpv.exe40⤵
- Executes dropped EXE
PID:2612 -
\??\c:\3lxxrxl.exec:\3lxxrxl.exe41⤵
- Executes dropped EXE
PID:2860 -
\??\c:\1bbttt.exec:\1bbttt.exe42⤵
- Executes dropped EXE
PID:2084 -
\??\c:\ttnntb.exec:\ttnntb.exe43⤵
- Executes dropped EXE
PID:2904 -
\??\c:\5jvpj.exec:\5jvpj.exe44⤵
- Executes dropped EXE
PID:2804 -
\??\c:\rlxxlfl.exec:\rlxxlfl.exe45⤵
- Executes dropped EXE
PID:2664 -
\??\c:\ntbtbt.exec:\ntbtbt.exe46⤵
- Executes dropped EXE
PID:3056 -
\??\c:\5pjdj.exec:\5pjdj.exe47⤵
- Executes dropped EXE
PID:2684 -
\??\c:\pdpjp.exec:\pdpjp.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2884 -
\??\c:\xrlffff.exec:\xrlffff.exe49⤵
- Executes dropped EXE
PID:752 -
\??\c:\nbntth.exec:\nbntth.exe50⤵
- Executes dropped EXE
PID:1632 -
\??\c:\5vddd.exec:\5vddd.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1420 -
\??\c:\3ppdv.exec:\3ppdv.exe52⤵
- Executes dropped EXE
PID:1424 -
\??\c:\xrllrlx.exec:\xrllrlx.exe53⤵
- Executes dropped EXE
PID:1984 -
\??\c:\1xxxxrr.exec:\1xxxxrr.exe54⤵
- Executes dropped EXE
PID:2836 -
\??\c:\7btbbb.exec:\7btbbb.exe55⤵
- Executes dropped EXE
PID:3048 -
\??\c:\5dpdv.exec:\5dpdv.exe56⤵
- Executes dropped EXE
PID:2024 -
\??\c:\1dvvd.exec:\1dvvd.exe57⤵
- Executes dropped EXE
PID:2200 -
\??\c:\fxfxfff.exec:\fxfxfff.exe58⤵
- Executes dropped EXE
PID:584 -
\??\c:\1ttthh.exec:\1ttthh.exe59⤵
- Executes dropped EXE
PID:2508 -
\??\c:\9nbhhh.exec:\9nbhhh.exe60⤵
- Executes dropped EXE
PID:2108 -
\??\c:\ppjjp.exec:\ppjjp.exe61⤵
- Executes dropped EXE
PID:2588 -
\??\c:\rflfxrx.exec:\rflfxrx.exe62⤵
- Executes dropped EXE
PID:1308 -
\??\c:\rxxlxxr.exec:\rxxlxxr.exe63⤵
- Executes dropped EXE
PID:1952 -
\??\c:\hbnntt.exec:\hbnntt.exe64⤵
- Executes dropped EXE
PID:1800 -
\??\c:\1dvjd.exec:\1dvjd.exe65⤵
- Executes dropped EXE
PID:1272 -
\??\c:\vpppj.exec:\vpppj.exe66⤵PID:2500
-
\??\c:\fxrrflx.exec:\fxrrflx.exe67⤵PID:2460
-
\??\c:\hbnnnn.exec:\hbnnnn.exe68⤵PID:1904
-
\??\c:\bnhhhh.exec:\bnhhhh.exe69⤵PID:2292
-
\??\c:\1vpjp.exec:\1vpjp.exe70⤵PID:1416
-
\??\c:\flrlrfl.exec:\flrlrfl.exe71⤵PID:3032
-
\??\c:\frfxxxx.exec:\frfxxxx.exe72⤵PID:1692
-
\??\c:\bhnhbt.exec:\bhnhbt.exe73⤵PID:1796
-
\??\c:\7nbbnn.exec:\7nbbnn.exe74⤵PID:1776
-
\??\c:\pjpjj.exec:\pjpjj.exe75⤵PID:1536
-
\??\c:\lxlrrrl.exec:\lxlrrrl.exe76⤵PID:2540
-
\??\c:\fxrrffl.exec:\fxrrffl.exe77⤵PID:2964
-
\??\c:\httbht.exec:\httbht.exe78⤵PID:1992
-
\??\c:\thnbnn.exec:\thnbnn.exe79⤵PID:2396
-
\??\c:\vjddj.exec:\vjddj.exe80⤵PID:1944
-
\??\c:\fxlrxxf.exec:\fxlrxxf.exe81⤵PID:2880
-
\??\c:\fxfxrlf.exec:\fxfxrlf.exe82⤵PID:2472
-
\??\c:\hnbtbt.exec:\hnbtbt.exe83⤵PID:2820
-
\??\c:\vjjdd.exec:\vjjdd.exe84⤵PID:2872
-
\??\c:\5vjjj.exec:\5vjjj.exe85⤵PID:2860
-
\??\c:\flfxxrr.exec:\flfxxrr.exe86⤵PID:2764
-
\??\c:\nbnhhb.exec:\nbnhhb.exe87⤵PID:2744
-
\??\c:\nbhbbt.exec:\nbhbbt.exe88⤵PID:2628
-
\??\c:\1jpjd.exec:\1jpjd.exe89⤵PID:2604
-
\??\c:\3xllfxf.exec:\3xllfxf.exe90⤵PID:380
-
\??\c:\9rllrrr.exec:\9rllrrr.exe91⤵PID:2300
-
\??\c:\hnbnnh.exec:\hnbnnh.exe92⤵PID:2344
-
\??\c:\9pddv.exec:\9pddv.exe93⤵PID:532
-
\??\c:\jvdvv.exec:\jvdvv.exe94⤵PID:1528
-
\??\c:\xlfflrx.exec:\xlfflrx.exe95⤵PID:2352
-
\??\c:\rxlffxx.exec:\rxlffxx.exe96⤵PID:1000
-
\??\c:\7nnnbt.exec:\7nnnbt.exe97⤵PID:1888
-
\??\c:\pdpjj.exec:\pdpjj.exe98⤵PID:2676
-
\??\c:\fxffffl.exec:\fxffffl.exe99⤵PID:1584
-
\??\c:\frffrlr.exec:\frffrlr.exe100⤵PID:2796
-
\??\c:\hhbbnn.exec:\hhbbnn.exe101⤵PID:2924
-
\??\c:\pdjdv.exec:\pdjdv.exe102⤵
- System Location Discovery: System Language Discovery
PID:2200 -
\??\c:\3rflrrx.exec:\3rflrrx.exe103⤵PID:840
-
\??\c:\xrfxxxx.exec:\xrfxxxx.exe104⤵PID:2508
-
\??\c:\bnbbbb.exec:\bnbbbb.exe105⤵PID:2108
-
\??\c:\djvvv.exec:\djvvv.exe106⤵PID:2956
-
\??\c:\7pjjp.exec:\7pjjp.exe107⤵PID:684
-
\??\c:\rlrllfl.exec:\rlrllfl.exe108⤵PID:2576
-
\??\c:\nnbhth.exec:\nnbhth.exe109⤵PID:1800
-
\??\c:\9ttthh.exec:\9ttthh.exe110⤵PID:2792
-
\??\c:\dpjjj.exec:\dpjjj.exe111⤵PID:940
-
\??\c:\xxllrfl.exec:\xxllrfl.exe112⤵PID:3000
-
\??\c:\lrflxrr.exec:\lrflxrr.exe113⤵PID:1728
-
\??\c:\7bbnhb.exec:\7bbnhb.exe114⤵PID:2436
-
\??\c:\1pjpp.exec:\1pjpp.exe115⤵PID:2236
-
\??\c:\vdddv.exec:\vdddv.exe116⤵PID:1792
-
\??\c:\rrlxflr.exec:\rrlxflr.exe117⤵PID:2136
-
\??\c:\tbbnhb.exec:\tbbnhb.exe118⤵PID:2092
-
\??\c:\7thhnn.exec:\7thhnn.exe119⤵PID:2376
-
\??\c:\djddp.exec:\djddp.exe120⤵PID:2920
-
\??\c:\5frrrrx.exec:\5frrrrx.exe121⤵PID:2316
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-