Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29/12/2024, 02:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a8d10410fa44038a3b506ffd0640a3657df7c216225f9fd5b88cf9e59938a2ab.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
a8d10410fa44038a3b506ffd0640a3657df7c216225f9fd5b88cf9e59938a2ab.exe
-
Size
453KB
-
MD5
e716c5deb71f84b64bccc9f74f26ab32
-
SHA1
b4153d8e4a5b7dd24a549dc55d4a9a1ca951d875
-
SHA256
a8d10410fa44038a3b506ffd0640a3657df7c216225f9fd5b88cf9e59938a2ab
-
SHA512
1318774c6a5179e3f49f8525fd4384cb0bc733af63d5501170569d0581ff32593ce7cb2c2d3dd4e6f7817a52f0c2a60dce65cae4913a2365fa8f836303a60d71
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeL:q7Tc2NYHUrAwfMp3CDL
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 47 IoCs
resource yara_rule behavioral1/memory/2240-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-18-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2812-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2368-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2484-79-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2484-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-85-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2968-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-90-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1832-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1968-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-130-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2744-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1976-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2100-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2100-185-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/376-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1548-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1208-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1880-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-336-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2592-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1872-374-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/1872-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1632-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1444-437-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-462-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/952-490-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-536-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2080-543-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2604-610-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2964-700-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2420-750-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1756-793-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1744-800-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1744-802-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2520-808-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2708 vpdpd.exe 2812 3rrfffr.exe 2368 ppjdv.exe 2992 tnbhnb.exe 2788 5lfxffl.exe 2688 dvvdv.exe 2484 jjvvd.exe 2968 3jdjj.exe 1832 xlfrxlf.exe 1968 lllrxfr.exe 2828 fxrfxfl.exe 3024 ffxlxxf.exe 2744 tnbbnt.exe 2796 7fxffff.exe 1816 3ppjd.exe 2344 xrrlxxf.exe 1976 nhbhhn.exe 2100 7xrrflx.exe 408 5btbhn.exe 2472 xrlrxfr.exe 1340 5tbhnt.exe 1476 7flrxfl.exe 376 fxrxlfx.exe 1876 xffrllx.exe 1712 9httbh.exe 1548 fxlxlrf.exe 2668 tbnbbt.exe 1208 rlfrllf.exe 1880 bnbnhb.exe 1220 1fxflrf.exe 576 rllflrx.exe 2864 dpjjd.exe 2764 rlflfrx.exe 2692 jdpvd.exe 2900 vppvj.exe 2872 rrlxlrx.exe 2608 nhhtnt.exe 2592 djdjd.exe 2004 dvpvp.exe 2272 bttbnh.exe 1576 bnbhtt.exe 1872 9djvd.exe 2324 xxrlrxl.exe 2664 nhbntt.exe 1632 vpjjj.exe 2952 pjvjv.exe 2956 fxrxllr.exe 2904 tnbhnn.exe 2848 3ttbnt.exe 2936 pjdjv.exe 3060 lfrrxxx.exe 1444 xrllrxl.exe 2360 5btbtb.exe 1972 7dpdj.exe 2164 ddvjp.exe 2124 fxxxffr.exe 2376 thbhhn.exe 2380 5pjvp.exe 952 vpjvv.exe 2524 ffxfrxl.exe 1340 3nhnbb.exe 1388 vvdpj.exe 2372 ppjjj.exe 352 rrlrflx.exe -
resource yara_rule behavioral1/memory/2240-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1832-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1976-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/376-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/376-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1548-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1548-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1208-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1880-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-343-0x0000000000250000-0x000000000027A000-memory.dmp upx behavioral1/memory/1872-374-0x00000000003D0000-0x00000000003FA000-memory.dmp upx behavioral1/memory/1872-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1444-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-462-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/952-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-536-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-589-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-662-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-700-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-750-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/948-775-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxlxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a8d10410fa44038a3b506ffd0640a3657df7c216225f9fd5b88cf9e59938a2ab.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bththn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lxrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2240 wrote to memory of 2708 2240 a8d10410fa44038a3b506ffd0640a3657df7c216225f9fd5b88cf9e59938a2ab.exe 31 PID 2240 wrote to memory of 2708 2240 a8d10410fa44038a3b506ffd0640a3657df7c216225f9fd5b88cf9e59938a2ab.exe 31 PID 2240 wrote to memory of 2708 2240 a8d10410fa44038a3b506ffd0640a3657df7c216225f9fd5b88cf9e59938a2ab.exe 31 PID 2240 wrote to memory of 2708 2240 a8d10410fa44038a3b506ffd0640a3657df7c216225f9fd5b88cf9e59938a2ab.exe 31 PID 2708 wrote to memory of 2812 2708 vpdpd.exe 32 PID 2708 wrote to memory of 2812 2708 vpdpd.exe 32 PID 2708 wrote to memory of 2812 2708 vpdpd.exe 32 PID 2708 wrote to memory of 2812 2708 vpdpd.exe 32 PID 2812 wrote to memory of 2368 2812 3rrfffr.exe 33 PID 2812 wrote to memory of 2368 2812 3rrfffr.exe 33 PID 2812 wrote to memory of 2368 2812 3rrfffr.exe 33 PID 2812 wrote to memory of 2368 2812 3rrfffr.exe 33 PID 2368 wrote to memory of 2992 2368 ppjdv.exe 34 PID 2368 wrote to memory of 2992 2368 ppjdv.exe 34 PID 2368 wrote to memory of 2992 2368 ppjdv.exe 34 PID 2368 wrote to memory of 2992 2368 ppjdv.exe 34 PID 2992 wrote to memory of 2788 2992 tnbhnb.exe 35 PID 2992 wrote to memory of 2788 2992 tnbhnb.exe 35 PID 2992 wrote to memory of 2788 2992 tnbhnb.exe 35 PID 2992 wrote to memory of 2788 2992 tnbhnb.exe 35 PID 2788 wrote to memory of 2688 2788 5lfxffl.exe 36 PID 2788 wrote to memory of 2688 2788 5lfxffl.exe 36 PID 2788 wrote to memory of 2688 2788 5lfxffl.exe 36 PID 2788 wrote to memory of 2688 2788 5lfxffl.exe 36 PID 2688 wrote to memory of 2484 2688 dvvdv.exe 37 PID 2688 wrote to memory of 2484 2688 dvvdv.exe 37 PID 2688 wrote to memory of 2484 2688 dvvdv.exe 37 PID 2688 wrote to memory of 2484 2688 dvvdv.exe 37 PID 2484 wrote to memory of 2968 2484 jjvvd.exe 38 PID 2484 wrote to memory of 2968 2484 jjvvd.exe 38 PID 2484 wrote to memory of 2968 2484 jjvvd.exe 38 PID 2484 wrote to memory of 2968 2484 jjvvd.exe 38 PID 2968 wrote to memory of 1832 2968 3jdjj.exe 39 PID 2968 wrote to memory of 1832 2968 3jdjj.exe 39 PID 2968 wrote to memory of 1832 2968 3jdjj.exe 39 PID 2968 wrote to memory of 1832 2968 3jdjj.exe 39 PID 1832 wrote to memory of 1968 1832 xlfrxlf.exe 40 PID 1832 wrote to memory of 1968 1832 xlfrxlf.exe 40 PID 1832 wrote to memory of 1968 1832 xlfrxlf.exe 40 PID 1832 wrote to memory of 1968 1832 xlfrxlf.exe 40 PID 1968 wrote to memory of 2828 1968 lllrxfr.exe 41 PID 1968 wrote to memory of 2828 1968 lllrxfr.exe 41 PID 1968 wrote to memory of 2828 1968 lllrxfr.exe 41 PID 1968 wrote to memory of 2828 1968 lllrxfr.exe 41 PID 2828 wrote to memory of 3024 2828 fxrfxfl.exe 42 PID 2828 wrote to memory of 3024 2828 fxrfxfl.exe 42 PID 2828 wrote to memory of 3024 2828 fxrfxfl.exe 42 PID 2828 wrote to memory of 3024 2828 fxrfxfl.exe 42 PID 3024 wrote to memory of 2744 3024 ffxlxxf.exe 43 PID 3024 wrote to memory of 2744 3024 ffxlxxf.exe 43 PID 3024 wrote to memory of 2744 3024 ffxlxxf.exe 43 PID 3024 wrote to memory of 2744 3024 ffxlxxf.exe 43 PID 2744 wrote to memory of 2796 2744 tnbbnt.exe 44 PID 2744 wrote to memory of 2796 2744 tnbbnt.exe 44 PID 2744 wrote to memory of 2796 2744 tnbbnt.exe 44 PID 2744 wrote to memory of 2796 2744 tnbbnt.exe 44 PID 2796 wrote to memory of 1816 2796 7fxffff.exe 45 PID 2796 wrote to memory of 1816 2796 7fxffff.exe 45 PID 2796 wrote to memory of 1816 2796 7fxffff.exe 45 PID 2796 wrote to memory of 1816 2796 7fxffff.exe 45 PID 1816 wrote to memory of 2344 1816 3ppjd.exe 46 PID 1816 wrote to memory of 2344 1816 3ppjd.exe 46 PID 1816 wrote to memory of 2344 1816 3ppjd.exe 46 PID 1816 wrote to memory of 2344 1816 3ppjd.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8d10410fa44038a3b506ffd0640a3657df7c216225f9fd5b88cf9e59938a2ab.exe"C:\Users\Admin\AppData\Local\Temp\a8d10410fa44038a3b506ffd0640a3657df7c216225f9fd5b88cf9e59938a2ab.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\vpdpd.exec:\vpdpd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\3rrfffr.exec:\3rrfffr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\ppjdv.exec:\ppjdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\tnbhnb.exec:\tnbhnb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\5lfxffl.exec:\5lfxffl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\dvvdv.exec:\dvvdv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\jjvvd.exec:\jjvvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\3jdjj.exec:\3jdjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\xlfrxlf.exec:\xlfrxlf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\lllrxfr.exec:\lllrxfr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\fxrfxfl.exec:\fxrfxfl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\ffxlxxf.exec:\ffxlxxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\tnbbnt.exec:\tnbbnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\7fxffff.exec:\7fxffff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\3ppjd.exec:\3ppjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
\??\c:\xrrlxxf.exec:\xrrlxxf.exe17⤵
- Executes dropped EXE
PID:2344 -
\??\c:\nhbhhn.exec:\nhbhhn.exe18⤵
- Executes dropped EXE
PID:1976 -
\??\c:\7xrrflx.exec:\7xrrflx.exe19⤵
- Executes dropped EXE
PID:2100 -
\??\c:\5btbhn.exec:\5btbhn.exe20⤵
- Executes dropped EXE
PID:408 -
\??\c:\xrlrxfr.exec:\xrlrxfr.exe21⤵
- Executes dropped EXE
PID:2472 -
\??\c:\5tbhnt.exec:\5tbhnt.exe22⤵
- Executes dropped EXE
PID:1340 -
\??\c:\7flrxfl.exec:\7flrxfl.exe23⤵
- Executes dropped EXE
PID:1476 -
\??\c:\fxrxlfx.exec:\fxrxlfx.exe24⤵
- Executes dropped EXE
PID:376 -
\??\c:\xffrllx.exec:\xffrllx.exe25⤵
- Executes dropped EXE
PID:1876 -
\??\c:\9httbh.exec:\9httbh.exe26⤵
- Executes dropped EXE
PID:1712 -
\??\c:\fxlxlrf.exec:\fxlxlrf.exe27⤵
- Executes dropped EXE
PID:1548 -
\??\c:\tbnbbt.exec:\tbnbbt.exe28⤵
- Executes dropped EXE
PID:2668 -
\??\c:\rlfrllf.exec:\rlfrllf.exe29⤵
- Executes dropped EXE
PID:1208 -
\??\c:\bnbnhb.exec:\bnbnhb.exe30⤵
- Executes dropped EXE
PID:1880 -
\??\c:\1fxflrf.exec:\1fxflrf.exe31⤵
- Executes dropped EXE
PID:1220 -
\??\c:\rllflrx.exec:\rllflrx.exe32⤵
- Executes dropped EXE
PID:576 -
\??\c:\dpjjd.exec:\dpjjd.exe33⤵
- Executes dropped EXE
PID:2864 -
\??\c:\rlflfrx.exec:\rlflfrx.exe34⤵
- Executes dropped EXE
PID:2764 -
\??\c:\jdpvd.exec:\jdpvd.exe35⤵
- Executes dropped EXE
PID:2692 -
\??\c:\vppvj.exec:\vppvj.exe36⤵
- Executes dropped EXE
PID:2900 -
\??\c:\rrlxlrx.exec:\rrlxlrx.exe37⤵
- Executes dropped EXE
PID:2872 -
\??\c:\nhhtnt.exec:\nhhtnt.exe38⤵
- Executes dropped EXE
PID:2608 -
\??\c:\djdjd.exec:\djdjd.exe39⤵
- Executes dropped EXE
PID:2592 -
\??\c:\dvpvp.exec:\dvpvp.exe40⤵
- Executes dropped EXE
PID:2004 -
\??\c:\bttbnh.exec:\bttbnh.exe41⤵
- Executes dropped EXE
PID:2272 -
\??\c:\bnbhtt.exec:\bnbhtt.exe42⤵
- Executes dropped EXE
PID:1576 -
\??\c:\9djvd.exec:\9djvd.exe43⤵
- Executes dropped EXE
PID:1872 -
\??\c:\xxrlrxl.exec:\xxrlrxl.exe44⤵
- Executes dropped EXE
PID:2324 -
\??\c:\nhbntt.exec:\nhbntt.exe45⤵
- Executes dropped EXE
PID:2664 -
\??\c:\vpjjj.exec:\vpjjj.exe46⤵
- Executes dropped EXE
PID:1632 -
\??\c:\pjvjv.exec:\pjvjv.exe47⤵
- Executes dropped EXE
PID:2952 -
\??\c:\fxrxllr.exec:\fxrxllr.exe48⤵
- Executes dropped EXE
PID:2956 -
\??\c:\tnbhnn.exec:\tnbhnn.exe49⤵
- Executes dropped EXE
PID:2904 -
\??\c:\3ttbnt.exec:\3ttbnt.exe50⤵
- Executes dropped EXE
PID:2848 -
\??\c:\pjdjv.exec:\pjdjv.exe51⤵
- Executes dropped EXE
PID:2936 -
\??\c:\lfrrxxx.exec:\lfrrxxx.exe52⤵
- Executes dropped EXE
PID:3060 -
\??\c:\xrllrxl.exec:\xrllrxl.exe53⤵
- Executes dropped EXE
PID:1444 -
\??\c:\5btbtb.exec:\5btbtb.exe54⤵
- Executes dropped EXE
PID:2360 -
\??\c:\7dpdj.exec:\7dpdj.exe55⤵
- Executes dropped EXE
PID:1972 -
\??\c:\ddvjp.exec:\ddvjp.exe56⤵
- Executes dropped EXE
PID:2164 -
\??\c:\fxxxffr.exec:\fxxxffr.exe57⤵
- Executes dropped EXE
PID:2124 -
\??\c:\thbhhn.exec:\thbhhn.exe58⤵
- Executes dropped EXE
PID:2376 -
\??\c:\5pjvp.exec:\5pjvp.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2380 -
\??\c:\vpjvv.exec:\vpjvv.exe60⤵
- Executes dropped EXE
PID:952 -
\??\c:\ffxfrxl.exec:\ffxfrxl.exe61⤵
- Executes dropped EXE
PID:2524 -
\??\c:\3nhnbb.exec:\3nhnbb.exe62⤵
- Executes dropped EXE
PID:1340 -
\??\c:\vvdpj.exec:\vvdpj.exe63⤵
- Executes dropped EXE
PID:1388 -
\??\c:\ppjjj.exec:\ppjjj.exe64⤵
- Executes dropped EXE
PID:2372 -
\??\c:\rrlrflx.exec:\rrlrflx.exe65⤵
- Executes dropped EXE
PID:352 -
\??\c:\ttntnn.exec:\ttntnn.exe66⤵PID:1948
-
\??\c:\djpdv.exec:\djpdv.exe67⤵PID:1712
-
\??\c:\jjvvp.exec:\jjvvp.exe68⤵PID:2080
-
\??\c:\htbhnh.exec:\htbhnh.exe69⤵PID:2032
-
\??\c:\htnnhh.exec:\htnnhh.exe70⤵PID:2504
-
\??\c:\dddpd.exec:\dddpd.exe71⤵PID:1812
-
\??\c:\rxxrxxl.exec:\rxxrxxl.exe72⤵PID:1880
-
\??\c:\bthtnt.exec:\bthtnt.exe73⤵PID:316
-
\??\c:\7tntbn.exec:\7tntbn.exe74⤵PID:2716
-
\??\c:\jpjvp.exec:\jpjvp.exe75⤵PID:1604
-
\??\c:\lllflrf.exec:\lllflrf.exe76⤵PID:2868
-
\??\c:\nhbhtn.exec:\nhbhtn.exe77⤵PID:2876
-
\??\c:\hbhnbh.exec:\hbhnbh.exe78⤵PID:2604
-
\??\c:\vddvp.exec:\vddvp.exe79⤵PID:3008
-
\??\c:\rrxxrxl.exec:\rrxxrxl.exe80⤵PID:2572
-
\??\c:\llxflxl.exec:\llxflxl.exe81⤵PID:2584
-
\??\c:\bbbbtn.exec:\bbbbtn.exe82⤵PID:2592
-
\??\c:\9dvdp.exec:\9dvdp.exe83⤵PID:2208
-
\??\c:\vpppd.exec:\vpppd.exe84⤵PID:1064
-
\??\c:\fxrrxfr.exec:\fxrrxfr.exe85⤵PID:1576
-
\??\c:\tnbhnt.exec:\tnbhnt.exe86⤵PID:1872
-
\??\c:\pjdvj.exec:\pjdvj.exe87⤵PID:2508
-
\??\c:\3dvjv.exec:\3dvjv.exe88⤵PID:2664
-
\??\c:\xxlflxl.exec:\xxlflxl.exe89⤵PID:1676
-
\??\c:\nhbhnt.exec:\nhbhnt.exe90⤵PID:468
-
\??\c:\nnbnbn.exec:\nnbnbn.exe91⤵PID:2956
-
\??\c:\ppjpj.exec:\ppjpj.exe92⤵PID:2964
-
\??\c:\xrflxxl.exec:\xrflxxl.exe93⤵PID:2672
-
\??\c:\fxllllr.exec:\fxllllr.exe94⤵PID:324
-
\??\c:\bbnbnb.exec:\bbnbnb.exe95⤵PID:2132
-
\??\c:\pjdjd.exec:\pjdjd.exe96⤵PID:1768
-
\??\c:\rxrfxlf.exec:\rxrfxlf.exe97⤵PID:2388
-
\??\c:\hnnnth.exec:\hnnnth.exe98⤵PID:1508
-
\??\c:\nhhnbb.exec:\nhhnbb.exe99⤵PID:1976
-
\??\c:\jjdjp.exec:\jjdjp.exe100⤵PID:2184
-
\??\c:\ppjvv.exec:\ppjvv.exe101⤵PID:2420
-
\??\c:\5rflrxr.exec:\5rflrxr.exe102⤵PID:2268
-
\??\c:\9nnbht.exec:\9nnbht.exe103⤵PID:2984
-
\??\c:\3hhhtt.exec:\3hhhtt.exe104⤵PID:1672
-
\??\c:\ddddv.exec:\ddddv.exe105⤵PID:948
-
\??\c:\lrfllfr.exec:\lrfllfr.exe106⤵PID:2160
-
\??\c:\7nhtbh.exec:\7nhtbh.exe107⤵PID:1756
-
\??\c:\1nnntt.exec:\1nnntt.exe108⤵PID:1744
-
\??\c:\9jjvj.exec:\9jjvj.exe109⤵PID:2520
-
\??\c:\5rfxrfr.exec:\5rfxrfr.exe110⤵PID:1548
-
\??\c:\nnbhbb.exec:\nnbhbb.exe111⤵PID:580
-
\??\c:\bnttbb.exec:\bnttbb.exe112⤵PID:1828
-
\??\c:\dvpvd.exec:\dvpvd.exe113⤵PID:992
-
\??\c:\fxrfllx.exec:\fxrfllx.exe114⤵PID:1752
-
\??\c:\3btbbh.exec:\3btbbh.exe115⤵PID:2676
-
\??\c:\7pjpj.exec:\7pjpj.exe116⤵PID:2084
-
\??\c:\1xlfffl.exec:\1xlfffl.exe117⤵PID:1596
-
\??\c:\7hbhbn.exec:\7hbhbn.exe118⤵PID:2708
-
\??\c:\jddjp.exec:\jddjp.exe119⤵PID:2720
-
\??\c:\pppvd.exec:\pppvd.exe120⤵PID:2576
-
\??\c:\flxlxfr.exec:\flxlxfr.exe121⤵PID:2596
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-