Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
28/12/2024, 22:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4bb3db868066a340ed6717e75868f10d4c6d5c4ae730d36e38fd7bd4145a1d2d.exe
Resource
win7-20240708-en
windows7-x64
7 signatures
150 seconds
General
-
Target
4bb3db868066a340ed6717e75868f10d4c6d5c4ae730d36e38fd7bd4145a1d2d.exe
-
Size
455KB
-
MD5
41406128b06ca173d4f8953eac69a349
-
SHA1
d16168f2a7c4900440a344cf34cb5e174acb1acb
-
SHA256
4bb3db868066a340ed6717e75868f10d4c6d5c4ae730d36e38fd7bd4145a1d2d
-
SHA512
0eced094dff7c3b2c23037cac0acf119a384d4ef1add13da7aa8de9573333438d7ec59660144607ba15cc4bd21f6cdcd099f2269709c2e89bcf1ef0c301ab957
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeTx:q7Tc2NYHUrAwfMp3CD1
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/2412-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2156-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2472-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2140-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1304-46-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1304-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-84-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2936-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/836-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1084-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2068-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1216-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1744-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1008-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2024-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1856-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/316-262-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/3052-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1560-279-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1668-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1736-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2304-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/836-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-408-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1080-416-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2712-437-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2024-515-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2996-633-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-739-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/568-790-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1964-835-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1964-854-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1644-989-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/3060-1104-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1724-1128-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1636-1230-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2788-1256-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1768-1263-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2156 g8602.exe 2472 dpvvj.exe 2140 vjpvv.exe 1304 tnnthn.exe 2832 082880.exe 2656 lfflxfx.exe 2696 9jvvd.exe 2936 jvpvp.exe 836 7pvdd.exe 1084 jvjvv.exe 2788 dpdvd.exe 1860 4244002.exe 2068 hbbbbb.exe 2764 g2040.exe 1216 s8440.exe 2908 fxxlfrr.exe 2920 nbtnhn.exe 2628 1fllxrl.exe 1744 46840.exe 1428 42440.exe 380 480688.exe 2952 ttntbb.exe 948 4666600.exe 1008 7pjjp.exe 2024 rlxflrf.exe 624 rfxflfl.exe 1856 08002.exe 316 0866228.exe 3052 vpddp.exe 1560 u866228.exe 1668 pvjjj.exe 2256 02084.exe 1600 420688.exe 1736 btnntt.exe 2304 646288.exe 2244 9pjjp.exe 2680 xllffxf.exe 1304 2648402.exe 2820 9nbtbh.exe 2884 6062044.exe 2656 k48400.exe 2696 680006.exe 2708 482840.exe 2540 5bhbhb.exe 836 llffffr.exe 2560 1lflrxl.exe 2772 7jpvv.exe 2592 3thhnn.exe 1080 480628.exe 1264 k08062.exe 1760 6084406.exe 1060 pdppp.exe 2712 846284.exe 2896 8640284.exe 2920 vjvvv.exe 2184 xrlrxxf.exe 2492 fxxfrlx.exe 1712 0806440.exe 3016 jjppd.exe 688 vdjjj.exe 2336 44280.exe 948 5vppp.exe 1076 rrllrxl.exe 1320 48066.exe -
resource yara_rule behavioral1/memory/2412-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1304-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/836-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1084-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1216-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1008-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/624-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1856-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1560-279-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/1668-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/836-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-515-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2072-576-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-589-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-602-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-633-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-683-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-739-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1404-803-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-810-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-835-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/944-1014-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-1039-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-1078-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-1091-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-1123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-1198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/836-1205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-1230-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/1768-1263-0x0000000000220000-0x000000000024A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xrfrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0248440.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26400.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 00246.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlfllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlxjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language w80062.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnttnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86402.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrxrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68002.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xlrrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 02084.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2228204.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language q64062.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 826806.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2412 wrote to memory of 2156 2412 4bb3db868066a340ed6717e75868f10d4c6d5c4ae730d36e38fd7bd4145a1d2d.exe 31 PID 2412 wrote to memory of 2156 2412 4bb3db868066a340ed6717e75868f10d4c6d5c4ae730d36e38fd7bd4145a1d2d.exe 31 PID 2412 wrote to memory of 2156 2412 4bb3db868066a340ed6717e75868f10d4c6d5c4ae730d36e38fd7bd4145a1d2d.exe 31 PID 2412 wrote to memory of 2156 2412 4bb3db868066a340ed6717e75868f10d4c6d5c4ae730d36e38fd7bd4145a1d2d.exe 31 PID 2156 wrote to memory of 2472 2156 g8602.exe 32 PID 2156 wrote to memory of 2472 2156 g8602.exe 32 PID 2156 wrote to memory of 2472 2156 g8602.exe 32 PID 2156 wrote to memory of 2472 2156 g8602.exe 32 PID 2472 wrote to memory of 2140 2472 dpvvj.exe 33 PID 2472 wrote to memory of 2140 2472 dpvvj.exe 33 PID 2472 wrote to memory of 2140 2472 dpvvj.exe 33 PID 2472 wrote to memory of 2140 2472 dpvvj.exe 33 PID 2140 wrote to memory of 1304 2140 vjpvv.exe 34 PID 2140 wrote to memory of 1304 2140 vjpvv.exe 34 PID 2140 wrote to memory of 1304 2140 vjpvv.exe 34 PID 2140 wrote to memory of 1304 2140 vjpvv.exe 34 PID 1304 wrote to memory of 2832 1304 tnnthn.exe 35 PID 1304 wrote to memory of 2832 1304 tnnthn.exe 35 PID 1304 wrote to memory of 2832 1304 tnnthn.exe 35 PID 1304 wrote to memory of 2832 1304 tnnthn.exe 35 PID 2832 wrote to memory of 2656 2832 082880.exe 36 PID 2832 wrote to memory of 2656 2832 082880.exe 36 PID 2832 wrote to memory of 2656 2832 082880.exe 36 PID 2832 wrote to memory of 2656 2832 082880.exe 36 PID 2656 wrote to memory of 2696 2656 lfflxfx.exe 37 PID 2656 wrote to memory of 2696 2656 lfflxfx.exe 37 PID 2656 wrote to memory of 2696 2656 lfflxfx.exe 37 PID 2656 wrote to memory of 2696 2656 lfflxfx.exe 37 PID 2696 wrote to memory of 2936 2696 9jvvd.exe 38 PID 2696 wrote to memory of 2936 2696 9jvvd.exe 38 PID 2696 wrote to memory of 2936 2696 9jvvd.exe 38 PID 2696 wrote to memory of 2936 2696 9jvvd.exe 38 PID 2936 wrote to memory of 836 2936 jvpvp.exe 39 PID 2936 wrote to memory of 836 2936 jvpvp.exe 39 PID 2936 wrote to memory of 836 2936 jvpvp.exe 39 PID 2936 wrote to memory of 836 2936 jvpvp.exe 39 PID 836 wrote to memory of 1084 836 7pvdd.exe 40 PID 836 wrote to memory of 1084 836 7pvdd.exe 40 PID 836 wrote to memory of 1084 836 7pvdd.exe 40 PID 836 wrote to memory of 1084 836 7pvdd.exe 40 PID 1084 wrote to memory of 2788 1084 jvjvv.exe 41 PID 1084 wrote to memory of 2788 1084 jvjvv.exe 41 PID 1084 wrote to memory of 2788 1084 jvjvv.exe 41 PID 1084 wrote to memory of 2788 1084 jvjvv.exe 41 PID 2788 wrote to memory of 1860 2788 dpdvd.exe 42 PID 2788 wrote to memory of 1860 2788 dpdvd.exe 42 PID 2788 wrote to memory of 1860 2788 dpdvd.exe 42 PID 2788 wrote to memory of 1860 2788 dpdvd.exe 42 PID 1860 wrote to memory of 2068 1860 4244002.exe 43 PID 1860 wrote to memory of 2068 1860 4244002.exe 43 PID 1860 wrote to memory of 2068 1860 4244002.exe 43 PID 1860 wrote to memory of 2068 1860 4244002.exe 43 PID 2068 wrote to memory of 2764 2068 hbbbbb.exe 44 PID 2068 wrote to memory of 2764 2068 hbbbbb.exe 44 PID 2068 wrote to memory of 2764 2068 hbbbbb.exe 44 PID 2068 wrote to memory of 2764 2068 hbbbbb.exe 44 PID 2764 wrote to memory of 1216 2764 g2040.exe 45 PID 2764 wrote to memory of 1216 2764 g2040.exe 45 PID 2764 wrote to memory of 1216 2764 g2040.exe 45 PID 2764 wrote to memory of 1216 2764 g2040.exe 45 PID 1216 wrote to memory of 2908 1216 s8440.exe 46 PID 1216 wrote to memory of 2908 1216 s8440.exe 46 PID 1216 wrote to memory of 2908 1216 s8440.exe 46 PID 1216 wrote to memory of 2908 1216 s8440.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\4bb3db868066a340ed6717e75868f10d4c6d5c4ae730d36e38fd7bd4145a1d2d.exe"C:\Users\Admin\AppData\Local\Temp\4bb3db868066a340ed6717e75868f10d4c6d5c4ae730d36e38fd7bd4145a1d2d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\g8602.exec:\g8602.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\dpvvj.exec:\dpvvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\vjpvv.exec:\vjpvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\tnnthn.exec:\tnnthn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
\??\c:\082880.exec:\082880.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\lfflxfx.exec:\lfflxfx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\9jvvd.exec:\9jvvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\jvpvp.exec:\jvpvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\7pvdd.exec:\7pvdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
\??\c:\jvjvv.exec:\jvjvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
\??\c:\dpdvd.exec:\dpdvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\4244002.exec:\4244002.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\hbbbbb.exec:\hbbbbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\g2040.exec:\g2040.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\s8440.exec:\s8440.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\fxxlfrr.exec:\fxxlfrr.exe17⤵
- Executes dropped EXE
PID:2908 -
\??\c:\nbtnhn.exec:\nbtnhn.exe18⤵
- Executes dropped EXE
PID:2920 -
\??\c:\1fllxrl.exec:\1fllxrl.exe19⤵
- Executes dropped EXE
PID:2628 -
\??\c:\46840.exec:\46840.exe20⤵
- Executes dropped EXE
PID:1744 -
\??\c:\42440.exec:\42440.exe21⤵
- Executes dropped EXE
PID:1428 -
\??\c:\480688.exec:\480688.exe22⤵
- Executes dropped EXE
PID:380 -
\??\c:\ttntbb.exec:\ttntbb.exe23⤵
- Executes dropped EXE
PID:2952 -
\??\c:\4666600.exec:\4666600.exe24⤵
- Executes dropped EXE
PID:948 -
\??\c:\7pjjp.exec:\7pjjp.exe25⤵
- Executes dropped EXE
PID:1008 -
\??\c:\rlxflrf.exec:\rlxflrf.exe26⤵
- Executes dropped EXE
PID:2024 -
\??\c:\rfxflfl.exec:\rfxflfl.exe27⤵
- Executes dropped EXE
PID:624 -
\??\c:\08002.exec:\08002.exe28⤵
- Executes dropped EXE
PID:1856 -
\??\c:\0866228.exec:\0866228.exe29⤵
- Executes dropped EXE
PID:316 -
\??\c:\vpddp.exec:\vpddp.exe30⤵
- Executes dropped EXE
PID:3052 -
\??\c:\u866228.exec:\u866228.exe31⤵
- Executes dropped EXE
PID:1560 -
\??\c:\pvjjj.exec:\pvjjj.exe32⤵
- Executes dropped EXE
PID:1668 -
\??\c:\02084.exec:\02084.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2256 -
\??\c:\420688.exec:\420688.exe34⤵
- Executes dropped EXE
PID:1600 -
\??\c:\btnntt.exec:\btnntt.exe35⤵
- Executes dropped EXE
PID:1736 -
\??\c:\646288.exec:\646288.exe36⤵
- Executes dropped EXE
PID:2304 -
\??\c:\9pjjp.exec:\9pjjp.exe37⤵
- Executes dropped EXE
PID:2244 -
\??\c:\xllffxf.exec:\xllffxf.exe38⤵
- Executes dropped EXE
PID:2680 -
\??\c:\2648402.exec:\2648402.exe39⤵
- Executes dropped EXE
PID:1304 -
\??\c:\9nbtbh.exec:\9nbtbh.exe40⤵
- Executes dropped EXE
PID:2820 -
\??\c:\6062044.exec:\6062044.exe41⤵
- Executes dropped EXE
PID:2884 -
\??\c:\k48400.exec:\k48400.exe42⤵
- Executes dropped EXE
PID:2656 -
\??\c:\680006.exec:\680006.exe43⤵
- Executes dropped EXE
PID:2696 -
\??\c:\482840.exec:\482840.exe44⤵
- Executes dropped EXE
PID:2708 -
\??\c:\5bhbhb.exec:\5bhbhb.exe45⤵
- Executes dropped EXE
PID:2540 -
\??\c:\llffffr.exec:\llffffr.exe46⤵
- Executes dropped EXE
PID:836 -
\??\c:\1lflrxl.exec:\1lflrxl.exe47⤵
- Executes dropped EXE
PID:2560 -
\??\c:\7jpvv.exec:\7jpvv.exe48⤵
- Executes dropped EXE
PID:2772 -
\??\c:\3thhnn.exec:\3thhnn.exe49⤵
- Executes dropped EXE
PID:2592 -
\??\c:\480628.exec:\480628.exe50⤵
- Executes dropped EXE
PID:1080 -
\??\c:\k08062.exec:\k08062.exe51⤵
- Executes dropped EXE
PID:1264 -
\??\c:\6084406.exec:\6084406.exe52⤵
- Executes dropped EXE
PID:1760 -
\??\c:\pdppp.exec:\pdppp.exe53⤵
- Executes dropped EXE
PID:1060 -
\??\c:\846284.exec:\846284.exe54⤵
- Executes dropped EXE
PID:2712 -
\??\c:\8640284.exec:\8640284.exe55⤵
- Executes dropped EXE
PID:2896 -
\??\c:\vjvvv.exec:\vjvvv.exe56⤵
- Executes dropped EXE
PID:2920 -
\??\c:\xrlrxxf.exec:\xrlrxxf.exe57⤵
- Executes dropped EXE
PID:2184 -
\??\c:\fxxfrlx.exec:\fxxfrlx.exe58⤵
- Executes dropped EXE
PID:2492 -
\??\c:\0806440.exec:\0806440.exe59⤵
- Executes dropped EXE
PID:1712 -
\??\c:\jjppd.exec:\jjppd.exe60⤵
- Executes dropped EXE
PID:3016 -
\??\c:\vdjjj.exec:\vdjjj.exe61⤵
- Executes dropped EXE
PID:688 -
\??\c:\44280.exec:\44280.exe62⤵
- Executes dropped EXE
PID:2336 -
\??\c:\5vppp.exec:\5vppp.exe63⤵
- Executes dropped EXE
PID:948 -
\??\c:\rrllrxl.exec:\rrllrxl.exe64⤵
- Executes dropped EXE
PID:1076 -
\??\c:\48066.exec:\48066.exe65⤵
- Executes dropped EXE
PID:1320 -
\??\c:\ddpdd.exec:\ddpdd.exe66⤵PID:2024
-
\??\c:\m2064.exec:\m2064.exe67⤵PID:1780
-
\??\c:\8824068.exec:\8824068.exe68⤵PID:3024
-
\??\c:\e82444.exec:\e82444.exe69⤵PID:2432
-
\??\c:\fflffxf.exec:\fflffxf.exe70⤵PID:2968
-
\??\c:\s8220.exec:\s8220.exe71⤵PID:1740
-
\??\c:\604640.exec:\604640.exe72⤵PID:1964
-
\??\c:\48662.exec:\48662.exe73⤵PID:1560
-
\??\c:\826806.exec:\826806.exe74⤵
- System Location Discovery: System Language Discovery
PID:868 -
\??\c:\httbbt.exec:\httbbt.exe75⤵PID:2412
-
\??\c:\8080622.exec:\8080622.exe76⤵PID:2072
-
\??\c:\8640222.exec:\8640222.exe77⤵PID:2296
-
\??\c:\a8628.exec:\a8628.exe78⤵PID:1920
-
\??\c:\04600.exec:\04600.exe79⤵PID:2140
-
\??\c:\dpddd.exec:\dpddd.exe80⤵PID:2244
-
\??\c:\606226.exec:\606226.exe81⤵PID:2680
-
\??\c:\04202.exec:\04202.exe82⤵PID:2684
-
\??\c:\1lxlrll.exec:\1lxlrll.exe83⤵PID:2832
-
\??\c:\0428624.exec:\0428624.exe84⤵PID:2996
-
\??\c:\xlfflfl.exec:\xlfflfl.exe85⤵PID:1928
-
\??\c:\pvjvp.exec:\pvjvp.exe86⤵PID:2904
-
\??\c:\1hntbh.exec:\1hntbh.exe87⤵PID:2532
-
\??\c:\1ttbnt.exec:\1ttbnt.exe88⤵PID:2584
-
\??\c:\pppdv.exec:\pppdv.exe89⤵PID:1708
-
\??\c:\i600002.exec:\i600002.exe90⤵PID:2724
-
\??\c:\xrxxxxl.exec:\xrxxxxl.exe91⤵PID:1640
-
\??\c:\60840.exec:\60840.exe92⤵PID:2772
-
\??\c:\7hbbtb.exec:\7hbbtb.exe93⤵PID:2592
-
\??\c:\44286.exec:\44286.exe94⤵PID:1080
-
\??\c:\4868064.exec:\4868064.exe95⤵PID:2764
-
\??\c:\482844.exec:\482844.exe96⤵PID:1644
-
\??\c:\tbtnnh.exec:\tbtnnh.exe97⤵PID:1216
-
\??\c:\3pdjv.exec:\3pdjv.exe98⤵PID:2712
-
\??\c:\ddvvv.exec:\ddvvv.exe99⤵PID:2908
-
\??\c:\424406.exec:\424406.exe100⤵PID:2076
-
\??\c:\o244828.exec:\o244828.exe101⤵PID:2964
-
\??\c:\646288.exec:\646288.exe102⤵PID:1480
-
\??\c:\7xlflfl.exec:\7xlflfl.exe103⤵PID:2492
-
\??\c:\2046842.exec:\2046842.exe104⤵PID:2944
-
\??\c:\2684662.exec:\2684662.exe105⤵PID:1244
-
\??\c:\1vdvv.exec:\1vdvv.exe106⤵PID:680
-
\??\c:\rllflff.exec:\rllflff.exe107⤵PID:2500
-
\??\c:\nhbhth.exec:\nhbhth.exe108⤵PID:1720
-
\??\c:\9btntt.exec:\9btntt.exe109⤵PID:568
-
\??\c:\0248440.exec:\0248440.exe110⤵
- System Location Discovery: System Language Discovery
PID:1892 -
\??\c:\3rllrlx.exec:\3rllrlx.exe111⤵PID:2252
-
\??\c:\btntnt.exec:\btntnt.exe112⤵PID:1404
-
\??\c:\s4624.exec:\s4624.exe113⤵PID:1984
-
\??\c:\pjvdj.exec:\pjvdj.exe114⤵PID:316
-
\??\c:\04486.exec:\04486.exe115⤵PID:2208
-
\??\c:\fxlrlrf.exec:\fxlrlrf.exe116⤵PID:1964
-
\??\c:\9btthn.exec:\9btthn.exe117⤵PID:344
-
\??\c:\xfxfxlf.exec:\xfxfxlf.exe118⤵PID:1972
-
\??\c:\lfrlrrf.exec:\lfrlrrf.exe119⤵PID:2468
-
\??\c:\dpjvv.exec:\dpjvv.exe120⤵PID:2156
-
\??\c:\42024.exec:\42024.exe121⤵PID:2720
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-