Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29/12/2024, 05:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e48af0eecb39517a47f30362055240dbb1ba0d055f08f9833de8571e4fd1e62f.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
e48af0eecb39517a47f30362055240dbb1ba0d055f08f9833de8571e4fd1e62f.exe
-
Size
456KB
-
MD5
68776a08dcfb7e37f2e6256cb5e304b8
-
SHA1
d3d2aa1a557681df99d24f9dfe3adbd0b2b0ccd5
-
SHA256
e48af0eecb39517a47f30362055240dbb1ba0d055f08f9833de8571e4fd1e62f
-
SHA512
8c685062b9f138129bbef8e60bd9da5c69537a41a872fc527c08b82052eef6303a50ec68ab51c0a19a9063efc6b42e821f674b4e04428fa2ee3e80c58420ba88
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRIB:q7Tc2NYHUrAwfMp3CDRQ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/2112-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2536-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-68-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2712-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2260-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1052-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1064-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-113-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1064-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1660-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1660-134-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1880-151-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/988-162-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/988-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2160-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1940-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2120-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1304-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1840-229-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2032-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/568-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2460-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2144-400-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1908-448-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1616-463-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2120-478-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1936-492-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-712-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2148-721-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2148-720-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2328-793-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2060-807-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2328-811-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2756 xlxfrxf.exe 2668 1nhhhh.exe 2788 vpjjv.exe 2676 bnbbhh.exe 2536 9bbtbb.exe 2712 llflrxf.exe 2260 5hnttb.exe 1052 jdvjp.exe 3004 fxflrxf.exe 2104 vjpvd.exe 2796 7rrxlrl.exe 1064 hnnttb.exe 1660 dpddp.exe 2256 7rlllrx.exe 1880 btbtbh.exe 988 1jvvd.exe 2160 llxxffr.exe 2168 pvdpd.exe 1940 jdppp.exe 924 nhthtb.exe 2120 9jdvd.exe 1304 xxrffff.exe 1840 hbhhnh.exe 1916 pjppv.exe 568 1fffllx.exe 2032 bnbhtb.exe 1132 tntbhh.exe 900 9pvpp.exe 2460 nbbtbh.exe 1520 vvjjp.exe 2756 lxlrffl.exe 2992 tnbtnn.exe 2580 vpddj.exe 2544 nhbbhh.exe 2572 bhttbb.exe 2584 3vjjp.exe 2712 1xxrrrx.exe 2604 bnttbt.exe 2632 vjvdd.exe 2996 pjvvd.exe 2900 rfrlllr.exe 2392 hhbhtt.exe 2104 dpddj.exe 600 jpdvv.exe 780 xlxxxxl.exe 2144 5rffllr.exe 2772 bthntn.exe 2004 5pvjj.exe 2804 xlxfllx.exe 1860 7hnntn.exe 2948 bhtthh.exe 2164 jvdvp.exe 2204 rffrrll.exe 1908 tbnntn.exe 1616 dvpvd.exe 2152 1rxffrr.exe 2120 7rffllr.exe 1328 tnttbb.exe 1936 vjvvd.exe 1700 dpddv.exe 1704 xlxxffr.exe 2364 bntnnh.exe 2284 9htthh.exe 2320 vdppv.exe -
resource yara_rule behavioral1/memory/2112-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1052-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1064-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1064-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/988-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1940-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1304-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1304-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/568-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-400-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2948-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-464-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-478-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-712-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-721-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1260-760-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-774-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-793-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2060-807-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2740-808-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-882-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fxxxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xffffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrlxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2112 wrote to memory of 2756 2112 e48af0eecb39517a47f30362055240dbb1ba0d055f08f9833de8571e4fd1e62f.exe 31 PID 2112 wrote to memory of 2756 2112 e48af0eecb39517a47f30362055240dbb1ba0d055f08f9833de8571e4fd1e62f.exe 31 PID 2112 wrote to memory of 2756 2112 e48af0eecb39517a47f30362055240dbb1ba0d055f08f9833de8571e4fd1e62f.exe 31 PID 2112 wrote to memory of 2756 2112 e48af0eecb39517a47f30362055240dbb1ba0d055f08f9833de8571e4fd1e62f.exe 31 PID 2756 wrote to memory of 2668 2756 xlxfrxf.exe 32 PID 2756 wrote to memory of 2668 2756 xlxfrxf.exe 32 PID 2756 wrote to memory of 2668 2756 xlxfrxf.exe 32 PID 2756 wrote to memory of 2668 2756 xlxfrxf.exe 32 PID 2668 wrote to memory of 2788 2668 1nhhhh.exe 33 PID 2668 wrote to memory of 2788 2668 1nhhhh.exe 33 PID 2668 wrote to memory of 2788 2668 1nhhhh.exe 33 PID 2668 wrote to memory of 2788 2668 1nhhhh.exe 33 PID 2788 wrote to memory of 2676 2788 vpjjv.exe 34 PID 2788 wrote to memory of 2676 2788 vpjjv.exe 34 PID 2788 wrote to memory of 2676 2788 vpjjv.exe 34 PID 2788 wrote to memory of 2676 2788 vpjjv.exe 34 PID 2676 wrote to memory of 2536 2676 bnbbhh.exe 35 PID 2676 wrote to memory of 2536 2676 bnbbhh.exe 35 PID 2676 wrote to memory of 2536 2676 bnbbhh.exe 35 PID 2676 wrote to memory of 2536 2676 bnbbhh.exe 35 PID 2536 wrote to memory of 2712 2536 9bbtbb.exe 36 PID 2536 wrote to memory of 2712 2536 9bbtbb.exe 36 PID 2536 wrote to memory of 2712 2536 9bbtbb.exe 36 PID 2536 wrote to memory of 2712 2536 9bbtbb.exe 36 PID 2712 wrote to memory of 2260 2712 llflrxf.exe 37 PID 2712 wrote to memory of 2260 2712 llflrxf.exe 37 PID 2712 wrote to memory of 2260 2712 llflrxf.exe 37 PID 2712 wrote to memory of 2260 2712 llflrxf.exe 37 PID 2260 wrote to memory of 1052 2260 5hnttb.exe 38 PID 2260 wrote to memory of 1052 2260 5hnttb.exe 38 PID 2260 wrote to memory of 1052 2260 5hnttb.exe 38 PID 2260 wrote to memory of 1052 2260 5hnttb.exe 38 PID 1052 wrote to memory of 3004 1052 jdvjp.exe 39 PID 1052 wrote to memory of 3004 1052 jdvjp.exe 39 PID 1052 wrote to memory of 3004 1052 jdvjp.exe 39 PID 1052 wrote to memory of 3004 1052 jdvjp.exe 39 PID 3004 wrote to memory of 2104 3004 fxflrxf.exe 40 PID 3004 wrote to memory of 2104 3004 fxflrxf.exe 40 PID 3004 wrote to memory of 2104 3004 fxflrxf.exe 40 PID 3004 wrote to memory of 2104 3004 fxflrxf.exe 40 PID 2104 wrote to memory of 2796 2104 vjpvd.exe 41 PID 2104 wrote to memory of 2796 2104 vjpvd.exe 41 PID 2104 wrote to memory of 2796 2104 vjpvd.exe 41 PID 2104 wrote to memory of 2796 2104 vjpvd.exe 41 PID 2796 wrote to memory of 1064 2796 7rrxlrl.exe 42 PID 2796 wrote to memory of 1064 2796 7rrxlrl.exe 42 PID 2796 wrote to memory of 1064 2796 7rrxlrl.exe 42 PID 2796 wrote to memory of 1064 2796 7rrxlrl.exe 42 PID 1064 wrote to memory of 1660 1064 hnnttb.exe 43 PID 1064 wrote to memory of 1660 1064 hnnttb.exe 43 PID 1064 wrote to memory of 1660 1064 hnnttb.exe 43 PID 1064 wrote to memory of 1660 1064 hnnttb.exe 43 PID 1660 wrote to memory of 2256 1660 dpddp.exe 44 PID 1660 wrote to memory of 2256 1660 dpddp.exe 44 PID 1660 wrote to memory of 2256 1660 dpddp.exe 44 PID 1660 wrote to memory of 2256 1660 dpddp.exe 44 PID 2256 wrote to memory of 1880 2256 7rlllrx.exe 45 PID 2256 wrote to memory of 1880 2256 7rlllrx.exe 45 PID 2256 wrote to memory of 1880 2256 7rlllrx.exe 45 PID 2256 wrote to memory of 1880 2256 7rlllrx.exe 45 PID 1880 wrote to memory of 988 1880 btbtbh.exe 46 PID 1880 wrote to memory of 988 1880 btbtbh.exe 46 PID 1880 wrote to memory of 988 1880 btbtbh.exe 46 PID 1880 wrote to memory of 988 1880 btbtbh.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\e48af0eecb39517a47f30362055240dbb1ba0d055f08f9833de8571e4fd1e62f.exe"C:\Users\Admin\AppData\Local\Temp\e48af0eecb39517a47f30362055240dbb1ba0d055f08f9833de8571e4fd1e62f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\xlxfrxf.exec:\xlxfrxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\1nhhhh.exec:\1nhhhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\vpjjv.exec:\vpjjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\bnbbhh.exec:\bnbbhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\9bbtbb.exec:\9bbtbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\llflrxf.exec:\llflrxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\5hnttb.exec:\5hnttb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\jdvjp.exec:\jdvjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
\??\c:\fxflrxf.exec:\fxflrxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\vjpvd.exec:\vjpvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\7rrxlrl.exec:\7rrxlrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\hnnttb.exec:\hnnttb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
\??\c:\dpddp.exec:\dpddp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\7rlllrx.exec:\7rlllrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\btbtbh.exec:\btbtbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\1jvvd.exec:\1jvvd.exe17⤵
- Executes dropped EXE
PID:988 -
\??\c:\llxxffr.exec:\llxxffr.exe18⤵
- Executes dropped EXE
PID:2160 -
\??\c:\pvdpd.exec:\pvdpd.exe19⤵
- Executes dropped EXE
PID:2168 -
\??\c:\jdppp.exec:\jdppp.exe20⤵
- Executes dropped EXE
PID:1940 -
\??\c:\nhthtb.exec:\nhthtb.exe21⤵
- Executes dropped EXE
PID:924 -
\??\c:\9jdvd.exec:\9jdvd.exe22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2120 -
\??\c:\xxrffff.exec:\xxrffff.exe23⤵
- Executes dropped EXE
PID:1304 -
\??\c:\hbhhnh.exec:\hbhhnh.exe24⤵
- Executes dropped EXE
PID:1840 -
\??\c:\pjppv.exec:\pjppv.exe25⤵
- Executes dropped EXE
PID:1916 -
\??\c:\1fffllx.exec:\1fffllx.exe26⤵
- Executes dropped EXE
PID:568 -
\??\c:\bnbhtb.exec:\bnbhtb.exe27⤵
- Executes dropped EXE
PID:2032 -
\??\c:\tntbhh.exec:\tntbhh.exe28⤵
- Executes dropped EXE
PID:1132 -
\??\c:\9pvpp.exec:\9pvpp.exe29⤵
- Executes dropped EXE
PID:900 -
\??\c:\nbbtbh.exec:\nbbtbh.exe30⤵
- Executes dropped EXE
PID:2460 -
\??\c:\vvjjp.exec:\vvjjp.exe31⤵
- Executes dropped EXE
PID:1520 -
\??\c:\lxlrffl.exec:\lxlrffl.exe32⤵
- Executes dropped EXE
PID:2756 -
\??\c:\tnbtnn.exec:\tnbtnn.exe33⤵
- Executes dropped EXE
PID:2992 -
\??\c:\vpddj.exec:\vpddj.exe34⤵
- Executes dropped EXE
PID:2580 -
\??\c:\nhbbhh.exec:\nhbbhh.exe35⤵
- Executes dropped EXE
PID:2544 -
\??\c:\bhttbb.exec:\bhttbb.exe36⤵
- Executes dropped EXE
PID:2572 -
\??\c:\3vjjp.exec:\3vjjp.exe37⤵
- Executes dropped EXE
PID:2584 -
\??\c:\1xxrrrx.exec:\1xxrrrx.exe38⤵
- Executes dropped EXE
PID:2712 -
\??\c:\bnttbt.exec:\bnttbt.exe39⤵
- Executes dropped EXE
PID:2604 -
\??\c:\vjvdd.exec:\vjvdd.exe40⤵
- Executes dropped EXE
PID:2632 -
\??\c:\pjvvd.exec:\pjvvd.exe41⤵
- Executes dropped EXE
PID:2996 -
\??\c:\rfrlllr.exec:\rfrlllr.exe42⤵
- Executes dropped EXE
PID:2900 -
\??\c:\hhbhtt.exec:\hhbhtt.exe43⤵
- Executes dropped EXE
PID:2392 -
\??\c:\dpddj.exec:\dpddj.exe44⤵
- Executes dropped EXE
PID:2104 -
\??\c:\jpdvv.exec:\jpdvv.exe45⤵
- Executes dropped EXE
PID:600 -
\??\c:\xlxxxxl.exec:\xlxxxxl.exe46⤵
- Executes dropped EXE
PID:780 -
\??\c:\5rffllr.exec:\5rffllr.exe47⤵
- Executes dropped EXE
PID:2144 -
\??\c:\bthntn.exec:\bthntn.exe48⤵
- Executes dropped EXE
PID:2772 -
\??\c:\5pvjj.exec:\5pvjj.exe49⤵
- Executes dropped EXE
PID:2004 -
\??\c:\xlxfllx.exec:\xlxfllx.exe50⤵
- Executes dropped EXE
PID:2804 -
\??\c:\7hnntn.exec:\7hnntn.exe51⤵
- Executes dropped EXE
PID:1860 -
\??\c:\bhtthh.exec:\bhtthh.exe52⤵
- Executes dropped EXE
PID:2948 -
\??\c:\jvdvp.exec:\jvdvp.exe53⤵
- Executes dropped EXE
PID:2164 -
\??\c:\rffrrll.exec:\rffrrll.exe54⤵
- Executes dropped EXE
PID:2204 -
\??\c:\tbnntn.exec:\tbnntn.exe55⤵
- Executes dropped EXE
PID:1908 -
\??\c:\dvpvd.exec:\dvpvd.exe56⤵
- Executes dropped EXE
PID:1616 -
\??\c:\1rxffrr.exec:\1rxffrr.exe57⤵
- Executes dropped EXE
PID:2152 -
\??\c:\7rffllr.exec:\7rffllr.exe58⤵
- Executes dropped EXE
PID:2120 -
\??\c:\tnttbb.exec:\tnttbb.exe59⤵
- Executes dropped EXE
PID:1328 -
\??\c:\vjvvd.exec:\vjvvd.exe60⤵
- Executes dropped EXE
PID:1936 -
\??\c:\dpddv.exec:\dpddv.exe61⤵
- Executes dropped EXE
PID:1700 -
\??\c:\xlxxffr.exec:\xlxxffr.exe62⤵
- Executes dropped EXE
PID:1704 -
\??\c:\bntnnh.exec:\bntnnh.exe63⤵
- Executes dropped EXE
PID:2364 -
\??\c:\9htthh.exec:\9htthh.exe64⤵
- Executes dropped EXE
PID:2284 -
\??\c:\vdppv.exec:\vdppv.exe65⤵
- Executes dropped EXE
PID:2320 -
\??\c:\frfflfr.exec:\frfflfr.exe66⤵PID:1132
-
\??\c:\7frrxrx.exec:\7frrxrx.exe67⤵PID:1480
-
\??\c:\nbnnbh.exec:\nbnnbh.exe68⤵PID:2828
-
\??\c:\pvjvv.exec:\pvjvv.exe69⤵PID:2812
-
\??\c:\dpvvj.exec:\dpvvj.exe70⤵PID:2652
-
\??\c:\fxrxlrf.exec:\fxrxlrf.exe71⤵PID:2920
-
\??\c:\7nnntb.exec:\7nnntb.exe72⤵PID:2344
-
\??\c:\dddvd.exec:\dddvd.exe73⤵PID:2820
-
\??\c:\dvdvj.exec:\dvdvj.exe74⤵PID:2552
-
\??\c:\5xlxffl.exec:\5xlxffl.exe75⤵PID:2548
-
\??\c:\nnhbbb.exec:\nnhbbb.exe76⤵PID:2892
-
\??\c:\9jddp.exec:\9jddp.exe77⤵PID:2584
-
\??\c:\dvdvp.exec:\dvdvp.exe78⤵PID:2712
-
\??\c:\flxlxxf.exec:\flxlxxf.exe79⤵PID:2604
-
\??\c:\nhnttt.exec:\nhnttt.exe80⤵PID:2196
-
\??\c:\thnnnh.exec:\thnnnh.exe81⤵PID:2988
-
\??\c:\3vddd.exec:\3vddd.exe82⤵PID:2472
-
\??\c:\frlllff.exec:\frlllff.exe83⤵PID:1432
-
\??\c:\xlrrrll.exec:\xlrrrll.exe84⤵PID:760
-
\??\c:\bntbbt.exec:\bntbbt.exe85⤵PID:1852
-
\??\c:\dvvdp.exec:\dvvdp.exe86⤵PID:1732
-
\??\c:\pdddj.exec:\pdddj.exe87⤵PID:1660
-
\??\c:\rffffxf.exec:\rffffxf.exe88⤵PID:2764
-
\??\c:\nnbhhh.exec:\nnbhhh.exe89⤵PID:1252
-
\??\c:\jvddp.exec:\jvddp.exe90⤵PID:1564
-
\??\c:\pjddp.exec:\pjddp.exe91⤵PID:2156
-
\??\c:\9xfxfff.exec:\9xfxfff.exe92⤵PID:1688
-
\??\c:\thnnbh.exec:\thnnbh.exe93⤵PID:2932
-
\??\c:\nbnhhh.exec:\nbnhhh.exe94⤵PID:1736
-
\??\c:\jjvvv.exec:\jjvvv.exe95⤵PID:2212
-
\??\c:\7vjjj.exec:\7vjjj.exe96⤵PID:2148
-
\??\c:\xlrxfff.exec:\xlrxfff.exe97⤵PID:444
-
\??\c:\bnttbh.exec:\bnttbh.exe98⤵PID:2500
-
\??\c:\dvjjv.exec:\dvjjv.exe99⤵PID:2276
-
\??\c:\jdvvd.exec:\jdvvd.exe100⤵PID:1208
-
\??\c:\lflxxlr.exec:\lflxxlr.exe101⤵PID:1124
-
\??\c:\nbnbnt.exec:\nbnbnt.exe102⤵PID:1700
-
\??\c:\nthbht.exec:\nthbht.exe103⤵PID:1260
-
\??\c:\jjddp.exec:\jjddp.exe104⤵PID:1600
-
\??\c:\lxllrrx.exec:\lxllrrx.exe105⤵PID:2644
-
\??\c:\btnhnn.exec:\btnhnn.exe106⤵PID:1376
-
\??\c:\7ttnnn.exec:\7ttnnn.exe107⤵PID:2328
-
\??\c:\pjddj.exec:\pjddj.exe108⤵PID:2752
-
\??\c:\dpddj.exec:\dpddj.exe109⤵PID:2060
-
\??\c:\rrllrrx.exec:\rrllrrx.exe110⤵PID:2740
-
\??\c:\9hbbhh.exec:\9hbbhh.exe111⤵PID:2068
-
\??\c:\9hnntt.exec:\9hnntt.exe112⤵PID:2696
-
\??\c:\dpjvv.exec:\dpjvv.exe113⤵PID:2692
-
\??\c:\frfxfxf.exec:\frfxfxf.exe114⤵PID:3040
-
\??\c:\hbhnnn.exec:\hbhnnn.exe115⤵PID:2648
-
\??\c:\thtntt.exec:\thtntt.exe116⤵PID:3016
-
\??\c:\dvjpv.exec:\dvjpv.exe117⤵PID:2656
-
\??\c:\jdvvj.exec:\jdvvj.exe118⤵PID:2260
-
\??\c:\lfllxfr.exec:\lfllxfr.exe119⤵PID:1052
-
\??\c:\nbnnnt.exec:\nbnnnt.exe120⤵PID:2976
-
\??\c:\hhnntt.exec:\hhnntt.exe121⤵PID:2376
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-