Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29/12/2024, 00:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
77c24a7fd8754d0b8cf05feac2478ff1b4fc202303a856475424a0b5f548fad8.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
77c24a7fd8754d0b8cf05feac2478ff1b4fc202303a856475424a0b5f548fad8.exe
-
Size
456KB
-
MD5
ed74182686793d6838e9c386d1d7360a
-
SHA1
0c4356db67546e546e0646dc11cc15096fa99131
-
SHA256
77c24a7fd8754d0b8cf05feac2478ff1b4fc202303a856475424a0b5f548fad8
-
SHA512
70cc7d52081a40e8be76c11b342c10b6049559288beafd0ae14935c5cffb0b31da42600e7c08b521a00a235728ae899b6c2efeb85cbc64d77f584d233603734f
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRB:q7Tc2NYHUrAwfMp3CDRB
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/3008-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1992-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2264-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1632-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-77-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2632-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1792-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3040-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3040-120-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2664-148-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2636-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-183-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2068-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/912-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2492-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2148-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1648-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/592-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/840-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/576-54-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2864-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2196-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3040-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3044-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1052-467-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2260-474-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1808-544-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-699-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2556-729-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2908-891-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-910-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1848-929-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3068-978-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/344-1051-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-1210-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2452-1275-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1992 7vdvp.exe 2264 rlfrxlx.exe 2364 hhhthn.exe 2932 vdpvj.exe 576 llxfrlr.exe 2836 pdjpv.exe 1632 pppvj.exe 2828 xxrlxxr.exe 2632 flxrlrl.exe 2764 dvpdp.exe 2616 rrllxfx.exe 3040 fflfxxl.exe 1792 bttbhh.exe 1864 htbbnt.exe 2664 htnhtt.exe 840 bbbhbh.exe 2696 1lxlrrx.exe 1964 bbtthn.exe 2636 nhthhn.exe 2448 fflffrl.exe 1052 lxlxlxf.exe 2068 7bnbnt.exe 2452 1dddp.exe 1264 fxffllr.exe 912 ttthnb.exe 2024 jvdvv.exe 1784 bbtthh.exe 2520 bnnthn.exe 592 dvdjp.exe 2016 frfflxx.exe 2492 hbntbn.exe 1668 pddjd.exe 2148 tttthh.exe 2104 htnnnt.exe 1648 pjpdp.exe 2864 jvddj.exe 2196 xrxxllr.exe 2380 hhnthh.exe 2748 1xlrxrx.exe 2704 bthhnh.exe 2892 ffxxrlx.exe 2308 bnttnh.exe 2812 vjdvd.exe 2652 vdjdd.exe 1908 tntbhh.exe 2616 jpdvv.exe 3040 jvdvv.exe 2608 1xlffll.exe 1864 htttbb.exe 3044 3dpdj.exe 820 frxxxrr.exe 840 rllrxfl.exe 1552 1nttbt.exe 1308 pppvj.exe 3068 pdpvd.exe 2236 1btbhn.exe 3028 nbtntn.exe 1052 3vjpp.exe 2260 rfrxxxx.exe 1276 1tnbnt.exe 2124 htnnbt.exe 1704 ppjpd.exe 2240 rfrrfxl.exe 352 5xlxlrf.exe -
resource yara_rule behavioral1/memory/3008-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1992-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/912-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/592-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/840-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1308-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1052-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-487-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-512-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1808-544-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/584-605-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-612-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1872-713-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/956-752-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/592-784-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-809-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1488-836-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2792-872-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-878-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-891-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-910-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/344-1051-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-1057-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-1098-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1912-1111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-1223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-1236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/924-1261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-1268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1144-1288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-1327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-1353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-1366-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xlfllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfrxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrxxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btthnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhthhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hhbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bnbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxxxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3008 wrote to memory of 1992 3008 77c24a7fd8754d0b8cf05feac2478ff1b4fc202303a856475424a0b5f548fad8.exe 30 PID 3008 wrote to memory of 1992 3008 77c24a7fd8754d0b8cf05feac2478ff1b4fc202303a856475424a0b5f548fad8.exe 30 PID 3008 wrote to memory of 1992 3008 77c24a7fd8754d0b8cf05feac2478ff1b4fc202303a856475424a0b5f548fad8.exe 30 PID 3008 wrote to memory of 1992 3008 77c24a7fd8754d0b8cf05feac2478ff1b4fc202303a856475424a0b5f548fad8.exe 30 PID 1992 wrote to memory of 2264 1992 7vdvp.exe 31 PID 1992 wrote to memory of 2264 1992 7vdvp.exe 31 PID 1992 wrote to memory of 2264 1992 7vdvp.exe 31 PID 1992 wrote to memory of 2264 1992 7vdvp.exe 31 PID 2264 wrote to memory of 2364 2264 rlfrxlx.exe 32 PID 2264 wrote to memory of 2364 2264 rlfrxlx.exe 32 PID 2264 wrote to memory of 2364 2264 rlfrxlx.exe 32 PID 2264 wrote to memory of 2364 2264 rlfrxlx.exe 32 PID 2364 wrote to memory of 2932 2364 hhhthn.exe 33 PID 2364 wrote to memory of 2932 2364 hhhthn.exe 33 PID 2364 wrote to memory of 2932 2364 hhhthn.exe 33 PID 2364 wrote to memory of 2932 2364 hhhthn.exe 33 PID 2932 wrote to memory of 576 2932 vdpvj.exe 34 PID 2932 wrote to memory of 576 2932 vdpvj.exe 34 PID 2932 wrote to memory of 576 2932 vdpvj.exe 34 PID 2932 wrote to memory of 576 2932 vdpvj.exe 34 PID 576 wrote to memory of 2836 576 llxfrlr.exe 35 PID 576 wrote to memory of 2836 576 llxfrlr.exe 35 PID 576 wrote to memory of 2836 576 llxfrlr.exe 35 PID 576 wrote to memory of 2836 576 llxfrlr.exe 35 PID 2836 wrote to memory of 1632 2836 pdjpv.exe 36 PID 2836 wrote to memory of 1632 2836 pdjpv.exe 36 PID 2836 wrote to memory of 1632 2836 pdjpv.exe 36 PID 2836 wrote to memory of 1632 2836 pdjpv.exe 36 PID 1632 wrote to memory of 2828 1632 pppvj.exe 37 PID 1632 wrote to memory of 2828 1632 pppvj.exe 37 PID 1632 wrote to memory of 2828 1632 pppvj.exe 37 PID 1632 wrote to memory of 2828 1632 pppvj.exe 37 PID 2828 wrote to memory of 2632 2828 xxrlxxr.exe 38 PID 2828 wrote to memory of 2632 2828 xxrlxxr.exe 38 PID 2828 wrote to memory of 2632 2828 xxrlxxr.exe 38 PID 2828 wrote to memory of 2632 2828 xxrlxxr.exe 38 PID 2632 wrote to memory of 2764 2632 flxrlrl.exe 39 PID 2632 wrote to memory of 2764 2632 flxrlrl.exe 39 PID 2632 wrote to memory of 2764 2632 flxrlrl.exe 39 PID 2632 wrote to memory of 2764 2632 flxrlrl.exe 39 PID 2764 wrote to memory of 2616 2764 dvpdp.exe 40 PID 2764 wrote to memory of 2616 2764 dvpdp.exe 40 PID 2764 wrote to memory of 2616 2764 dvpdp.exe 40 PID 2764 wrote to memory of 2616 2764 dvpdp.exe 40 PID 2616 wrote to memory of 3040 2616 rrllxfx.exe 41 PID 2616 wrote to memory of 3040 2616 rrllxfx.exe 41 PID 2616 wrote to memory of 3040 2616 rrllxfx.exe 41 PID 2616 wrote to memory of 3040 2616 rrllxfx.exe 41 PID 3040 wrote to memory of 1792 3040 fflfxxl.exe 42 PID 3040 wrote to memory of 1792 3040 fflfxxl.exe 42 PID 3040 wrote to memory of 1792 3040 fflfxxl.exe 42 PID 3040 wrote to memory of 1792 3040 fflfxxl.exe 42 PID 1792 wrote to memory of 1864 1792 bttbhh.exe 43 PID 1792 wrote to memory of 1864 1792 bttbhh.exe 43 PID 1792 wrote to memory of 1864 1792 bttbhh.exe 43 PID 1792 wrote to memory of 1864 1792 bttbhh.exe 43 PID 1864 wrote to memory of 2664 1864 htbbnt.exe 44 PID 1864 wrote to memory of 2664 1864 htbbnt.exe 44 PID 1864 wrote to memory of 2664 1864 htbbnt.exe 44 PID 1864 wrote to memory of 2664 1864 htbbnt.exe 44 PID 2664 wrote to memory of 840 2664 htnhtt.exe 45 PID 2664 wrote to memory of 840 2664 htnhtt.exe 45 PID 2664 wrote to memory of 840 2664 htnhtt.exe 45 PID 2664 wrote to memory of 840 2664 htnhtt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\77c24a7fd8754d0b8cf05feac2478ff1b4fc202303a856475424a0b5f548fad8.exe"C:\Users\Admin\AppData\Local\Temp\77c24a7fd8754d0b8cf05feac2478ff1b4fc202303a856475424a0b5f548fad8.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\7vdvp.exec:\7vdvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\rlfrxlx.exec:\rlfrxlx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\hhhthn.exec:\hhhthn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\vdpvj.exec:\vdpvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\llxfrlr.exec:\llxfrlr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:576 -
\??\c:\pdjpv.exec:\pdjpv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\pppvj.exec:\pppvj.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\xxrlxxr.exec:\xxrlxxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\flxrlrl.exec:\flxrlrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\dvpdp.exec:\dvpdp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\rrllxfx.exec:\rrllxfx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\fflfxxl.exec:\fflfxxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\bttbhh.exec:\bttbhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\htbbnt.exec:\htbbnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\htnhtt.exec:\htnhtt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\bbbhbh.exec:\bbbhbh.exe17⤵
- Executes dropped EXE
PID:840 -
\??\c:\1lxlrrx.exec:\1lxlrrx.exe18⤵
- Executes dropped EXE
PID:2696 -
\??\c:\bbtthn.exec:\bbtthn.exe19⤵
- Executes dropped EXE
PID:1964 -
\??\c:\nhthhn.exec:\nhthhn.exe20⤵
- Executes dropped EXE
PID:2636 -
\??\c:\fflffrl.exec:\fflffrl.exe21⤵
- Executes dropped EXE
PID:2448 -
\??\c:\lxlxlxf.exec:\lxlxlxf.exe22⤵
- Executes dropped EXE
PID:1052 -
\??\c:\7bnbnt.exec:\7bnbnt.exe23⤵
- Executes dropped EXE
PID:2068 -
\??\c:\1dddp.exec:\1dddp.exe24⤵
- Executes dropped EXE
PID:2452 -
\??\c:\fxffllr.exec:\fxffllr.exe25⤵
- Executes dropped EXE
PID:1264 -
\??\c:\ttthnb.exec:\ttthnb.exe26⤵
- Executes dropped EXE
PID:912 -
\??\c:\jvdvv.exec:\jvdvv.exe27⤵
- Executes dropped EXE
PID:2024 -
\??\c:\bbtthh.exec:\bbtthh.exe28⤵
- Executes dropped EXE
PID:1784 -
\??\c:\bnnthn.exec:\bnnthn.exe29⤵
- Executes dropped EXE
PID:2520 -
\??\c:\dvdjp.exec:\dvdjp.exe30⤵
- Executes dropped EXE
PID:592 -
\??\c:\frfflxx.exec:\frfflxx.exe31⤵
- Executes dropped EXE
PID:2016 -
\??\c:\hbntbn.exec:\hbntbn.exe32⤵
- Executes dropped EXE
PID:2492 -
\??\c:\pddjd.exec:\pddjd.exe33⤵
- Executes dropped EXE
PID:1668 -
\??\c:\tttthh.exec:\tttthh.exe34⤵
- Executes dropped EXE
PID:2148 -
\??\c:\htnnnt.exec:\htnnnt.exe35⤵
- Executes dropped EXE
PID:2104 -
\??\c:\pjpdp.exec:\pjpdp.exe36⤵
- Executes dropped EXE
PID:1648 -
\??\c:\jvddj.exec:\jvddj.exe37⤵
- Executes dropped EXE
PID:2864 -
\??\c:\xrxxllr.exec:\xrxxllr.exe38⤵
- Executes dropped EXE
PID:2196 -
\??\c:\hhnthh.exec:\hhnthh.exe39⤵
- Executes dropped EXE
PID:2380 -
\??\c:\1xlrxrx.exec:\1xlrxrx.exe40⤵
- Executes dropped EXE
PID:2748 -
\??\c:\bthhnh.exec:\bthhnh.exe41⤵
- Executes dropped EXE
PID:2704 -
\??\c:\ffxxrlx.exec:\ffxxrlx.exe42⤵
- Executes dropped EXE
PID:2892 -
\??\c:\bnttnh.exec:\bnttnh.exe43⤵
- Executes dropped EXE
PID:2308 -
\??\c:\vjdvd.exec:\vjdvd.exe44⤵
- Executes dropped EXE
PID:2812 -
\??\c:\vdjdd.exec:\vdjdd.exe45⤵
- Executes dropped EXE
PID:2652 -
\??\c:\tntbhh.exec:\tntbhh.exe46⤵
- Executes dropped EXE
PID:1908 -
\??\c:\jpdvv.exec:\jpdvv.exe47⤵
- Executes dropped EXE
PID:2616 -
\??\c:\jvdvv.exec:\jvdvv.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3040 -
\??\c:\1xlffll.exec:\1xlffll.exe49⤵
- Executes dropped EXE
PID:2608 -
\??\c:\htttbb.exec:\htttbb.exe50⤵
- Executes dropped EXE
PID:1864 -
\??\c:\3dpdj.exec:\3dpdj.exe51⤵
- Executes dropped EXE
PID:3044 -
\??\c:\frxxxrr.exec:\frxxxrr.exe52⤵
- Executes dropped EXE
PID:820 -
\??\c:\rllrxfl.exec:\rllrxfl.exe53⤵
- Executes dropped EXE
PID:840 -
\??\c:\1nttbt.exec:\1nttbt.exe54⤵
- Executes dropped EXE
PID:1552 -
\??\c:\pppvj.exec:\pppvj.exe55⤵
- Executes dropped EXE
PID:1308 -
\??\c:\pdpvd.exec:\pdpvd.exe56⤵
- Executes dropped EXE
PID:3068 -
\??\c:\1btbhn.exec:\1btbhn.exe57⤵
- Executes dropped EXE
PID:2236 -
\??\c:\nbtntn.exec:\nbtntn.exe58⤵
- Executes dropped EXE
PID:3028 -
\??\c:\3vjpp.exec:\3vjpp.exe59⤵
- Executes dropped EXE
PID:1052 -
\??\c:\rfrxxxx.exec:\rfrxxxx.exe60⤵
- Executes dropped EXE
PID:2260 -
\??\c:\1tnbnt.exec:\1tnbnt.exe61⤵
- Executes dropped EXE
PID:1276 -
\??\c:\htnnbt.exec:\htnnbt.exe62⤵
- Executes dropped EXE
PID:2124 -
\??\c:\ppjpd.exec:\ppjpd.exe63⤵
- Executes dropped EXE
PID:1704 -
\??\c:\rfrrfxl.exec:\rfrrfxl.exe64⤵
- Executes dropped EXE
PID:2240 -
\??\c:\5xlxlrf.exec:\5xlxlrf.exe65⤵
- Executes dropped EXE
PID:352 -
\??\c:\hntnnh.exec:\hntnnh.exe66⤵PID:2024
-
\??\c:\9jjpj.exec:\9jjpj.exe67⤵PID:2228
-
\??\c:\pdpvv.exec:\pdpvv.exe68⤵PID:2564
-
\??\c:\9xlflfl.exec:\9xlflfl.exe69⤵PID:1528
-
\??\c:\5xfllll.exec:\5xfllll.exe70⤵PID:892
-
\??\c:\7bhhnn.exec:\7bhhnn.exe71⤵PID:1808
-
\??\c:\vpjdv.exec:\vpjdv.exe72⤵PID:2492
-
\??\c:\rxfrrlr.exec:\rxfrrlr.exe73⤵PID:3008
-
\??\c:\hbnbhh.exec:\hbnbhh.exe74⤵PID:2340
-
\??\c:\btbthh.exec:\btbthh.exe75⤵PID:2352
-
\??\c:\pjjvp.exec:\pjjvp.exe76⤵PID:2104
-
\??\c:\pdpvd.exec:\pdpvd.exe77⤵PID:1272
-
\??\c:\lxlffxl.exec:\lxlffxl.exe78⤵PID:816
-
\??\c:\hbtbnt.exec:\hbtbnt.exe79⤵PID:2792
-
\??\c:\hbtbnh.exec:\hbtbnh.exe80⤵PID:576
-
\??\c:\vvpvj.exec:\vvpvj.exe81⤵PID:2820
-
\??\c:\5lxrrrf.exec:\5lxrrrf.exe82⤵PID:584
-
\??\c:\5tbnnn.exec:\5tbnnn.exe83⤵PID:2440
-
\??\c:\nnbhhb.exec:\nnbhhb.exe84⤵PID:2620
-
\??\c:\1pjdd.exec:\1pjdd.exe85⤵PID:2632
-
\??\c:\3djdp.exec:\3djdp.exe86⤵PID:2756
-
\??\c:\xxxlffl.exec:\xxxlffl.exe87⤵PID:2660
-
\??\c:\bbnbht.exec:\bbnbht.exe88⤵PID:2924
-
\??\c:\1nbbbb.exec:\1nbbbb.exe89⤵PID:2464
-
\??\c:\3pjpp.exec:\3pjpp.exe90⤵
- System Location Discovery: System Language Discovery
PID:1848 -
\??\c:\djppp.exec:\djppp.exe91⤵PID:2000
-
\??\c:\5xlrffl.exec:\5xlrffl.exe92⤵PID:1720
-
\??\c:\hthhtt.exec:\hthhtt.exe93⤵PID:1324
-
\??\c:\dvddd.exec:\dvddd.exe94⤵PID:2312
-
\??\c:\xrxxffr.exec:\xrxxffr.exe95⤵PID:2776
-
\??\c:\5rlrffl.exec:\5rlrffl.exe96⤵PID:2904
-
\??\c:\9nttbb.exec:\9nttbb.exe97⤵PID:3060
-
\??\c:\5thnnt.exec:\5thnnt.exe98⤵PID:2152
-
\??\c:\ppjdp.exec:\ppjdp.exe99⤵PID:1872
-
\??\c:\xfllxlr.exec:\xfllxlr.exe100⤵PID:1288
-
\??\c:\llflffx.exec:\llflffx.exe101⤵PID:2556
-
\??\c:\nbnbhh.exec:\nbnbhh.exe102⤵PID:2220
-
\??\c:\dpddj.exec:\dpddj.exe103⤵PID:1276
-
\??\c:\dvddd.exec:\dvddd.exe104⤵PID:2136
-
\??\c:\lllrflr.exec:\lllrflr.exe105⤵PID:956
-
\??\c:\9nhnnn.exec:\9nhnnn.exe106⤵PID:1104
-
\??\c:\nhbhbt.exec:\nhbhbt.exe107⤵PID:1144
-
\??\c:\9dppv.exec:\9dppv.exe108⤵PID:1800
-
\??\c:\fxfxxxf.exec:\fxfxxxf.exe109⤵PID:2228
-
\??\c:\9xlrxlr.exec:\9xlrxlr.exe110⤵PID:592
-
\??\c:\hhtbnn.exec:\hhtbnn.exe111⤵PID:1528
-
\??\c:\jvjdp.exec:\jvjdp.exe112⤵PID:2016
-
\??\c:\vpppv.exec:\vpppv.exe113⤵PID:2100
-
\??\c:\xxrrlrf.exec:\xxrrlrf.exe114⤵PID:2176
-
\??\c:\httbnt.exec:\httbnt.exe115⤵PID:332
-
\??\c:\btbhnn.exec:\btbhnn.exe116⤵PID:2420
-
\??\c:\jdpvj.exec:\jdpvj.exe117⤵PID:2372
-
\??\c:\rlxrfxx.exec:\rlxrfxx.exe118⤵PID:1488
-
\??\c:\xrffrxl.exec:\xrffrxl.exe119⤵PID:2404
-
\??\c:\nhttbb.exec:\nhttbb.exe120⤵PID:1912
-
\??\c:\bnbbnh.exec:\bnbbnh.exe121⤵PID:2792
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-