Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29/12/2024, 03:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c5f1a42519efbb482ea4f7e5e5735a4329c448e5c6428827987cefc8d626b4ac.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
c5f1a42519efbb482ea4f7e5e5735a4329c448e5c6428827987cefc8d626b4ac.exe
-
Size
456KB
-
MD5
ef57657e36a02b78ecc11f73d7e6d425
-
SHA1
03a2dec8fb08b08e93aa039ee2219acd0dde2d5f
-
SHA256
c5f1a42519efbb482ea4f7e5e5735a4329c448e5c6428827987cefc8d626b4ac
-
SHA512
d8700a3429551d42208ff99fe98672650a53292675295208b211a9263bc6563ff8b5f5fd23d50cca2d376fc5630f1650ceb0362a1bed4722ad8cd495b8053edc
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRX:q7Tc2NYHUrAwfMp3CDRX
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 47 IoCs
resource yara_rule behavioral1/memory/2888-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2084-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2316-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1792-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3040-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2004-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1048-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1964-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1480-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/688-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/376-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1608-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2260-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/276-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1584-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-413-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1912-438-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-445-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1628-494-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-507-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2304-565-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-597-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2692-617-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2812-672-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/1620-749-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2132-775-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2440-800-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3032-807-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1872-810-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2836-845-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-875-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2584-877-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1304-909-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/840-952-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/852-965-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon behavioral1/memory/1096-1156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-1244-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1004-1335-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2888 1vpdd.exe 2316 1frxllr.exe 1792 nnntth.exe 2764 btnnhn.exe 2716 lrlfxfr.exe 2860 hhhtnt.exe 3040 rrrxrxl.exe 2616 xrlrlxl.exe 2604 xrflxfr.exe 2840 nnhbnt.exe 1804 pjdpd.exe 2004 ffxrlrx.exe 2324 3dvdp.exe 1048 bthhnh.exe 1964 dvppd.exe 236 tnhhtb.exe 1544 fxrxflr.exe 2912 flxxrfr.exe 1480 vvdjj.exe 688 rrlxrxx.exe 2416 tttbnn.exe 1356 xrffxll.exe 2932 9vvdj.exe 376 rrlfxll.exe 2940 nnhbhn.exe 1608 ffxlxlx.exe 2260 nnhnbb.exe 1012 vvvjj.exe 2056 3rffrfx.exe 276 7nhnbt.exe 3020 5xflflr.exe 1848 tttbnt.exe 1584 rxllxfl.exe 1060 hhbhth.exe 2652 jddjj.exe 2668 7vvdv.exe 316 xrlrflf.exe 2760 btttbn.exe 2568 5vdjj.exe 2720 pvvjv.exe 2884 7rxfrxr.exe 2848 3btbht.exe 2608 pjddj.exe 1096 djdvj.exe 2104 rxxrffr.exe 1264 hhhnhn.exe 320 jdvvd.exe 2448 jddpj.exe 2004 1rflffr.exe 1704 ttttnb.exe 2744 nnhnbb.exe 1392 ddvpv.exe 1516 xfffrlx.exe 1272 ttnhtb.exe 1912 vvjpj.exe 2880 5ddpd.exe 576 1frfxfr.exe 2196 hbnnbb.exe 2388 bttbhn.exe 1464 djjvj.exe 2988 9llrlxl.exe 448 hbhntt.exe 844 1hbhtb.exe 1628 jdvvj.exe -
resource yara_rule behavioral1/memory/2888-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1048-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1480-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/688-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/376-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/276-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1912-438-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-494-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-507-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-565-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/852-686-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-705-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-749-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-775-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-845-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-884-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1304-903-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1816-923-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-930-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1328-938-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2476-1082-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-1119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1096-1156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1304-1175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1048-1194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-1231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-1244-0x0000000000220000-0x000000000024A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxlrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdjd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2084 wrote to memory of 2888 2084 c5f1a42519efbb482ea4f7e5e5735a4329c448e5c6428827987cefc8d626b4ac.exe 31 PID 2084 wrote to memory of 2888 2084 c5f1a42519efbb482ea4f7e5e5735a4329c448e5c6428827987cefc8d626b4ac.exe 31 PID 2084 wrote to memory of 2888 2084 c5f1a42519efbb482ea4f7e5e5735a4329c448e5c6428827987cefc8d626b4ac.exe 31 PID 2084 wrote to memory of 2888 2084 c5f1a42519efbb482ea4f7e5e5735a4329c448e5c6428827987cefc8d626b4ac.exe 31 PID 2888 wrote to memory of 2316 2888 1vpdd.exe 32 PID 2888 wrote to memory of 2316 2888 1vpdd.exe 32 PID 2888 wrote to memory of 2316 2888 1vpdd.exe 32 PID 2888 wrote to memory of 2316 2888 1vpdd.exe 32 PID 2316 wrote to memory of 1792 2316 1frxllr.exe 33 PID 2316 wrote to memory of 1792 2316 1frxllr.exe 33 PID 2316 wrote to memory of 1792 2316 1frxllr.exe 33 PID 2316 wrote to memory of 1792 2316 1frxllr.exe 33 PID 1792 wrote to memory of 2764 1792 nnntth.exe 34 PID 1792 wrote to memory of 2764 1792 nnntth.exe 34 PID 1792 wrote to memory of 2764 1792 nnntth.exe 34 PID 1792 wrote to memory of 2764 1792 nnntth.exe 34 PID 2764 wrote to memory of 2716 2764 btnnhn.exe 35 PID 2764 wrote to memory of 2716 2764 btnnhn.exe 35 PID 2764 wrote to memory of 2716 2764 btnnhn.exe 35 PID 2764 wrote to memory of 2716 2764 btnnhn.exe 35 PID 2716 wrote to memory of 2860 2716 lrlfxfr.exe 36 PID 2716 wrote to memory of 2860 2716 lrlfxfr.exe 36 PID 2716 wrote to memory of 2860 2716 lrlfxfr.exe 36 PID 2716 wrote to memory of 2860 2716 lrlfxfr.exe 36 PID 2860 wrote to memory of 3040 2860 hhhtnt.exe 37 PID 2860 wrote to memory of 3040 2860 hhhtnt.exe 37 PID 2860 wrote to memory of 3040 2860 hhhtnt.exe 37 PID 2860 wrote to memory of 3040 2860 hhhtnt.exe 37 PID 3040 wrote to memory of 2616 3040 rrrxrxl.exe 38 PID 3040 wrote to memory of 2616 3040 rrrxrxl.exe 38 PID 3040 wrote to memory of 2616 3040 rrrxrxl.exe 38 PID 3040 wrote to memory of 2616 3040 rrrxrxl.exe 38 PID 2616 wrote to memory of 2604 2616 xrlrlxl.exe 39 PID 2616 wrote to memory of 2604 2616 xrlrlxl.exe 39 PID 2616 wrote to memory of 2604 2616 xrlrlxl.exe 39 PID 2616 wrote to memory of 2604 2616 xrlrlxl.exe 39 PID 2604 wrote to memory of 2840 2604 xrflxfr.exe 40 PID 2604 wrote to memory of 2840 2604 xrflxfr.exe 40 PID 2604 wrote to memory of 2840 2604 xrflxfr.exe 40 PID 2604 wrote to memory of 2840 2604 xrflxfr.exe 40 PID 2840 wrote to memory of 1804 2840 nnhbnt.exe 41 PID 2840 wrote to memory of 1804 2840 nnhbnt.exe 41 PID 2840 wrote to memory of 1804 2840 nnhbnt.exe 41 PID 2840 wrote to memory of 1804 2840 nnhbnt.exe 41 PID 1804 wrote to memory of 2004 1804 pjdpd.exe 42 PID 1804 wrote to memory of 2004 1804 pjdpd.exe 42 PID 1804 wrote to memory of 2004 1804 pjdpd.exe 42 PID 1804 wrote to memory of 2004 1804 pjdpd.exe 42 PID 2004 wrote to memory of 2324 2004 ffxrlrx.exe 43 PID 2004 wrote to memory of 2324 2004 ffxrlrx.exe 43 PID 2004 wrote to memory of 2324 2004 ffxrlrx.exe 43 PID 2004 wrote to memory of 2324 2004 ffxrlrx.exe 43 PID 2324 wrote to memory of 1048 2324 3dvdp.exe 44 PID 2324 wrote to memory of 1048 2324 3dvdp.exe 44 PID 2324 wrote to memory of 1048 2324 3dvdp.exe 44 PID 2324 wrote to memory of 1048 2324 3dvdp.exe 44 PID 1048 wrote to memory of 1964 1048 bthhnh.exe 45 PID 1048 wrote to memory of 1964 1048 bthhnh.exe 45 PID 1048 wrote to memory of 1964 1048 bthhnh.exe 45 PID 1048 wrote to memory of 1964 1048 bthhnh.exe 45 PID 1964 wrote to memory of 236 1964 dvppd.exe 46 PID 1964 wrote to memory of 236 1964 dvppd.exe 46 PID 1964 wrote to memory of 236 1964 dvppd.exe 46 PID 1964 wrote to memory of 236 1964 dvppd.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\c5f1a42519efbb482ea4f7e5e5735a4329c448e5c6428827987cefc8d626b4ac.exe"C:\Users\Admin\AppData\Local\Temp\c5f1a42519efbb482ea4f7e5e5735a4329c448e5c6428827987cefc8d626b4ac.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\1vpdd.exec:\1vpdd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\1frxllr.exec:\1frxllr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\nnntth.exec:\nnntth.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\btnnhn.exec:\btnnhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\lrlfxfr.exec:\lrlfxfr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\hhhtnt.exec:\hhhtnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\rrrxrxl.exec:\rrrxrxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\xrlrlxl.exec:\xrlrlxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\xrflxfr.exec:\xrflxfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\nnhbnt.exec:\nnhbnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\pjdpd.exec:\pjdpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\ffxrlrx.exec:\ffxrlrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\3dvdp.exec:\3dvdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\bthhnh.exec:\bthhnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\dvppd.exec:\dvppd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\tnhhtb.exec:\tnhhtb.exe17⤵
- Executes dropped EXE
PID:236 -
\??\c:\fxrxflr.exec:\fxrxflr.exe18⤵
- Executes dropped EXE
PID:1544 -
\??\c:\flxxrfr.exec:\flxxrfr.exe19⤵
- Executes dropped EXE
PID:2912 -
\??\c:\vvdjj.exec:\vvdjj.exe20⤵
- Executes dropped EXE
PID:1480 -
\??\c:\rrlxrxx.exec:\rrlxrxx.exe21⤵
- Executes dropped EXE
PID:688 -
\??\c:\tttbnn.exec:\tttbnn.exe22⤵
- Executes dropped EXE
PID:2416 -
\??\c:\xrffxll.exec:\xrffxll.exe23⤵
- Executes dropped EXE
PID:1356 -
\??\c:\9vvdj.exec:\9vvdj.exe24⤵
- Executes dropped EXE
PID:2932 -
\??\c:\rrlfxll.exec:\rrlfxll.exe25⤵
- Executes dropped EXE
PID:376 -
\??\c:\nnhbhn.exec:\nnhbhn.exe26⤵
- Executes dropped EXE
PID:2940 -
\??\c:\ffxlxlx.exec:\ffxlxlx.exe27⤵
- Executes dropped EXE
PID:1608 -
\??\c:\nnhnbb.exec:\nnhnbb.exe28⤵
- Executes dropped EXE
PID:2260 -
\??\c:\vvvjj.exec:\vvvjj.exe29⤵
- Executes dropped EXE
PID:1012 -
\??\c:\3rffrfx.exec:\3rffrfx.exe30⤵
- Executes dropped EXE
PID:2056 -
\??\c:\7nhnbt.exec:\7nhnbt.exe31⤵
- Executes dropped EXE
PID:276 -
\??\c:\5xflflr.exec:\5xflflr.exe32⤵
- Executes dropped EXE
PID:3020 -
\??\c:\tttbnt.exec:\tttbnt.exe33⤵
- Executes dropped EXE
PID:1848 -
\??\c:\rxllxfl.exec:\rxllxfl.exe34⤵
- Executes dropped EXE
PID:1584 -
\??\c:\hhbhth.exec:\hhbhth.exe35⤵
- Executes dropped EXE
PID:1060 -
\??\c:\jddjj.exec:\jddjj.exe36⤵
- Executes dropped EXE
PID:2652 -
\??\c:\7vvdv.exec:\7vvdv.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2668 -
\??\c:\xrlrflf.exec:\xrlrflf.exe38⤵
- Executes dropped EXE
PID:316 -
\??\c:\btttbn.exec:\btttbn.exe39⤵
- Executes dropped EXE
PID:2760 -
\??\c:\5vdjj.exec:\5vdjj.exe40⤵
- Executes dropped EXE
PID:2568 -
\??\c:\pvvjv.exec:\pvvjv.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2720 -
\??\c:\7rxfrxr.exec:\7rxfrxr.exe42⤵
- Executes dropped EXE
PID:2884 -
\??\c:\3btbht.exec:\3btbht.exe43⤵
- Executes dropped EXE
PID:2848 -
\??\c:\pjddj.exec:\pjddj.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2608 -
\??\c:\djdvj.exec:\djdvj.exe45⤵
- Executes dropped EXE
PID:1096 -
\??\c:\rxxrffr.exec:\rxxrffr.exe46⤵
- Executes dropped EXE
PID:2104 -
\??\c:\hhhnhn.exec:\hhhnhn.exe47⤵
- Executes dropped EXE
PID:1264 -
\??\c:\jdvvd.exec:\jdvvd.exe48⤵
- Executes dropped EXE
PID:320 -
\??\c:\jddpj.exec:\jddpj.exe49⤵
- Executes dropped EXE
PID:2448 -
\??\c:\1rflffr.exec:\1rflffr.exe50⤵
- Executes dropped EXE
PID:2004 -
\??\c:\ttttnb.exec:\ttttnb.exe51⤵
- Executes dropped EXE
PID:1704 -
\??\c:\nnhnbb.exec:\nnhnbb.exe52⤵
- Executes dropped EXE
PID:2744 -
\??\c:\ddvpv.exec:\ddvpv.exe53⤵
- Executes dropped EXE
PID:1392 -
\??\c:\xfffrlx.exec:\xfffrlx.exe54⤵
- Executes dropped EXE
PID:1516 -
\??\c:\ttnhtb.exec:\ttnhtb.exe55⤵
- Executes dropped EXE
PID:1272 -
\??\c:\vvjpj.exec:\vvjpj.exe56⤵
- Executes dropped EXE
PID:1912 -
\??\c:\5ddpd.exec:\5ddpd.exe57⤵
- Executes dropped EXE
PID:2880 -
\??\c:\1frfxfr.exec:\1frfxfr.exe58⤵
- Executes dropped EXE
PID:576 -
\??\c:\hbnnbb.exec:\hbnnbb.exe59⤵
- Executes dropped EXE
PID:2196 -
\??\c:\bttbhn.exec:\bttbhn.exe60⤵
- Executes dropped EXE
PID:2388 -
\??\c:\djjvj.exec:\djjvj.exe61⤵
- Executes dropped EXE
PID:1464 -
\??\c:\9llrlxl.exec:\9llrlxl.exe62⤵
- Executes dropped EXE
PID:2988 -
\??\c:\hbhntt.exec:\hbhntt.exe63⤵
- Executes dropped EXE
PID:448 -
\??\c:\1hbhtb.exec:\1hbhtb.exe64⤵
- Executes dropped EXE
PID:844 -
\??\c:\jdvvj.exec:\jdvvj.exe65⤵
- Executes dropped EXE
PID:1628 -
\??\c:\rrxrffx.exec:\rrxrffx.exe66⤵PID:2180
-
\??\c:\1nhnth.exec:\1nhnth.exe67⤵PID:2940
-
\??\c:\nhhhnt.exec:\nhhhnt.exe68⤵PID:1604
-
\??\c:\ppjvv.exec:\ppjvv.exe69⤵PID:2280
-
\??\c:\1lfxllx.exec:\1lfxllx.exe70⤵PID:2080
-
\??\c:\1tbnbn.exec:\1tbnbn.exe71⤵PID:1864
-
\??\c:\nttbtt.exec:\nttbtt.exe72⤵PID:3032
-
\??\c:\jppdv.exec:\jppdv.exe73⤵PID:1872
-
\??\c:\fxrxllx.exec:\fxrxllx.exe74⤵PID:3008
-
\??\c:\ffrxrrx.exec:\ffrxrrx.exe75⤵PID:2012
-
\??\c:\hnhtht.exec:\hnhtht.exe76⤵PID:1688
-
\??\c:\dvvvj.exec:\dvvvj.exe77⤵PID:2304
-
\??\c:\jdpvd.exec:\jdpvd.exe78⤵PID:2312
-
\??\c:\fllxlrl.exec:\fllxlrl.exe79⤵PID:1808
-
\??\c:\bbtbtb.exec:\bbtbtb.exe80⤵PID:2832
-
\??\c:\3vvjd.exec:\3vvjd.exe81⤵PID:2868
-
\??\c:\9pvvj.exec:\9pvvj.exe82⤵PID:2692
-
\??\c:\7fflxlf.exec:\7fflxlf.exe83⤵PID:2716
-
\??\c:\ntnbtb.exec:\ntnbtb.exe84⤵PID:2724
-
\??\c:\ppjdv.exec:\ppjdv.exe85⤵PID:2844
-
\??\c:\lfxfrxr.exec:\lfxfrxr.exe86⤵PID:356
-
\??\c:\3rllfrf.exec:\3rllfrf.exe87⤵PID:2608
-
\??\c:\tnnthh.exec:\tnnthh.exe88⤵PID:2052
-
\??\c:\3dvdd.exec:\3dvdd.exe89⤵PID:2288
-
\??\c:\ddvdp.exec:\ddvdp.exe90⤵PID:1560
-
\??\c:\lfrxlrf.exec:\lfrxlrf.exe91⤵PID:2096
-
\??\c:\nnbhbb.exec:\nnbhbb.exe92⤵PID:1256
-
\??\c:\dpddv.exec:\dpddv.exe93⤵PID:2360
-
\??\c:\llfrxlr.exec:\llfrxlr.exe94⤵PID:2812
-
\??\c:\ffxxrxx.exec:\ffxxrxx.exe95⤵PID:840
-
\??\c:\ntbbtb.exec:\ntbbtb.exe96⤵PID:640
-
\??\c:\vppjj.exec:\vppjj.exe97⤵PID:852
-
\??\c:\7lflxfl.exec:\7lflxfl.exe98⤵PID:2916
-
\??\c:\hnhthn.exec:\hnhthn.exe99⤵PID:1544
-
\??\c:\1hthbh.exec:\1hthbh.exe100⤵PID:2436
-
\??\c:\dvdvv.exec:\dvdvv.exe101⤵PID:2256
-
\??\c:\xfxrfxx.exec:\xfxrfxx.exe102⤵PID:1984
-
\??\c:\nhhnbb.exec:\nhhnbb.exe103⤵PID:280
-
\??\c:\7bnthn.exec:\7bnthn.exe104⤵PID:1120
-
\??\c:\jjdpp.exec:\jjdpp.exe105⤵PID:2948
-
\??\c:\lfrrffl.exec:\lfrrffl.exe106⤵PID:1620
-
\??\c:\lxxlflx.exec:\lxxlflx.exe107⤵PID:2544
-
\??\c:\bhbnhn.exec:\bhbnhn.exe108⤵PID:2420
-
\??\c:\djjpd.exec:\djjpd.exe109⤵PID:2008
-
\??\c:\5jdjj.exec:\5jdjj.exe110⤵PID:2132
-
\??\c:\llrxlrl.exec:\llrxlrl.exe111⤵PID:1980
-
\??\c:\5hnbbn.exec:\5hnbbn.exe112⤵PID:2280
-
\??\c:\7dvdd.exec:\7dvdd.exe113⤵PID:1720
-
\??\c:\xrllxxl.exec:\xrllxxl.exe114⤵PID:2440
-
\??\c:\fllrflr.exec:\fllrflr.exe115⤵PID:3032
-
\??\c:\tbbthn.exec:\tbbthn.exe116⤵PID:1872
-
\??\c:\pjdjd.exec:\pjdjd.exe117⤵PID:1644
-
\??\c:\fffrlrl.exec:\fffrlrl.exe118⤵PID:2888
-
\??\c:\3tnbtb.exec:\3tnbtb.exe119⤵PID:2320
-
\??\c:\9vvdv.exec:\9vvdv.exe120⤵PID:2272
-
\??\c:\9pvjv.exec:\9pvjv.exe121⤵PID:2664
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-