Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
28/12/2024, 23:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
518b91b19264b7bf5892ff68de664f3c8e4db4659ae05534259dd927a9d48c3e.exe
Resource
win7-20240708-en
windows7-x64
7 signatures
150 seconds
General
-
Target
518b91b19264b7bf5892ff68de664f3c8e4db4659ae05534259dd927a9d48c3e.exe
-
Size
454KB
-
MD5
6ccbdd72fc864773cc3a3380a866545a
-
SHA1
d059e5ecc82f7ce23a44ffbe9af3dfdd80bce032
-
SHA256
518b91b19264b7bf5892ff68de664f3c8e4db4659ae05534259dd927a9d48c3e
-
SHA512
75ff9bf541dee70bf8c322594ea932794bf7106e3a25549e3e4155b2ebdf9bdd36ba4aceff9ca73bcae61f8add857b9b6d39a969b1e73bcdc63179ba342657c2
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeH:q7Tc2NYHUrAwfMp3CDH
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 51 IoCs
resource yara_rule behavioral1/memory/2280-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/556-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/556-16-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2952-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2352-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3040-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1864-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2120-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/332-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1152-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1320-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1384-238-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1212-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1748-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-327-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2720-341-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1456-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-377-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3040-401-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1448-423-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1176-481-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1608-507-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1628-532-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1284-615-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2564-622-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2644-648-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2644-667-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2472-728-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1336-779-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2532-867-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2532-872-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2176-878-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2976-904-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2892-918-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2920-925-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1624-969-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1008-1063-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/976-1069-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1564-1158-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 556 vddjv.exe 2952 pjvvj.exe 2352 thbbnn.exe 2760 02286.exe 2812 208888.exe 2960 q64088.exe 3064 64668.exe 2844 264462.exe 2620 642806.exe 3040 xfflrrf.exe 1864 c462228.exe 2944 bttbnt.exe 2164 ddpvd.exe 2860 82068.exe 1920 08488.exe 1952 jdpjj.exe 2120 9pvpv.exe 332 c682888.exe 1704 xlrrfxf.exe 2972 lfrxfrx.exe 780 htnbtn.exe 2084 9thhtn.exe 1152 48044.exe 1320 rfrrrrr.exe 2588 rlrxffl.exe 1384 xrffffl.exe 1788 g2884.exe 2236 lxlxlfl.exe 2152 64606.exe 3060 60462.exe 2028 2066662.exe 1212 3vjdj.exe 1748 208460.exe 2160 64224.exe 2516 4824282.exe 2080 k26844.exe 3068 20068.exe 2348 262048.exe 2720 0862884.exe 2808 fxllrrx.exe 1456 hbnnht.exe 2884 lxrrxxf.exe 2712 jvjdj.exe 3064 tnbbhh.exe 2844 20284.exe 3048 fxxfxfl.exe 1620 nhbhhh.exe 3040 rrxxllx.exe 2424 082844.exe 1736 2220286.exe 1448 224284.exe 1652 3nhtth.exe 1856 406466.exe 2376 o422002.exe 2448 864022.exe 828 q00240.exe 1640 jjjvd.exe 332 vvppv.exe 652 nhtbhn.exe 1176 i640222.exe 236 llxxxrx.exe 1336 k42626.exe 1048 tnbnhh.exe 1608 084402.exe -
resource yara_rule behavioral1/memory/556-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/556-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1864-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/332-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1152-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1320-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1384-240-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1212-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1456-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1448-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1176-481-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-507-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-532-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1572-539-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-582-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1284-608-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-728-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-790-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-867-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2532-872-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-878-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2892-918-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2688-956-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1992-988-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-1049-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1260-1108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/860-1234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1992-1274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-1281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-1300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-1313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-1339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1320-1346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/904-1371-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfllrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxllllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language u866846.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0046464.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 642806.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48802.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48208.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6466440.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2280 wrote to memory of 556 2280 518b91b19264b7bf5892ff68de664f3c8e4db4659ae05534259dd927a9d48c3e.exe 30 PID 2280 wrote to memory of 556 2280 518b91b19264b7bf5892ff68de664f3c8e4db4659ae05534259dd927a9d48c3e.exe 30 PID 2280 wrote to memory of 556 2280 518b91b19264b7bf5892ff68de664f3c8e4db4659ae05534259dd927a9d48c3e.exe 30 PID 2280 wrote to memory of 556 2280 518b91b19264b7bf5892ff68de664f3c8e4db4659ae05534259dd927a9d48c3e.exe 30 PID 556 wrote to memory of 2952 556 vddjv.exe 31 PID 556 wrote to memory of 2952 556 vddjv.exe 31 PID 556 wrote to memory of 2952 556 vddjv.exe 31 PID 556 wrote to memory of 2952 556 vddjv.exe 31 PID 2952 wrote to memory of 2352 2952 pjvvj.exe 32 PID 2952 wrote to memory of 2352 2952 pjvvj.exe 32 PID 2952 wrote to memory of 2352 2952 pjvvj.exe 32 PID 2952 wrote to memory of 2352 2952 pjvvj.exe 32 PID 2352 wrote to memory of 2760 2352 thbbnn.exe 33 PID 2352 wrote to memory of 2760 2352 thbbnn.exe 33 PID 2352 wrote to memory of 2760 2352 thbbnn.exe 33 PID 2352 wrote to memory of 2760 2352 thbbnn.exe 33 PID 2760 wrote to memory of 2812 2760 02286.exe 34 PID 2760 wrote to memory of 2812 2760 02286.exe 34 PID 2760 wrote to memory of 2812 2760 02286.exe 34 PID 2760 wrote to memory of 2812 2760 02286.exe 34 PID 2812 wrote to memory of 2960 2812 208888.exe 35 PID 2812 wrote to memory of 2960 2812 208888.exe 35 PID 2812 wrote to memory of 2960 2812 208888.exe 35 PID 2812 wrote to memory of 2960 2812 208888.exe 35 PID 2960 wrote to memory of 3064 2960 q64088.exe 36 PID 2960 wrote to memory of 3064 2960 q64088.exe 36 PID 2960 wrote to memory of 3064 2960 q64088.exe 36 PID 2960 wrote to memory of 3064 2960 q64088.exe 36 PID 3064 wrote to memory of 2844 3064 64668.exe 37 PID 3064 wrote to memory of 2844 3064 64668.exe 37 PID 3064 wrote to memory of 2844 3064 64668.exe 37 PID 3064 wrote to memory of 2844 3064 64668.exe 37 PID 2844 wrote to memory of 2620 2844 264462.exe 38 PID 2844 wrote to memory of 2620 2844 264462.exe 38 PID 2844 wrote to memory of 2620 2844 264462.exe 38 PID 2844 wrote to memory of 2620 2844 264462.exe 38 PID 2620 wrote to memory of 3040 2620 642806.exe 39 PID 2620 wrote to memory of 3040 2620 642806.exe 39 PID 2620 wrote to memory of 3040 2620 642806.exe 39 PID 2620 wrote to memory of 3040 2620 642806.exe 39 PID 3040 wrote to memory of 1864 3040 xfflrrf.exe 40 PID 3040 wrote to memory of 1864 3040 xfflrrf.exe 40 PID 3040 wrote to memory of 1864 3040 xfflrrf.exe 40 PID 3040 wrote to memory of 1864 3040 xfflrrf.exe 40 PID 1864 wrote to memory of 2944 1864 c462228.exe 41 PID 1864 wrote to memory of 2944 1864 c462228.exe 41 PID 1864 wrote to memory of 2944 1864 c462228.exe 41 PID 1864 wrote to memory of 2944 1864 c462228.exe 41 PID 2944 wrote to memory of 2164 2944 bttbnt.exe 42 PID 2944 wrote to memory of 2164 2944 bttbnt.exe 42 PID 2944 wrote to memory of 2164 2944 bttbnt.exe 42 PID 2944 wrote to memory of 2164 2944 bttbnt.exe 42 PID 2164 wrote to memory of 2860 2164 ddpvd.exe 43 PID 2164 wrote to memory of 2860 2164 ddpvd.exe 43 PID 2164 wrote to memory of 2860 2164 ddpvd.exe 43 PID 2164 wrote to memory of 2860 2164 ddpvd.exe 43 PID 2860 wrote to memory of 1920 2860 82068.exe 44 PID 2860 wrote to memory of 1920 2860 82068.exe 44 PID 2860 wrote to memory of 1920 2860 82068.exe 44 PID 2860 wrote to memory of 1920 2860 82068.exe 44 PID 1920 wrote to memory of 1952 1920 08488.exe 45 PID 1920 wrote to memory of 1952 1920 08488.exe 45 PID 1920 wrote to memory of 1952 1920 08488.exe 45 PID 1920 wrote to memory of 1952 1920 08488.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\518b91b19264b7bf5892ff68de664f3c8e4db4659ae05534259dd927a9d48c3e.exe"C:\Users\Admin\AppData\Local\Temp\518b91b19264b7bf5892ff68de664f3c8e4db4659ae05534259dd927a9d48c3e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\vddjv.exec:\vddjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
\??\c:\pjvvj.exec:\pjvvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\thbbnn.exec:\thbbnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\02286.exec:\02286.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\208888.exec:\208888.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\q64088.exec:\q64088.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\64668.exec:\64668.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\264462.exec:\264462.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\642806.exec:\642806.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\xfflrrf.exec:\xfflrrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\c462228.exec:\c462228.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\bttbnt.exec:\bttbnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\ddpvd.exec:\ddpvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\82068.exec:\82068.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\08488.exec:\08488.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\jdpjj.exec:\jdpjj.exe17⤵
- Executes dropped EXE
PID:1952 -
\??\c:\9pvpv.exec:\9pvpv.exe18⤵
- Executes dropped EXE
PID:2120 -
\??\c:\c682888.exec:\c682888.exe19⤵
- Executes dropped EXE
PID:332 -
\??\c:\xlrrfxf.exec:\xlrrfxf.exe20⤵
- Executes dropped EXE
PID:1704 -
\??\c:\lfrxfrx.exec:\lfrxfrx.exe21⤵
- Executes dropped EXE
PID:2972 -
\??\c:\htnbtn.exec:\htnbtn.exe22⤵
- Executes dropped EXE
PID:780 -
\??\c:\9thhtn.exec:\9thhtn.exe23⤵
- Executes dropped EXE
PID:2084 -
\??\c:\48044.exec:\48044.exe24⤵
- Executes dropped EXE
PID:1152 -
\??\c:\rfrrrrr.exec:\rfrrrrr.exe25⤵
- Executes dropped EXE
PID:1320 -
\??\c:\rlrxffl.exec:\rlrxffl.exe26⤵
- Executes dropped EXE
PID:2588 -
\??\c:\xrffffl.exec:\xrffffl.exe27⤵
- Executes dropped EXE
PID:1384 -
\??\c:\g2884.exec:\g2884.exe28⤵
- Executes dropped EXE
PID:1788 -
\??\c:\lxlxlfl.exec:\lxlxlfl.exe29⤵
- Executes dropped EXE
PID:2236 -
\??\c:\64606.exec:\64606.exe30⤵
- Executes dropped EXE
PID:2152 -
\??\c:\60462.exec:\60462.exe31⤵
- Executes dropped EXE
PID:3060 -
\??\c:\2066662.exec:\2066662.exe32⤵
- Executes dropped EXE
PID:2028 -
\??\c:\3vjdj.exec:\3vjdj.exe33⤵
- Executes dropped EXE
PID:1212 -
\??\c:\208460.exec:\208460.exe34⤵
- Executes dropped EXE
PID:1748 -
\??\c:\64224.exec:\64224.exe35⤵
- Executes dropped EXE
PID:2160 -
\??\c:\64644.exec:\64644.exe36⤵PID:1712
-
\??\c:\4824282.exec:\4824282.exe37⤵
- Executes dropped EXE
PID:2516 -
\??\c:\k26844.exec:\k26844.exe38⤵
- Executes dropped EXE
PID:2080 -
\??\c:\20068.exec:\20068.exe39⤵
- Executes dropped EXE
PID:3068 -
\??\c:\262048.exec:\262048.exe40⤵
- Executes dropped EXE
PID:2348 -
\??\c:\0862884.exec:\0862884.exe41⤵
- Executes dropped EXE
PID:2720 -
\??\c:\fxllrrx.exec:\fxllrrx.exe42⤵
- Executes dropped EXE
PID:2808 -
\??\c:\hbnnht.exec:\hbnnht.exe43⤵
- Executes dropped EXE
PID:1456 -
\??\c:\lxrrxxf.exec:\lxrrxxf.exe44⤵
- Executes dropped EXE
PID:2884 -
\??\c:\jvjdj.exec:\jvjdj.exe45⤵
- Executes dropped EXE
PID:2712 -
\??\c:\tnbbhh.exec:\tnbbhh.exe46⤵
- Executes dropped EXE
PID:3064 -
\??\c:\20284.exec:\20284.exe47⤵
- Executes dropped EXE
PID:2844 -
\??\c:\fxxfxfl.exec:\fxxfxfl.exe48⤵
- Executes dropped EXE
PID:3048 -
\??\c:\nhbhhh.exec:\nhbhhh.exe49⤵
- Executes dropped EXE
PID:1620 -
\??\c:\rrxxllx.exec:\rrxxllx.exe50⤵
- Executes dropped EXE
PID:3040 -
\??\c:\082844.exec:\082844.exe51⤵
- Executes dropped EXE
PID:2424 -
\??\c:\2220286.exec:\2220286.exe52⤵
- Executes dropped EXE
PID:1736 -
\??\c:\224284.exec:\224284.exe53⤵
- Executes dropped EXE
PID:1448 -
\??\c:\3nhtth.exec:\3nhtth.exe54⤵
- Executes dropped EXE
PID:1652 -
\??\c:\406466.exec:\406466.exe55⤵
- Executes dropped EXE
PID:1856 -
\??\c:\o422002.exec:\o422002.exe56⤵
- Executes dropped EXE
PID:2376 -
\??\c:\864022.exec:\864022.exe57⤵
- Executes dropped EXE
PID:2448 -
\??\c:\q00240.exec:\q00240.exe58⤵
- Executes dropped EXE
PID:828 -
\??\c:\jjjvd.exec:\jjjvd.exe59⤵
- Executes dropped EXE
PID:1640 -
\??\c:\vvppv.exec:\vvppv.exe60⤵
- Executes dropped EXE
PID:332 -
\??\c:\nhtbhn.exec:\nhtbhn.exe61⤵
- Executes dropped EXE
PID:652 -
\??\c:\i640222.exec:\i640222.exe62⤵
- Executes dropped EXE
PID:1176 -
\??\c:\llxxxrx.exec:\llxxxrx.exe63⤵
- Executes dropped EXE
PID:236 -
\??\c:\k42626.exec:\k42626.exe64⤵
- Executes dropped EXE
PID:1336 -
\??\c:\tnbnhh.exec:\tnbnhh.exe65⤵
- Executes dropped EXE
PID:1048 -
\??\c:\084402.exec:\084402.exe66⤵
- Executes dropped EXE
PID:1608 -
\??\c:\m4062.exec:\m4062.exe67⤵PID:2024
-
\??\c:\0446808.exec:\0446808.exe68⤵PID:2588
-
\??\c:\480200.exec:\480200.exe69⤵PID:1784
-
\??\c:\u640280.exec:\u640280.exe70⤵PID:1628
-
\??\c:\nhhttn.exec:\nhhttn.exe71⤵PID:2436
-
\??\c:\6428442.exec:\6428442.exe72⤵PID:1572
-
\??\c:\080088.exec:\080088.exe73⤵PID:1224
-
\??\c:\c240028.exec:\c240028.exe74⤵PID:1688
-
\??\c:\080084.exec:\080084.exe75⤵PID:3060
-
\??\c:\htbhnh.exec:\htbhnh.exe76⤵PID:2956
-
\??\c:\4846228.exec:\4846228.exe77⤵PID:2000
-
\??\c:\nhnntt.exec:\nhnntt.exe78⤵PID:1692
-
\??\c:\rfllrxf.exec:\rfllrxf.exe79⤵
- System Location Discovery: System Language Discovery
PID:2108 -
\??\c:\c404600.exec:\c404600.exe80⤵PID:2020
-
\??\c:\vjpvd.exec:\vjpvd.exe81⤵PID:2564
-
\??\c:\nbttnn.exec:\nbttnn.exe82⤵PID:2148
-
\??\c:\9pddv.exec:\9pddv.exe83⤵PID:1284
-
\??\c:\8666628.exec:\8666628.exe84⤵PID:2352
-
\??\c:\424288.exec:\424288.exe85⤵PID:2964
-
\??\c:\084844.exec:\084844.exe86⤵PID:2760
-
\??\c:\lxllllx.exec:\lxllllx.exe87⤵
- System Location Discovery: System Language Discovery
PID:2728 -
\??\c:\frllrlr.exec:\frllrlr.exe88⤵PID:2644
-
\??\c:\htbttn.exec:\htbttn.exe89⤵PID:2928
-
\??\c:\c428404.exec:\c428404.exe90⤵PID:2188
-
\??\c:\480662.exec:\480662.exe91⤵PID:2676
-
\??\c:\608444.exec:\608444.exe92⤵PID:2688
-
\??\c:\64666.exec:\64666.exe93⤵PID:3056
-
\??\c:\486862.exec:\486862.exe94⤵PID:1620
-
\??\c:\646622.exec:\646622.exe95⤵PID:2596
-
\??\c:\0428448.exec:\0428448.exe96⤵PID:2508
-
\??\c:\9dpjp.exec:\9dpjp.exe97⤵PID:2428
-
\??\c:\c644444.exec:\c644444.exe98⤵PID:2904
-
\??\c:\64664.exec:\64664.exe99⤵PID:1940
-
\??\c:\xfrffll.exec:\xfrffll.exe100⤵PID:1772
-
\??\c:\42888.exec:\42888.exe101⤵PID:2472
-
\??\c:\pvjdj.exec:\pvjdj.exe102⤵PID:540
-
\??\c:\40680.exec:\40680.exe103⤵PID:2568
-
\??\c:\u462828.exec:\u462828.exe104⤵PID:608
-
\??\c:\jdvvv.exec:\jdvvv.exe105⤵PID:2592
-
\??\c:\9bnntb.exec:\9bnntb.exe106⤵PID:2036
-
\??\c:\68602.exec:\68602.exe107⤵PID:2232
-
\??\c:\k62400.exec:\k62400.exe108⤵PID:1980
-
\??\c:\xxlxlfl.exec:\xxlxlfl.exe109⤵PID:2496
-
\??\c:\c288888.exec:\c288888.exe110⤵PID:1336
-
\??\c:\q02282.exec:\q02282.exe111⤵PID:1796
-
\??\c:\u020006.exec:\u020006.exe112⤵PID:1608
-
\??\c:\2000602.exec:\2000602.exe113⤵PID:680
-
\??\c:\dvvvv.exec:\dvvvv.exe114⤵PID:904
-
\??\c:\5frxxxx.exec:\5frxxxx.exe115⤵PID:1172
-
\??\c:\5frflll.exec:\5frflll.exe116⤵PID:568
-
\??\c:\204060.exec:\204060.exe117⤵PID:1800
-
\??\c:\hbnnhn.exec:\hbnnhn.exe118⤵PID:1572
-
\??\c:\4282662.exec:\4282662.exe119⤵PID:1224
-
\??\c:\vvjdj.exec:\vvjdj.exe120⤵
- System Location Discovery: System Language Discovery
PID:2968 -
\??\c:\480688.exec:\480688.exe121⤵PID:2032
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-