Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/12/2024, 03:34
Behavioral task
behavioral1
Sample
dbb7520714957ec7de227fda0f2dcca09fdd3f01ee7417850ca6e4edd0be46d9.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
dbb7520714957ec7de227fda0f2dcca09fdd3f01ee7417850ca6e4edd0be46d9.exe
-
Size
334KB
-
MD5
164b41a849393e5935e7b9ba189ea346
-
SHA1
1b5c6b50c1898e9567ec876a32d891ab28d72165
-
SHA256
dbb7520714957ec7de227fda0f2dcca09fdd3f01ee7417850ca6e4edd0be46d9
-
SHA512
9027258e41e7d58bb986ba9435d15a726dcc4b5c4483c3694cb360bdf294385b1f171b083aa0d0fac1ffb78a0c20cdca3144ba7791139dbd103a8b97f02b5514
-
SSDEEP
6144:vcm4FmowdHoStJdJIjaRleL42bL37BoTPkhu9gX5yGsTshQc8R0nxA5ij8+RC7tx:94wFHoStJdSjylh2b77BoTMA9gX59sT5
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/2492-1-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2524-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/864-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1812-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/828-40-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/828-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2824-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2700-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2372-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2932-75-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2932-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2568-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3064-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2792-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1708-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2028-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2368-140-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2860-147-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1640-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2924-170-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1444-186-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1132-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2244-216-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2068-247-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1492-260-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/332-282-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2852-328-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2008-339-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2672-360-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2004-366-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1244-372-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1552-421-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2948-424-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2236-436-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3044-471-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1636-477-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1400-483-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2856-564-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2756-612-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2108-704-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2104-942-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1052-1140-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/2168-1183-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/768-11326-0x00000000776F0000-0x000000007780F000-memory.dmp family_blackmoon behavioral1/memory/768-20583-0x00000000776F0000-0x000000007780F000-memory.dmp family_blackmoon behavioral1/memory/768-23340-0x00000000776F0000-0x000000007780F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2524 hbnnbt.exe 864 pvppd.exe 1812 7rflxrx.exe 828 3xlrffl.exe 2824 hbtthh.exe 2700 dvjpd.exe 2372 rrllllr.exe 2932 nbbhnn.exe 2720 fxlrrrx.exe 2568 1tnhtt.exe 3064 5pvvd.exe 2248 ffrxffr.exe 2792 nhttbt.exe 1708 7jvjv.exe 2028 5rllrrx.exe 2368 pjjdp.exe 2860 fxlxlrf.exe 1984 3nbttt.exe 1640 dvddj.exe 2924 xfxxxxx.exe 2392 bthhtt.exe 1444 ddvjj.exe 2244 lxfflfl.exe 1132 ntbttn.exe 3024 1vvdp.exe 780 ffrfrrl.exe 2012 pdjjp.exe 1684 fxrxxff.exe 2432 7xrxxxf.exe 2420 bnbbhb.exe 2068 xrxrffr.exe 1492 5xffffx.exe 1756 vpdpp.exe 1696 rlxllrf.exe 2348 nbnttn.exe 332 bthnnt.exe 2260 pdppj.exe 1600 vpdvd.exe 1732 xlffrrx.exe 2856 hbnbtt.exe 1812 nhtbhb.exe 2680 3jpjp.exe 2836 vvppp.exe 2824 ffxlflr.exe 2852 lfxlxxx.exe 2744 9bhhhn.exe 2008 jvjjj.exe 2688 7djpv.exe 2664 fxrllfl.exe 2592 lfxxffl.exe 2672 hbnhnh.exe 2004 pdjvd.exe 1244 7vpvv.exe 1844 rlfflrx.exe 1064 5thbhb.exe 1460 jdppd.exe 2880 9pdvd.exe 2024 rrlxlxf.exe 1572 fxfrxxf.exe 1720 9tnhhh.exe 1516 jdvvd.exe 1552 pjddj.exe 2948 lxllrxl.exe 3056 xlllxrx.exe -
resource yara_rule behavioral1/memory/2492-1-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000c000000012280-5.dat upx behavioral1/memory/2524-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016edc-16.dat upx behavioral1/memory/2492-6-0x00000000001B0000-0x00000000001D7000-memory.dmp upx behavioral1/memory/1812-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/864-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016f02-23.dat upx behavioral1/memory/1812-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000174b4-33.dat upx behavioral1/files/0x00070000000174f8-41.dat upx behavioral1/memory/2824-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/828-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000017570-51.dat upx behavioral1/memory/2824-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000175f7-60.dat upx behavioral1/memory/2700-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2372-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000019261-68.dat upx behavioral1/memory/2932-75-0x00000000003C0000-0x00000000003E7000-memory.dmp upx behavioral1/files/0x0005000000019274-76.dat upx behavioral1/memory/2932-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001927a-84.dat upx behavioral1/memory/2568-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019299-91.dat upx behavioral1/files/0x00050000000192a1-100.dat upx behavioral1/memory/3064-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019354-108.dat upx behavioral1/files/0x0005000000019358-116.dat upx behavioral1/memory/2792-115-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1708-124-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001938e-123.dat upx behavioral1/files/0x000500000001939f-132.dat upx behavioral1/memory/2028-131-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193cc-139.dat upx behavioral1/memory/2368-140-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193d0-148.dat upx behavioral1/memory/2860-147-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193dc-155.dat upx behavioral1/memory/1640-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193f9-162.dat upx behavioral1/files/0x0009000000016de9-171.dat upx behavioral1/files/0x0005000000019426-178.dat upx behavioral1/memory/1444-186-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019428-185.dat upx behavioral1/files/0x00050000000194ad-193.dat upx behavioral1/files/0x00050000000194c3-202.dat upx behavioral1/memory/1132-201-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/780-209-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194d5-208.dat upx behavioral1/files/0x00050000000194e1-217.dat upx behavioral1/files/0x0005000000019502-224.dat upx behavioral1/files/0x0005000000019508-231.dat upx behavioral1/files/0x0005000000019510-238.dat upx behavioral1/files/0x0005000000019518-245.dat upx behavioral1/memory/2068-247-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019520-253.dat upx behavioral1/memory/1492-260-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2348-276-0x00000000001B0000-0x00000000001D7000-memory.dmp upx behavioral1/memory/332-282-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2852-328-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2008-339-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2672-360-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2004-366-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xflrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7htntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlfffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflfllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rflrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2492 wrote to memory of 2524 2492 dbb7520714957ec7de227fda0f2dcca09fdd3f01ee7417850ca6e4edd0be46d9.exe 31 PID 2492 wrote to memory of 2524 2492 dbb7520714957ec7de227fda0f2dcca09fdd3f01ee7417850ca6e4edd0be46d9.exe 31 PID 2492 wrote to memory of 2524 2492 dbb7520714957ec7de227fda0f2dcca09fdd3f01ee7417850ca6e4edd0be46d9.exe 31 PID 2492 wrote to memory of 2524 2492 dbb7520714957ec7de227fda0f2dcca09fdd3f01ee7417850ca6e4edd0be46d9.exe 31 PID 2524 wrote to memory of 864 2524 hbnnbt.exe 32 PID 2524 wrote to memory of 864 2524 hbnnbt.exe 32 PID 2524 wrote to memory of 864 2524 hbnnbt.exe 32 PID 2524 wrote to memory of 864 2524 hbnnbt.exe 32 PID 864 wrote to memory of 1812 864 pvppd.exe 33 PID 864 wrote to memory of 1812 864 pvppd.exe 33 PID 864 wrote to memory of 1812 864 pvppd.exe 33 PID 864 wrote to memory of 1812 864 pvppd.exe 33 PID 1812 wrote to memory of 828 1812 7rflxrx.exe 34 PID 1812 wrote to memory of 828 1812 7rflxrx.exe 34 PID 1812 wrote to memory of 828 1812 7rflxrx.exe 34 PID 1812 wrote to memory of 828 1812 7rflxrx.exe 34 PID 828 wrote to memory of 2824 828 3xlrffl.exe 35 PID 828 wrote to memory of 2824 828 3xlrffl.exe 35 PID 828 wrote to memory of 2824 828 3xlrffl.exe 35 PID 828 wrote to memory of 2824 828 3xlrffl.exe 35 PID 2824 wrote to memory of 2700 2824 hbtthh.exe 36 PID 2824 wrote to memory of 2700 2824 hbtthh.exe 36 PID 2824 wrote to memory of 2700 2824 hbtthh.exe 36 PID 2824 wrote to memory of 2700 2824 hbtthh.exe 36 PID 2700 wrote to memory of 2372 2700 dvjpd.exe 37 PID 2700 wrote to memory of 2372 2700 dvjpd.exe 37 PID 2700 wrote to memory of 2372 2700 dvjpd.exe 37 PID 2700 wrote to memory of 2372 2700 dvjpd.exe 37 PID 2372 wrote to memory of 2932 2372 rrllllr.exe 38 PID 2372 wrote to memory of 2932 2372 rrllllr.exe 38 PID 2372 wrote to memory of 2932 2372 rrllllr.exe 38 PID 2372 wrote to memory of 2932 2372 rrllllr.exe 38 PID 2932 wrote to memory of 2720 2932 nbbhnn.exe 39 PID 2932 wrote to memory of 2720 2932 nbbhnn.exe 39 PID 2932 wrote to memory of 2720 2932 nbbhnn.exe 39 PID 2932 wrote to memory of 2720 2932 nbbhnn.exe 39 PID 2720 wrote to memory of 2568 2720 fxlrrrx.exe 40 PID 2720 wrote to memory of 2568 2720 fxlrrrx.exe 40 PID 2720 wrote to memory of 2568 2720 fxlrrrx.exe 40 PID 2720 wrote to memory of 2568 2720 fxlrrrx.exe 40 PID 2568 wrote to memory of 3064 2568 1tnhtt.exe 41 PID 2568 wrote to memory of 3064 2568 1tnhtt.exe 41 PID 2568 wrote to memory of 3064 2568 1tnhtt.exe 41 PID 2568 wrote to memory of 3064 2568 1tnhtt.exe 41 PID 3064 wrote to memory of 2248 3064 5pvvd.exe 42 PID 3064 wrote to memory of 2248 3064 5pvvd.exe 42 PID 3064 wrote to memory of 2248 3064 5pvvd.exe 42 PID 3064 wrote to memory of 2248 3064 5pvvd.exe 42 PID 2248 wrote to memory of 2792 2248 ffrxffr.exe 43 PID 2248 wrote to memory of 2792 2248 ffrxffr.exe 43 PID 2248 wrote to memory of 2792 2248 ffrxffr.exe 43 PID 2248 wrote to memory of 2792 2248 ffrxffr.exe 43 PID 2792 wrote to memory of 1708 2792 nhttbt.exe 44 PID 2792 wrote to memory of 1708 2792 nhttbt.exe 44 PID 2792 wrote to memory of 1708 2792 nhttbt.exe 44 PID 2792 wrote to memory of 1708 2792 nhttbt.exe 44 PID 1708 wrote to memory of 2028 1708 7jvjv.exe 45 PID 1708 wrote to memory of 2028 1708 7jvjv.exe 45 PID 1708 wrote to memory of 2028 1708 7jvjv.exe 45 PID 1708 wrote to memory of 2028 1708 7jvjv.exe 45 PID 2028 wrote to memory of 2368 2028 5rllrrx.exe 46 PID 2028 wrote to memory of 2368 2028 5rllrrx.exe 46 PID 2028 wrote to memory of 2368 2028 5rllrrx.exe 46 PID 2028 wrote to memory of 2368 2028 5rllrrx.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\dbb7520714957ec7de227fda0f2dcca09fdd3f01ee7417850ca6e4edd0be46d9.exe"C:\Users\Admin\AppData\Local\Temp\dbb7520714957ec7de227fda0f2dcca09fdd3f01ee7417850ca6e4edd0be46d9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\hbnnbt.exec:\hbnnbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\pvppd.exec:\pvppd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\7rflxrx.exec:\7rflxrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\3xlrffl.exec:\3xlrffl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:828 -
\??\c:\hbtthh.exec:\hbtthh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\dvjpd.exec:\dvjpd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\rrllllr.exec:\rrllllr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\nbbhnn.exec:\nbbhnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\fxlrrrx.exec:\fxlrrrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\1tnhtt.exec:\1tnhtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\5pvvd.exec:\5pvvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\ffrxffr.exec:\ffrxffr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\nhttbt.exec:\nhttbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\7jvjv.exec:\7jvjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\5rllrrx.exec:\5rllrrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\pjjdp.exec:\pjjdp.exe17⤵
- Executes dropped EXE
PID:2368 -
\??\c:\fxlxlrf.exec:\fxlxlrf.exe18⤵
- Executes dropped EXE
PID:2860 -
\??\c:\3nbttt.exec:\3nbttt.exe19⤵
- Executes dropped EXE
PID:1984 -
\??\c:\dvddj.exec:\dvddj.exe20⤵
- Executes dropped EXE
PID:1640 -
\??\c:\xfxxxxx.exec:\xfxxxxx.exe21⤵
- Executes dropped EXE
PID:2924 -
\??\c:\bthhtt.exec:\bthhtt.exe22⤵
- Executes dropped EXE
PID:2392 -
\??\c:\ddvjj.exec:\ddvjj.exe23⤵
- Executes dropped EXE
PID:1444 -
\??\c:\lxfflfl.exec:\lxfflfl.exe24⤵
- Executes dropped EXE
PID:2244 -
\??\c:\ntbttn.exec:\ntbttn.exe25⤵
- Executes dropped EXE
PID:1132 -
\??\c:\1vvdp.exec:\1vvdp.exe26⤵
- Executes dropped EXE
PID:3024 -
\??\c:\ffrfrrl.exec:\ffrfrrl.exe27⤵
- Executes dropped EXE
PID:780 -
\??\c:\pdjjp.exec:\pdjjp.exe28⤵
- Executes dropped EXE
PID:2012 -
\??\c:\fxrxxff.exec:\fxrxxff.exe29⤵
- Executes dropped EXE
PID:1684 -
\??\c:\7xrxxxf.exec:\7xrxxxf.exe30⤵
- Executes dropped EXE
PID:2432 -
\??\c:\bnbbhb.exec:\bnbbhb.exe31⤵
- Executes dropped EXE
PID:2420 -
\??\c:\xrxrffr.exec:\xrxrffr.exe32⤵
- Executes dropped EXE
PID:2068 -
\??\c:\5xffffx.exec:\5xffffx.exe33⤵
- Executes dropped EXE
PID:1492 -
\??\c:\vpdpp.exec:\vpdpp.exe34⤵
- Executes dropped EXE
PID:1756 -
\??\c:\rlxllrf.exec:\rlxllrf.exe35⤵
- Executes dropped EXE
PID:1696 -
\??\c:\nbnttn.exec:\nbnttn.exe36⤵
- Executes dropped EXE
PID:2348 -
\??\c:\bthnnt.exec:\bthnnt.exe37⤵
- Executes dropped EXE
PID:332 -
\??\c:\pdppj.exec:\pdppj.exe38⤵
- Executes dropped EXE
PID:2260 -
\??\c:\vpdvd.exec:\vpdvd.exe39⤵
- Executes dropped EXE
PID:1600 -
\??\c:\xlffrrx.exec:\xlffrrx.exe40⤵
- Executes dropped EXE
PID:1732 -
\??\c:\hbnbtt.exec:\hbnbtt.exe41⤵
- Executes dropped EXE
PID:2856 -
\??\c:\nhtbhb.exec:\nhtbhb.exe42⤵
- Executes dropped EXE
PID:1812 -
\??\c:\3jpjp.exec:\3jpjp.exe43⤵
- Executes dropped EXE
PID:2680 -
\??\c:\vvppp.exec:\vvppp.exe44⤵
- Executes dropped EXE
PID:2836 -
\??\c:\ffxlflr.exec:\ffxlflr.exe45⤵
- Executes dropped EXE
PID:2824 -
\??\c:\lfxlxxx.exec:\lfxlxxx.exe46⤵
- Executes dropped EXE
PID:2852 -
\??\c:\9bhhhn.exec:\9bhhhn.exe47⤵
- Executes dropped EXE
PID:2744 -
\??\c:\jvjjj.exec:\jvjjj.exe48⤵
- Executes dropped EXE
PID:2008 -
\??\c:\7djpv.exec:\7djpv.exe49⤵
- Executes dropped EXE
PID:2688 -
\??\c:\fxrllfl.exec:\fxrllfl.exe50⤵
- Executes dropped EXE
PID:2664 -
\??\c:\lfxxffl.exec:\lfxxffl.exe51⤵
- Executes dropped EXE
PID:2592 -
\??\c:\hbnhnh.exec:\hbnhnh.exe52⤵
- Executes dropped EXE
PID:2672 -
\??\c:\pdjvd.exec:\pdjvd.exe53⤵
- Executes dropped EXE
PID:2004 -
\??\c:\7vpvv.exec:\7vpvv.exe54⤵
- Executes dropped EXE
PID:1244 -
\??\c:\rlfflrx.exec:\rlfflrx.exe55⤵
- Executes dropped EXE
PID:1844 -
\??\c:\5thbhb.exec:\5thbhb.exe56⤵
- Executes dropped EXE
PID:1064 -
\??\c:\jdppd.exec:\jdppd.exe57⤵
- Executes dropped EXE
PID:1460 -
\??\c:\9pdvd.exec:\9pdvd.exe58⤵
- Executes dropped EXE
PID:2880 -
\??\c:\rrlxlxf.exec:\rrlxlxf.exe59⤵
- Executes dropped EXE
PID:2024 -
\??\c:\fxfrxxf.exec:\fxfrxxf.exe60⤵
- Executes dropped EXE
PID:1572 -
\??\c:\9tnhhh.exec:\9tnhhh.exe61⤵
- Executes dropped EXE
PID:1720 -
\??\c:\jdvvd.exec:\jdvvd.exe62⤵
- Executes dropped EXE
PID:1516 -
\??\c:\pjddj.exec:\pjddj.exe63⤵
- Executes dropped EXE
PID:1552 -
\??\c:\lxllrxl.exec:\lxllrxl.exe64⤵
- Executes dropped EXE
PID:2948 -
\??\c:\xlllxrx.exec:\xlllxrx.exe65⤵
- Executes dropped EXE
PID:3056 -
\??\c:\hbnnbb.exec:\hbnnbb.exe66⤵PID:2236
-
\??\c:\jvvvp.exec:\jvvvp.exe67⤵PID:2208
-
\??\c:\dvpjp.exec:\dvpjp.exe68⤵PID:940
-
\??\c:\lfxfffl.exec:\lfxfffl.exe69⤵PID:3048
-
\??\c:\nhtbbt.exec:\nhtbbt.exe70⤵PID:1616
-
\??\c:\bbntht.exec:\bbntht.exe71⤵PID:3044
-
\??\c:\pdddv.exec:\pdddv.exe72⤵PID:1636
-
\??\c:\rllflrr.exec:\rllflrr.exe73⤵PID:1400
-
\??\c:\1fxxfxf.exec:\1fxxfxf.exe74⤵PID:1388
-
\??\c:\3bnnnn.exec:\3bnnnn.exe75⤵PID:3004
-
\??\c:\dvjpp.exec:\dvjpp.exe76⤵PID:2432
-
\??\c:\pjvjj.exec:\pjvjj.exe77⤵PID:1224
-
\??\c:\lfrrffl.exec:\lfrrffl.exe78⤵PID:2164
-
\??\c:\xrrxxxf.exec:\xrrxxxf.exe79⤵PID:2068
-
\??\c:\7nbhnh.exec:\7nbhnh.exe80⤵PID:2148
-
\??\c:\tbhbhn.exec:\tbhbhn.exe81⤵PID:1964
-
\??\c:\1dpdd.exec:\1dpdd.exe82⤵PID:1152
-
\??\c:\5frllfl.exec:\5frllfl.exe83⤵PID:1164
-
\??\c:\7xrrxrx.exec:\7xrrxrx.exe84⤵PID:2328
-
\??\c:\btbbbh.exec:\btbbbh.exe85⤵PID:2084
-
\??\c:\9nhthn.exec:\9nhthn.exe86⤵PID:484
-
\??\c:\dpvpv.exec:\dpvpv.exe87⤵PID:1600
-
\??\c:\3lxlllr.exec:\3lxlllr.exe88⤵PID:924
-
\??\c:\7xllrrl.exec:\7xllrrl.exe89⤵PID:2856
-
\??\c:\htnttn.exec:\htnttn.exe90⤵PID:2768
-
\??\c:\7hbttt.exec:\7hbttt.exe91⤵PID:2680
-
\??\c:\vvvdd.exec:\vvvdd.exe92⤵PID:2812
-
\??\c:\xrfffxx.exec:\xrfffxx.exe93⤵PID:2700
-
\??\c:\3xxfrrx.exec:\3xxfrrx.exe94⤵PID:2668
-
\??\c:\nnbntn.exec:\nnbntn.exe95⤵
- System Location Discovery: System Language Discovery
PID:2756 -
\??\c:\1bbtnn.exec:\1bbtnn.exe96⤵PID:1660
-
\??\c:\jdjjd.exec:\jdjjd.exe97⤵PID:2552
-
\??\c:\xlxfffl.exec:\xlxfffl.exe98⤵PID:2600
-
\??\c:\rfrxxxx.exec:\rfrxxxx.exe99⤵PID:2580
-
\??\c:\3thntt.exec:\3thntt.exe100⤵PID:2128
-
\??\c:\9btbbt.exec:\9btbbt.exe101⤵PID:2424
-
\??\c:\jvddv.exec:\jvddv.exe102⤵PID:2788
-
\??\c:\fxrxxxf.exec:\fxrxxxf.exe103⤵PID:1844
-
\??\c:\rlrrxfr.exec:\rlrrxfr.exe104⤵PID:2784
-
\??\c:\btbhnn.exec:\btbhnn.exe105⤵PID:2796
-
\??\c:\ttnttn.exec:\ttnttn.exe106⤵PID:2028
-
\??\c:\ppdvj.exec:\ppdvj.exe107⤵PID:2904
-
\??\c:\vpjjv.exec:\vpjjv.exe108⤵
- System Location Discovery: System Language Discovery
PID:1612 -
\??\c:\lfxxxxf.exec:\lfxxxxf.exe109⤵PID:1208
-
\??\c:\thnntn.exec:\thnntn.exe110⤵PID:564
-
\??\c:\bthttb.exec:\bthttb.exe111⤵PID:1352
-
\??\c:\pdpvd.exec:\pdpvd.exe112⤵PID:2920
-
\??\c:\jvvdd.exec:\jvvdd.exe113⤵PID:2940
-
\??\c:\fxrrllr.exec:\fxrrllr.exe114⤵PID:2064
-
\??\c:\7xfllll.exec:\7xfllll.exe115⤵PID:1312
-
\??\c:\3hbntt.exec:\3hbntt.exe116⤵PID:2108
-
\??\c:\1vjpj.exec:\1vjpj.exe117⤵PID:940
-
\??\c:\3pjjp.exec:\3pjjp.exe118⤵PID:3048
-
\??\c:\3xrxxfl.exec:\3xrxxfl.exe119⤵PID:948
-
\??\c:\hbntbn.exec:\hbntbn.exe120⤵PID:2488
-
\??\c:\hbhnhh.exec:\hbhnhh.exe121⤵PID:1940
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-