Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/12/2024, 19:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0c97dc316d48aae62af52b22d4d106dec30655640475f5cee3ad73b3c206bb12.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
0c97dc316d48aae62af52b22d4d106dec30655640475f5cee3ad73b3c206bb12.exe
-
Size
453KB
-
MD5
b5bd2a67c30cb1cff0c080485d0478ef
-
SHA1
ecb64b84ea0437413d1f1d7718e7a6a195cbe7d8
-
SHA256
0c97dc316d48aae62af52b22d4d106dec30655640475f5cee3ad73b3c206bb12
-
SHA512
cea537a6f15cd7d8de8aa481a24dddc4cb64baa8de2f9a51ab8484bccde1fb7c3beab154a3a2ed7f849f96008d215879526b21582d5a03b8433340f516a75812
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeS:q7Tc2NYHUrAwfMp3CDS
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 50 IoCs
resource yara_rule behavioral1/memory/2236-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2320-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2192-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1628-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-62-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2728-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-73-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2656-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-90-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2324-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-165-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2488-163-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1940-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1888-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1184-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-219-0x00000000001E0000-0x000000000020A000-memory.dmp family_blackmoon behavioral1/memory/1564-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1548-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1628-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1684-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-440-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-446-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1148-461-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1936-474-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1888-482-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/292-508-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1144-521-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/596-533-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1724-565-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1584-602-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1884-609-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3040-622-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2400-896-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2116-952-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2992-977-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1656-1082-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1616-1114-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2920-1175-0x0000000001C60000-0x0000000001C8A000-memory.dmp family_blackmoon behavioral1/memory/800-1269-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2104-1306-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1672-1313-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2192 tthbtb.exe 2320 hhtnhn.exe 1628 dppdj.exe 2808 5djjp.exe 2728 rlfxlrx.exe 2912 vdvvv.exe 2752 fxfflll.exe 2656 vvppj.exe 2796 frxxlfl.exe 2636 1vvpj.exe 2324 rlrrxxf.exe 2624 dvpvj.exe 2868 xrffflx.exe 3008 9dpdp.exe 2824 lrffllx.exe 3016 7thhnb.exe 2488 3dpjj.exe 2432 7xrrflx.exe 1940 vpvdp.exe 1888 pjppv.exe 2104 vvvpd.exe 1184 7hthtt.exe 1920 ppdjd.exe 2424 nbttbb.exe 1956 pdppd.exe 236 vpdpv.exe 1564 rrxflrx.exe 3060 thtbbb.exe 2076 frxxflr.exe 2032 jddpd.exe 1616 xrlrxxl.exe 668 tththh.exe 2196 jjpvd.exe 2208 nbnttb.exe 2552 btbttb.exe 1548 vvjjp.exe 264 7xfxxxx.exe 1628 3hnntb.exe 2808 hbttbb.exe 2724 9dvvd.exe 3044 ddppd.exe 2628 9frrlll.exe 2736 nnbbbb.exe 3000 vvpvp.exe 2732 1dppj.exe 2616 rfrxxxl.exe 2612 tntnbh.exe 2932 hthbhb.exe 2112 jdjpv.exe 840 rlxfllf.exe 1684 lfrflrl.exe 692 bthhnt.exe 3008 5vpvd.exe 2988 7xlrllr.exe 2516 fxrrxlf.exe 2680 hbbhhb.exe 1764 pjvvp.exe 1148 1xrrllf.exe 1152 xllrxxx.exe 1936 nbnhnb.exe 1888 jdddj.exe 448 xxrlrrx.exe 2596 xrfffff.exe 856 9httnn.exe -
resource yara_rule behavioral1/memory/2236-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1940-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1888-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1184-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-219-0x00000000001E0000-0x000000000020A000-memory.dmp upx behavioral1/memory/1564-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/668-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1548-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1548-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1888-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1888-482-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/292-508-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1144-521-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-565-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1884-609-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-622-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-647-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-702-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1224-776-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1656-1082-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1300-1314-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfxlfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2236 wrote to memory of 2192 2236 0c97dc316d48aae62af52b22d4d106dec30655640475f5cee3ad73b3c206bb12.exe 30 PID 2236 wrote to memory of 2192 2236 0c97dc316d48aae62af52b22d4d106dec30655640475f5cee3ad73b3c206bb12.exe 30 PID 2236 wrote to memory of 2192 2236 0c97dc316d48aae62af52b22d4d106dec30655640475f5cee3ad73b3c206bb12.exe 30 PID 2236 wrote to memory of 2192 2236 0c97dc316d48aae62af52b22d4d106dec30655640475f5cee3ad73b3c206bb12.exe 30 PID 2192 wrote to memory of 2320 2192 tthbtb.exe 31 PID 2192 wrote to memory of 2320 2192 tthbtb.exe 31 PID 2192 wrote to memory of 2320 2192 tthbtb.exe 31 PID 2192 wrote to memory of 2320 2192 tthbtb.exe 31 PID 2320 wrote to memory of 1628 2320 hhtnhn.exe 32 PID 2320 wrote to memory of 1628 2320 hhtnhn.exe 32 PID 2320 wrote to memory of 1628 2320 hhtnhn.exe 32 PID 2320 wrote to memory of 1628 2320 hhtnhn.exe 32 PID 1628 wrote to memory of 2808 1628 dppdj.exe 33 PID 1628 wrote to memory of 2808 1628 dppdj.exe 33 PID 1628 wrote to memory of 2808 1628 dppdj.exe 33 PID 1628 wrote to memory of 2808 1628 dppdj.exe 33 PID 2808 wrote to memory of 2728 2808 5djjp.exe 34 PID 2808 wrote to memory of 2728 2808 5djjp.exe 34 PID 2808 wrote to memory of 2728 2808 5djjp.exe 34 PID 2808 wrote to memory of 2728 2808 5djjp.exe 34 PID 2728 wrote to memory of 2912 2728 rlfxlrx.exe 35 PID 2728 wrote to memory of 2912 2728 rlfxlrx.exe 35 PID 2728 wrote to memory of 2912 2728 rlfxlrx.exe 35 PID 2728 wrote to memory of 2912 2728 rlfxlrx.exe 35 PID 2912 wrote to memory of 2752 2912 vdvvv.exe 36 PID 2912 wrote to memory of 2752 2912 vdvvv.exe 36 PID 2912 wrote to memory of 2752 2912 vdvvv.exe 36 PID 2912 wrote to memory of 2752 2912 vdvvv.exe 36 PID 2752 wrote to memory of 2656 2752 fxfflll.exe 37 PID 2752 wrote to memory of 2656 2752 fxfflll.exe 37 PID 2752 wrote to memory of 2656 2752 fxfflll.exe 37 PID 2752 wrote to memory of 2656 2752 fxfflll.exe 37 PID 2656 wrote to memory of 2796 2656 vvppj.exe 38 PID 2656 wrote to memory of 2796 2656 vvppj.exe 38 PID 2656 wrote to memory of 2796 2656 vvppj.exe 38 PID 2656 wrote to memory of 2796 2656 vvppj.exe 38 PID 2796 wrote to memory of 2636 2796 frxxlfl.exe 39 PID 2796 wrote to memory of 2636 2796 frxxlfl.exe 39 PID 2796 wrote to memory of 2636 2796 frxxlfl.exe 39 PID 2796 wrote to memory of 2636 2796 frxxlfl.exe 39 PID 2636 wrote to memory of 2324 2636 1vvpj.exe 40 PID 2636 wrote to memory of 2324 2636 1vvpj.exe 40 PID 2636 wrote to memory of 2324 2636 1vvpj.exe 40 PID 2636 wrote to memory of 2324 2636 1vvpj.exe 40 PID 2324 wrote to memory of 2624 2324 rlrrxxf.exe 41 PID 2324 wrote to memory of 2624 2324 rlrrxxf.exe 41 PID 2324 wrote to memory of 2624 2324 rlrrxxf.exe 41 PID 2324 wrote to memory of 2624 2324 rlrrxxf.exe 41 PID 2624 wrote to memory of 2868 2624 dvpvj.exe 42 PID 2624 wrote to memory of 2868 2624 dvpvj.exe 42 PID 2624 wrote to memory of 2868 2624 dvpvj.exe 42 PID 2624 wrote to memory of 2868 2624 dvpvj.exe 42 PID 2868 wrote to memory of 3008 2868 xrffflx.exe 43 PID 2868 wrote to memory of 3008 2868 xrffflx.exe 43 PID 2868 wrote to memory of 3008 2868 xrffflx.exe 43 PID 2868 wrote to memory of 3008 2868 xrffflx.exe 43 PID 3008 wrote to memory of 2824 3008 9dpdp.exe 44 PID 3008 wrote to memory of 2824 3008 9dpdp.exe 44 PID 3008 wrote to memory of 2824 3008 9dpdp.exe 44 PID 3008 wrote to memory of 2824 3008 9dpdp.exe 44 PID 2824 wrote to memory of 3016 2824 lrffllx.exe 45 PID 2824 wrote to memory of 3016 2824 lrffllx.exe 45 PID 2824 wrote to memory of 3016 2824 lrffllx.exe 45 PID 2824 wrote to memory of 3016 2824 lrffllx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c97dc316d48aae62af52b22d4d106dec30655640475f5cee3ad73b3c206bb12.exe"C:\Users\Admin\AppData\Local\Temp\0c97dc316d48aae62af52b22d4d106dec30655640475f5cee3ad73b3c206bb12.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\tthbtb.exec:\tthbtb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\hhtnhn.exec:\hhtnhn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\dppdj.exec:\dppdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\5djjp.exec:\5djjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\rlfxlrx.exec:\rlfxlrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\vdvvv.exec:\vdvvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\fxfflll.exec:\fxfflll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\vvppj.exec:\vvppj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\frxxlfl.exec:\frxxlfl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\1vvpj.exec:\1vvpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\rlrrxxf.exec:\rlrrxxf.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\dvpvj.exec:\dvpvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\xrffflx.exec:\xrffflx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\9dpdp.exec:\9dpdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\lrffllx.exec:\lrffllx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\7thhnb.exec:\7thhnb.exe17⤵
- Executes dropped EXE
PID:3016 -
\??\c:\3dpjj.exec:\3dpjj.exe18⤵
- Executes dropped EXE
PID:2488 -
\??\c:\7xrrflx.exec:\7xrrflx.exe19⤵
- Executes dropped EXE
PID:2432 -
\??\c:\vpvdp.exec:\vpvdp.exe20⤵
- Executes dropped EXE
PID:1940 -
\??\c:\pjppv.exec:\pjppv.exe21⤵
- Executes dropped EXE
PID:1888 -
\??\c:\vvvpd.exec:\vvvpd.exe22⤵
- Executes dropped EXE
PID:2104 -
\??\c:\7hthtt.exec:\7hthtt.exe23⤵
- Executes dropped EXE
PID:1184 -
\??\c:\ppdjd.exec:\ppdjd.exe24⤵
- Executes dropped EXE
PID:1920 -
\??\c:\nbttbb.exec:\nbttbb.exe25⤵
- Executes dropped EXE
PID:2424 -
\??\c:\pdppd.exec:\pdppd.exe26⤵
- Executes dropped EXE
PID:1956 -
\??\c:\vpdpv.exec:\vpdpv.exe27⤵
- Executes dropped EXE
PID:236 -
\??\c:\rrxflrx.exec:\rrxflrx.exe28⤵
- Executes dropped EXE
PID:1564 -
\??\c:\thtbbb.exec:\thtbbb.exe29⤵
- Executes dropped EXE
PID:3060 -
\??\c:\frxxflr.exec:\frxxflr.exe30⤵
- Executes dropped EXE
PID:2076 -
\??\c:\jddpd.exec:\jddpd.exe31⤵
- Executes dropped EXE
PID:2032 -
\??\c:\xrlrxxl.exec:\xrlrxxl.exe32⤵
- Executes dropped EXE
PID:1616 -
\??\c:\tththh.exec:\tththh.exe33⤵
- Executes dropped EXE
PID:668 -
\??\c:\jjpvd.exec:\jjpvd.exe34⤵
- Executes dropped EXE
PID:2196 -
\??\c:\nbnttb.exec:\nbnttb.exe35⤵
- Executes dropped EXE
PID:2208 -
\??\c:\btbttb.exec:\btbttb.exe36⤵
- Executes dropped EXE
PID:2552 -
\??\c:\vvjjp.exec:\vvjjp.exe37⤵
- Executes dropped EXE
PID:1548 -
\??\c:\7xfxxxx.exec:\7xfxxxx.exe38⤵
- Executes dropped EXE
PID:264 -
\??\c:\3hnntb.exec:\3hnntb.exe39⤵
- Executes dropped EXE
PID:1628 -
\??\c:\hbttbb.exec:\hbttbb.exe40⤵
- Executes dropped EXE
PID:2808 -
\??\c:\9dvvd.exec:\9dvvd.exe41⤵
- Executes dropped EXE
PID:2724 -
\??\c:\ddppd.exec:\ddppd.exe42⤵
- Executes dropped EXE
PID:3044 -
\??\c:\9frrlll.exec:\9frrlll.exe43⤵
- Executes dropped EXE
PID:2628 -
\??\c:\nnbbbb.exec:\nnbbbb.exe44⤵
- Executes dropped EXE
PID:2736 -
\??\c:\vvpvp.exec:\vvpvp.exe45⤵
- Executes dropped EXE
PID:3000 -
\??\c:\1dppj.exec:\1dppj.exe46⤵
- Executes dropped EXE
PID:2732 -
\??\c:\rfrxxxl.exec:\rfrxxxl.exe47⤵
- Executes dropped EXE
PID:2616 -
\??\c:\tntnbh.exec:\tntnbh.exe48⤵
- Executes dropped EXE
PID:2612 -
\??\c:\hthbhb.exec:\hthbhb.exe49⤵
- Executes dropped EXE
PID:2932 -
\??\c:\jdjpv.exec:\jdjpv.exe50⤵
- Executes dropped EXE
PID:2112 -
\??\c:\rlxfllf.exec:\rlxfllf.exe51⤵
- Executes dropped EXE
PID:840 -
\??\c:\lfrflrl.exec:\lfrflrl.exe52⤵
- Executes dropped EXE
PID:1684 -
\??\c:\bthhnt.exec:\bthhnt.exe53⤵
- Executes dropped EXE
PID:692 -
\??\c:\5vpvd.exec:\5vpvd.exe54⤵
- Executes dropped EXE
PID:3008 -
\??\c:\7xlrllr.exec:\7xlrllr.exe55⤵
- Executes dropped EXE
PID:2988 -
\??\c:\fxrrxlf.exec:\fxrrxlf.exe56⤵
- Executes dropped EXE
PID:2516 -
\??\c:\hbbhhb.exec:\hbbhhb.exe57⤵
- Executes dropped EXE
PID:2680 -
\??\c:\pjvvp.exec:\pjvvp.exe58⤵
- Executes dropped EXE
PID:1764 -
\??\c:\1xrrllf.exec:\1xrrllf.exe59⤵
- Executes dropped EXE
PID:1148 -
\??\c:\xllrxxx.exec:\xllrxxx.exe60⤵
- Executes dropped EXE
PID:1152 -
\??\c:\nbnhnb.exec:\nbnhnb.exe61⤵
- Executes dropped EXE
PID:1936 -
\??\c:\jdddj.exec:\jdddj.exe62⤵
- Executes dropped EXE
PID:1888 -
\??\c:\xxrlrrx.exec:\xxrlrrx.exe63⤵
- Executes dropped EXE
PID:448 -
\??\c:\xrfffff.exec:\xrfffff.exe64⤵
- Executes dropped EXE
PID:2596 -
\??\c:\9httnn.exec:\9httnn.exe65⤵
- Executes dropped EXE
PID:856 -
\??\c:\7jdjd.exec:\7jdjd.exe66⤵PID:292
-
\??\c:\1vjpv.exec:\1vjpv.exe67⤵PID:1556
-
\??\c:\rxrxxxx.exec:\rxrxxxx.exe68⤵PID:1956
-
\??\c:\nhbhhh.exec:\nhbhhh.exe69⤵PID:1144
-
\??\c:\dvppj.exec:\dvppj.exe70⤵PID:596
-
\??\c:\1vpvd.exec:\1vpvd.exe71⤵PID:2276
-
\??\c:\xxrfxfr.exec:\xxrfxfr.exe72⤵PID:3060
-
\??\c:\hbhhtt.exec:\hbhhtt.exe73⤵PID:1904
-
\??\c:\7hhtht.exec:\7hhtht.exe74⤵PID:2536
-
\??\c:\jdpjv.exec:\jdpjv.exe75⤵PID:1724
-
\??\c:\rxxlflf.exec:\rxxlflf.exe76⤵PID:1688
-
\??\c:\rlffrfr.exec:\rlffrfr.exe77⤵PID:888
-
\??\c:\ttnthh.exec:\ttnthh.exe78⤵PID:2556
-
\??\c:\jvjjj.exec:\jvjjj.exe79⤵PID:1944
-
\??\c:\rxlrfrf.exec:\rxlrfrf.exe80⤵PID:2316
-
\??\c:\5lxfllx.exec:\5lxfllx.exe81⤵PID:1584
-
\??\c:\htnntt.exec:\htnntt.exe82⤵PID:1884
-
\??\c:\vjjjj.exec:\vjjjj.exe83⤵PID:2100
-
\??\c:\ddpjp.exec:\ddpjp.exe84⤵PID:3040
-
\??\c:\fxrxffx.exec:\fxrxffx.exe85⤵PID:2908
-
\??\c:\5hbbhn.exec:\5hbbhn.exe86⤵PID:2912
-
\??\c:\htnnnt.exec:\htnnnt.exe87⤵PID:3036
-
\??\c:\pjvdv.exec:\pjvdv.exe88⤵PID:2880
-
\??\c:\9xllfff.exec:\9xllfff.exe89⤵PID:2788
-
\??\c:\hntnnb.exec:\hntnnb.exe90⤵PID:2984
-
\??\c:\nhhtbh.exec:\nhhtbh.exe91⤵PID:2796
-
\??\c:\dvvdp.exec:\dvvdp.exe92⤵
- System Location Discovery: System Language Discovery
PID:2740 -
\??\c:\xfrxlrx.exec:\xfrxlrx.exe93⤵PID:2404
-
\??\c:\flfrfrf.exec:\flfrfrf.exe94⤵PID:2672
-
\??\c:\bbbnth.exec:\bbbnth.exe95⤵PID:2624
-
\??\c:\jjdjv.exec:\jjdjv.exe96⤵PID:2036
-
\??\c:\pjvpv.exec:\pjvpv.exe97⤵PID:2472
-
\??\c:\flflxxl.exec:\flflxxl.exe98⤵PID:2688
-
\??\c:\tbnbnb.exec:\tbnbnb.exe99⤵PID:768
-
\??\c:\9vvvp.exec:\9vvvp.exe100⤵PID:3016
-
\??\c:\xxxflll.exec:\xxxflll.exe101⤵PID:884
-
\??\c:\ffrrrfl.exec:\ffrrrfl.exe102⤵PID:2264
-
\??\c:\tnbhnh.exec:\tnbhnh.exe103⤵PID:1764
-
\??\c:\5vvdj.exec:\5vvdj.exe104⤵PID:2172
-
\??\c:\xxllrrx.exec:\xxllrrx.exe105⤵PID:2268
-
\??\c:\fxrrffl.exec:\fxrrffl.exe106⤵PID:1940
-
\??\c:\hhttbt.exec:\hhttbt.exe107⤵PID:2248
-
\??\c:\1pvjv.exec:\1pvjv.exe108⤵
- System Location Discovery: System Language Discovery
PID:3064 -
\??\c:\ffrxffl.exec:\ffrxffl.exe109⤵PID:1224
-
\??\c:\rrflxrf.exec:\rrflxrf.exe110⤵PID:1604
-
\??\c:\nnnnbb.exec:\nnnnbb.exe111⤵PID:2424
-
\??\c:\vvjjp.exec:\vvjjp.exe112⤵PID:1660
-
\??\c:\7xrxxxf.exec:\7xrxxxf.exe113⤵PID:2024
-
\??\c:\hbhttb.exec:\hbhttb.exe114⤵PID:952
-
\??\c:\1thttt.exec:\1thttt.exe115⤵PID:616
-
\??\c:\7pjvv.exec:\7pjvv.exe116⤵PID:1784
-
\??\c:\xrflrrx.exec:\xrflrrx.exe117⤵PID:556
-
\??\c:\nhbbnb.exec:\nhbbnb.exe118⤵PID:2064
-
\??\c:\btbhnb.exec:\btbhnb.exe119⤵PID:592
-
\??\c:\vpjpv.exec:\vpjpv.exe120⤵PID:804
-
\??\c:\xxllxxl.exec:\xxllxxl.exe121⤵PID:2388
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-