Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/12/2024, 20:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1978cd7f48af420d15f520cdfa9d443b363afd3dc4f05d8ab4abb38c098e8f76.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
1978cd7f48af420d15f520cdfa9d443b363afd3dc4f05d8ab4abb38c098e8f76.exe
-
Size
454KB
-
MD5
cd85dba726b3975f6586cfb7a5001734
-
SHA1
01e7194421d130bf64c54fd0b2aabf62a5591e97
-
SHA256
1978cd7f48af420d15f520cdfa9d443b363afd3dc4f05d8ab4abb38c098e8f76
-
SHA512
2b9821672d98550b3a2fa15869c983afc71c50d580c8c6e4eafd8d105f3b16b8d52b6a505389d005fbda53e2cb81e856ce1fda9723e2abfe83cfa212fcc0f553
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeH:q7Tc2NYHUrAwfMp3CDH
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 47 IoCs
resource yara_rule behavioral1/memory/2444-547-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1640-519-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-457-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-443-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1232-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/336-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-322-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2348-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/848-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2340-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/620-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/444-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2272-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2272-191-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3068-182-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2492-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/864-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/492-152-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1628-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1744-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-78-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2504-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-47-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2764-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2192-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-578-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2496-638-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2228-652-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2820-666-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1728-673-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/264-680-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1392-711-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2240-736-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2608-873-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2608-893-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2192 fxlxlrr.exe 2716 ttthth.exe 2632 vvppd.exe 2764 bnhthh.exe 2644 3dpvd.exe 2504 ntntbh.exe 2960 1xrfrxr.exe 1744 btthtt.exe 2820 rxlffrx.exe 2864 hhhntb.exe 1700 fffxrfr.exe 1296 bbnntb.exe 1972 jjvpd.exe 1628 xxlrxxf.exe 492 1dpvj.exe 864 xffxxxl.exe 2492 bbbtnt.exe 3068 djppj.exe 2272 hhntnt.exe 2344 3jvjv.exe 444 fxfxrxx.exe 2452 pvvdv.exe 620 xrxrxlx.exe 2184 3btbtb.exe 1640 fllfrxr.exe 2592 xllxrxl.exe 2384 djvdj.exe 2340 3xflxxr.exe 1188 7hbhtb.exe 848 pjjpd.exe 2980 7rxlffx.exe 2664 vvpdp.exe 2348 1fxlfll.exe 2888 hhnbth.exe 3060 hthhnn.exe 336 vdvjd.exe 2764 7rrllll.exe 2672 5bhtnt.exe 2580 hbbhnb.exe 3016 vvjpd.exe 1232 jppdv.exe 2804 xxrfrfr.exe 2832 nnhntb.exe 2752 7tntbh.exe 1724 dddpj.exe 1612 rrlxlrl.exe 1964 rllrflx.exe 2476 nnntnt.exe 2568 tbbhhn.exe 1756 pppjd.exe 1272 9rlrxlr.exe 2128 3rrfrxl.exe 864 thbhtb.exe 2908 3vvpv.exe 3044 7vppp.exe 2488 xrfrxlr.exe 1828 9nhtht.exe 2604 1bbnnn.exe 1504 jjdjv.exe 1080 ddvvd.exe 1864 rfxfrll.exe 2472 hbnhtb.exe 2328 tbtnhb.exe 2892 1pjpd.exe -
resource yara_rule behavioral1/memory/2444-547-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1640-519-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1232-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/336-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/848-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/620-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/444-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/864-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/492-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-578-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2516-586-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-638-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2240-736-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2056-886-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1232-906-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxfllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5btbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tnnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlrxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7fxfrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2980 wrote to memory of 2192 2980 1978cd7f48af420d15f520cdfa9d443b363afd3dc4f05d8ab4abb38c098e8f76.exe 30 PID 2980 wrote to memory of 2192 2980 1978cd7f48af420d15f520cdfa9d443b363afd3dc4f05d8ab4abb38c098e8f76.exe 30 PID 2980 wrote to memory of 2192 2980 1978cd7f48af420d15f520cdfa9d443b363afd3dc4f05d8ab4abb38c098e8f76.exe 30 PID 2980 wrote to memory of 2192 2980 1978cd7f48af420d15f520cdfa9d443b363afd3dc4f05d8ab4abb38c098e8f76.exe 30 PID 2192 wrote to memory of 2716 2192 fxlxlrr.exe 31 PID 2192 wrote to memory of 2716 2192 fxlxlrr.exe 31 PID 2192 wrote to memory of 2716 2192 fxlxlrr.exe 31 PID 2192 wrote to memory of 2716 2192 fxlxlrr.exe 31 PID 2716 wrote to memory of 2632 2716 ttthth.exe 32 PID 2716 wrote to memory of 2632 2716 ttthth.exe 32 PID 2716 wrote to memory of 2632 2716 ttthth.exe 32 PID 2716 wrote to memory of 2632 2716 ttthth.exe 32 PID 2632 wrote to memory of 2764 2632 vvppd.exe 33 PID 2632 wrote to memory of 2764 2632 vvppd.exe 33 PID 2632 wrote to memory of 2764 2632 vvppd.exe 33 PID 2632 wrote to memory of 2764 2632 vvppd.exe 33 PID 2764 wrote to memory of 2644 2764 bnhthh.exe 34 PID 2764 wrote to memory of 2644 2764 bnhthh.exe 34 PID 2764 wrote to memory of 2644 2764 bnhthh.exe 34 PID 2764 wrote to memory of 2644 2764 bnhthh.exe 34 PID 2644 wrote to memory of 2504 2644 3dpvd.exe 35 PID 2644 wrote to memory of 2504 2644 3dpvd.exe 35 PID 2644 wrote to memory of 2504 2644 3dpvd.exe 35 PID 2644 wrote to memory of 2504 2644 3dpvd.exe 35 PID 2504 wrote to memory of 2960 2504 ntntbh.exe 36 PID 2504 wrote to memory of 2960 2504 ntntbh.exe 36 PID 2504 wrote to memory of 2960 2504 ntntbh.exe 36 PID 2504 wrote to memory of 2960 2504 ntntbh.exe 36 PID 2960 wrote to memory of 1744 2960 1xrfrxr.exe 37 PID 2960 wrote to memory of 1744 2960 1xrfrxr.exe 37 PID 2960 wrote to memory of 1744 2960 1xrfrxr.exe 37 PID 2960 wrote to memory of 1744 2960 1xrfrxr.exe 37 PID 1744 wrote to memory of 2820 1744 btthtt.exe 38 PID 1744 wrote to memory of 2820 1744 btthtt.exe 38 PID 1744 wrote to memory of 2820 1744 btthtt.exe 38 PID 1744 wrote to memory of 2820 1744 btthtt.exe 38 PID 2820 wrote to memory of 2864 2820 rxlffrx.exe 39 PID 2820 wrote to memory of 2864 2820 rxlffrx.exe 39 PID 2820 wrote to memory of 2864 2820 rxlffrx.exe 39 PID 2820 wrote to memory of 2864 2820 rxlffrx.exe 39 PID 2864 wrote to memory of 1700 2864 hhhntb.exe 40 PID 2864 wrote to memory of 1700 2864 hhhntb.exe 40 PID 2864 wrote to memory of 1700 2864 hhhntb.exe 40 PID 2864 wrote to memory of 1700 2864 hhhntb.exe 40 PID 1700 wrote to memory of 1296 1700 fffxrfr.exe 41 PID 1700 wrote to memory of 1296 1700 fffxrfr.exe 41 PID 1700 wrote to memory of 1296 1700 fffxrfr.exe 41 PID 1700 wrote to memory of 1296 1700 fffxrfr.exe 41 PID 1296 wrote to memory of 1972 1296 bbnntb.exe 42 PID 1296 wrote to memory of 1972 1296 bbnntb.exe 42 PID 1296 wrote to memory of 1972 1296 bbnntb.exe 42 PID 1296 wrote to memory of 1972 1296 bbnntb.exe 42 PID 1972 wrote to memory of 1628 1972 jjvpd.exe 43 PID 1972 wrote to memory of 1628 1972 jjvpd.exe 43 PID 1972 wrote to memory of 1628 1972 jjvpd.exe 43 PID 1972 wrote to memory of 1628 1972 jjvpd.exe 43 PID 1628 wrote to memory of 492 1628 xxlrxxf.exe 44 PID 1628 wrote to memory of 492 1628 xxlrxxf.exe 44 PID 1628 wrote to memory of 492 1628 xxlrxxf.exe 44 PID 1628 wrote to memory of 492 1628 xxlrxxf.exe 44 PID 492 wrote to memory of 864 492 1dpvj.exe 45 PID 492 wrote to memory of 864 492 1dpvj.exe 45 PID 492 wrote to memory of 864 492 1dpvj.exe 45 PID 492 wrote to memory of 864 492 1dpvj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\1978cd7f48af420d15f520cdfa9d443b363afd3dc4f05d8ab4abb38c098e8f76.exe"C:\Users\Admin\AppData\Local\Temp\1978cd7f48af420d15f520cdfa9d443b363afd3dc4f05d8ab4abb38c098e8f76.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\fxlxlrr.exec:\fxlxlrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\ttthth.exec:\ttthth.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\vvppd.exec:\vvppd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\bnhthh.exec:\bnhthh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\3dpvd.exec:\3dpvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\ntntbh.exec:\ntntbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\1xrfrxr.exec:\1xrfrxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\btthtt.exec:\btthtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
\??\c:\rxlffrx.exec:\rxlffrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\hhhntb.exec:\hhhntb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\fffxrfr.exec:\fffxrfr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\bbnntb.exec:\bbnntb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
\??\c:\jjvpd.exec:\jjvpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\xxlrxxf.exec:\xxlrxxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\1dpvj.exec:\1dpvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:492 -
\??\c:\xffxxxl.exec:\xffxxxl.exe17⤵
- Executes dropped EXE
PID:864 -
\??\c:\bbbtnt.exec:\bbbtnt.exe18⤵
- Executes dropped EXE
PID:2492 -
\??\c:\djppj.exec:\djppj.exe19⤵
- Executes dropped EXE
PID:3068 -
\??\c:\hhntnt.exec:\hhntnt.exe20⤵
- Executes dropped EXE
PID:2272 -
\??\c:\3jvjv.exec:\3jvjv.exe21⤵
- Executes dropped EXE
PID:2344 -
\??\c:\fxfxrxx.exec:\fxfxrxx.exe22⤵
- Executes dropped EXE
PID:444 -
\??\c:\pvvdv.exec:\pvvdv.exe23⤵
- Executes dropped EXE
PID:2452 -
\??\c:\xrxrxlx.exec:\xrxrxlx.exe24⤵
- Executes dropped EXE
PID:620 -
\??\c:\3btbtb.exec:\3btbtb.exe25⤵
- Executes dropped EXE
PID:2184 -
\??\c:\fllfrxr.exec:\fllfrxr.exe26⤵
- Executes dropped EXE
PID:1640 -
\??\c:\xllxrxl.exec:\xllxrxl.exe27⤵
- Executes dropped EXE
PID:2592 -
\??\c:\djvdj.exec:\djvdj.exe28⤵
- Executes dropped EXE
PID:2384 -
\??\c:\3xflxxr.exec:\3xflxxr.exe29⤵
- Executes dropped EXE
PID:2340 -
\??\c:\7hbhtb.exec:\7hbhtb.exe30⤵
- Executes dropped EXE
PID:1188 -
\??\c:\pjjpd.exec:\pjjpd.exe31⤵
- Executes dropped EXE
PID:848 -
\??\c:\7rxlffx.exec:\7rxlffx.exe32⤵
- Executes dropped EXE
PID:2980 -
\??\c:\vvpdp.exec:\vvpdp.exe33⤵
- Executes dropped EXE
PID:2664 -
\??\c:\1fxlfll.exec:\1fxlfll.exe34⤵
- Executes dropped EXE
PID:2348 -
\??\c:\hhnbth.exec:\hhnbth.exe35⤵
- Executes dropped EXE
PID:2888 -
\??\c:\hthhnn.exec:\hthhnn.exe36⤵
- Executes dropped EXE
PID:3060 -
\??\c:\vdvjd.exec:\vdvjd.exe37⤵
- Executes dropped EXE
PID:336 -
\??\c:\7rrllll.exec:\7rrllll.exe38⤵
- Executes dropped EXE
PID:2764 -
\??\c:\5bhtnt.exec:\5bhtnt.exe39⤵
- Executes dropped EXE
PID:2672 -
\??\c:\hbbhnb.exec:\hbbhnb.exe40⤵
- Executes dropped EXE
PID:2580 -
\??\c:\vvjpd.exec:\vvjpd.exe41⤵
- Executes dropped EXE
PID:3016 -
\??\c:\jppdv.exec:\jppdv.exe42⤵
- Executes dropped EXE
PID:1232 -
\??\c:\xxrfrfr.exec:\xxrfrfr.exe43⤵
- Executes dropped EXE
PID:2804 -
\??\c:\nnhntb.exec:\nnhntb.exe44⤵
- Executes dropped EXE
PID:2832 -
\??\c:\7tntbh.exec:\7tntbh.exe45⤵
- Executes dropped EXE
PID:2752 -
\??\c:\dddpj.exec:\dddpj.exe46⤵
- Executes dropped EXE
PID:1724 -
\??\c:\rrlxlrl.exec:\rrlxlrl.exe47⤵
- Executes dropped EXE
PID:1612 -
\??\c:\rllrflx.exec:\rllrflx.exe48⤵
- Executes dropped EXE
PID:1964 -
\??\c:\nnntnt.exec:\nnntnt.exe49⤵
- Executes dropped EXE
PID:2476 -
\??\c:\tbbhhn.exec:\tbbhhn.exe50⤵
- Executes dropped EXE
PID:2568 -
\??\c:\pppjd.exec:\pppjd.exe51⤵
- Executes dropped EXE
PID:1756 -
\??\c:\9rlrxlr.exec:\9rlrxlr.exe52⤵
- Executes dropped EXE
PID:1272 -
\??\c:\3rrfrxl.exec:\3rrfrxl.exe53⤵
- Executes dropped EXE
PID:2128 -
\??\c:\thbhtb.exec:\thbhtb.exe54⤵
- Executes dropped EXE
PID:864 -
\??\c:\3vvpv.exec:\3vvpv.exe55⤵
- Executes dropped EXE
PID:2908 -
\??\c:\7vppp.exec:\7vppp.exe56⤵
- Executes dropped EXE
PID:3044 -
\??\c:\xrfrxlr.exec:\xrfrxlr.exe57⤵
- Executes dropped EXE
PID:2488 -
\??\c:\9nhtht.exec:\9nhtht.exe58⤵
- Executes dropped EXE
PID:1828 -
\??\c:\1bbnnn.exec:\1bbnnn.exe59⤵
- Executes dropped EXE
PID:2604 -
\??\c:\jjdjv.exec:\jjdjv.exe60⤵
- Executes dropped EXE
PID:1504 -
\??\c:\ddvvd.exec:\ddvvd.exe61⤵
- Executes dropped EXE
PID:1080 -
\??\c:\rfxfrll.exec:\rfxfrll.exe62⤵
- Executes dropped EXE
PID:1864 -
\??\c:\hbnhtb.exec:\hbnhtb.exe63⤵
- Executes dropped EXE
PID:2472 -
\??\c:\tbtnhb.exec:\tbtnhb.exe64⤵
- Executes dropped EXE
PID:2328 -
\??\c:\1pjpd.exec:\1pjpd.exe65⤵
- Executes dropped EXE
PID:2892 -
\??\c:\ppdjp.exec:\ppdjp.exe66⤵PID:1640
-
\??\c:\fxlfrxr.exec:\fxlfrxr.exe67⤵PID:2360
-
\??\c:\lfflxfl.exec:\lfflxfl.exe68⤵PID:2464
-
\??\c:\3hhnnt.exec:\3hhnnt.exe69⤵PID:2444
-
\??\c:\jpjpv.exec:\jpjpv.exe70⤵PID:2340
-
\??\c:\7pjvj.exec:\7pjvj.exe71⤵PID:2172
-
\??\c:\rrxlrlx.exec:\rrxlrlx.exe72⤵PID:3064
-
\??\c:\9bttbh.exec:\9bttbh.exe73⤵PID:2648
-
\??\c:\vdvdj.exec:\vdvdj.exe74⤵PID:2656
-
\??\c:\llxflrf.exec:\llxflrf.exe75⤵PID:2704
-
\??\c:\3hhntb.exec:\3hhntb.exe76⤵PID:2516
-
\??\c:\lfffflf.exec:\lfffflf.exe77⤵PID:2784
-
\??\c:\bbtnhh.exec:\bbtnhh.exe78⤵PID:2544
-
\??\c:\djddp.exec:\djddp.exe79⤵PID:2564
-
\??\c:\bbbnth.exec:\bbbnth.exe80⤵PID:2572
-
\??\c:\pvvdd.exec:\pvvdd.exe81⤵
- System Location Discovery: System Language Discovery
PID:2676 -
\??\c:\rrrxlrf.exec:\rrrxlrf.exe82⤵PID:2228
-
\??\c:\1hntnb.exec:\1hntnb.exe83⤵PID:2496
-
\??\c:\7ppdp.exec:\7ppdp.exe84⤵PID:2812
-
\??\c:\5xxlxrf.exec:\5xxlxrf.exe85⤵PID:2844
-
\??\c:\9nhnbh.exec:\9nhnbh.exe86⤵PID:264
-
\??\c:\pvpdd.exec:\pvpdd.exe87⤵PID:2820
-
\??\c:\fxrfrxx.exec:\fxrfrxx.exe88⤵PID:1728
-
\??\c:\nhttnt.exec:\nhttnt.exe89⤵PID:1692
-
\??\c:\pvddp.exec:\pvddp.exe90⤵PID:1916
-
\??\c:\7xrxxfx.exec:\7xrxxfx.exe91⤵PID:2476
-
\??\c:\bbnnnn.exec:\bbnnnn.exe92⤵PID:592
-
\??\c:\vppvv.exec:\vppvv.exe93⤵PID:1628
-
\??\c:\9rffrxf.exec:\9rffrxf.exe94⤵PID:1392
-
\??\c:\bhhnnt.exec:\bhhnnt.exe95⤵PID:1944
-
\??\c:\vvvpj.exec:\vvvpj.exe96⤵PID:1796
-
\??\c:\xfxxrxl.exec:\xfxxrxl.exe97⤵PID:3052
-
\??\c:\pvdjd.exec:\pvdjd.exe98⤵PID:2240
-
\??\c:\7xxxflx.exec:\7xxxflx.exe99⤵PID:2236
-
\??\c:\xfxrflx.exec:\xfxrflx.exe100⤵PID:2548
-
\??\c:\bbhnhn.exec:\bbhnhn.exe101⤵PID:1420
-
\??\c:\3vvdj.exec:\3vvdj.exe102⤵PID:444
-
\??\c:\1llxlrx.exec:\1llxlrx.exe103⤵PID:2452
-
\??\c:\tbbnnn.exec:\tbbnnn.exe104⤵PID:1988
-
\??\c:\7jdjv.exec:\7jdjv.exe105⤵PID:2280
-
\??\c:\dvpvp.exec:\dvpvp.exe106⤵PID:2276
-
\??\c:\fffrlll.exec:\fffrlll.exe107⤵PID:2184
-
\??\c:\ttthbn.exec:\ttthbn.exe108⤵PID:1372
-
\??\c:\jpjvd.exec:\jpjvd.exe109⤵PID:1928
-
\??\c:\vpddj.exec:\vpddj.exe110⤵PID:2420
-
\??\c:\7frrxfl.exec:\7frrxfl.exe111⤵PID:888
-
\??\c:\thnbnb.exec:\thnbnb.exe112⤵PID:2300
-
\??\c:\9btbtt.exec:\9btbtt.exe113⤵PID:2120
-
\??\c:\pjjpd.exec:\pjjpd.exe114⤵PID:848
-
\??\c:\rllxxfr.exec:\rllxxfr.exe115⤵PID:2700
-
\??\c:\ffxlrfx.exec:\ffxlrfx.exe116⤵PID:2636
-
\??\c:\tthnnt.exec:\tthnnt.exe117⤵PID:1596
-
\??\c:\ddvvd.exec:\ddvvd.exe118⤵PID:2632
-
\??\c:\rrrrrff.exec:\rrrrrff.exe119⤵PID:2888
-
\??\c:\nnhtbh.exec:\nnhtbh.exe120⤵PID:2608
-
\??\c:\dvjvj.exec:\dvjvj.exe121⤵PID:3060
-
\??\c:\1rxlxfx.exec:\1rxlxfx.exe122⤵PID:2440
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-