Analysis
- max time kernel
120s - max time network
16s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system - submitted
08/01/2025, 05:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f5d5452e1909611271ca16013b3e69c3d55a4581aaa20967a059a8135af7ff07.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
- Target f5d5452e1909611271ca16013b3e69c3d55a4581aaa20967a059a8135af7ff07.exe
- Size 455KB
- Sample250108-fxbdraxrcj
- SHA256 f5d5452e1909611271ca16013b3e69c3d55a4581aaa20967a059a8135af7ff07
- MD5 0515ccf5dea6da3585c782ae395af656
- SHA1 79796f60dc4f53b169477c13e75b03716084ca94
- SHA512 186cd1b1c8d5015719abcdd8ac9773381e799028db4cc918f64a3c6f7786cf760ac2485abd06a9049186644b036a485ffb691f1d14179ad392d8494ee52d3832
- SSDEEP 6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe3:q7Tc2NYHUrAwfMp3CD3
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Blackmoon family
- Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/2396-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2320-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2524-22-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2320-13-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1200-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2040-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2068-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1956-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/320-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1696-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2196-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1772-204-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2256-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2152-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/940-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1296-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2536-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2536-312-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2260-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/820-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1400-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2440-412-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/112-449-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2152-520-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1624-561-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1620-565-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1716-676-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1716-675-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/576-696-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2076-759-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2528-846-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/2528-867-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/2400-1131-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2504-1237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 2320 jdppp.exe 2524 3xfxrxr.exe 1200 ttnbtb.exe 2040 9xffrlr.exe 2820 bhhtht.exe 2756 7xxxxxl.exe 2640 nttbnt.exe 2736 ddpvd.exe 2604 rfllrrr.exe 2720 ddpvp.exe 2068 rxlffrf.exe 540 tbtttn.exe 2796 dvdpp.exe 1956 1bhnhh.exe 320 nhhthh.exe 2664 fxlrffl.exe 1696 nbhbbt.exe 1312 jvjjj.exe 2196 7xxlfxr.exe 2244 ttnhhn.exe 1772 5jvjd.exe 2164 5bnntb.exe 2256 jvjjp.exe 2984 fxrxxxl.exe 2152 nntthb.exe 940 dpjdp.exe 1268 nhbhbh.exe 2148 jjdjp.exe 1296 xrllxxl.exe 3032 hbnthb.exe 2064 jdppj.exe 2084 btntht.exe 1532 ntbhbt.exe 2536 pjvdd.exe 2496 7xxlrrx.exe 2260 1bnnbt.exe 2008 nhbbhh.exe 2880 vjpdp.exe 2612 5frrflf.exe 2756 3nnbth.exe 2916 ntbhhh.exe 2884 3jvvd.exe 2600 llffrrf.exe 2668 htttbh.exe 2116 hhbtbb.exe 1404 pvppd.exe 820 fxrxxxf.exe 1400 9lrxrfl.exe 2440 bthtnt.exe 2796 7jppp.exe 572 xrxfxxl.exe 1300 5fxflff.exe 1116 bnhhbb.exe 2944 9hnhnn.exe 112 jpjvd.exe 2936 rlrrffl.exe 2276 rrrrffr.exe 2304 hbhhtn.exe 2244 jjdjp.exe 2076 7xxxlrr.exe 3060 7lxflrl.exe 924 hbnhnt.exe 2996 pjvdj.exe 1304 pppvj.exe -
resource yara_rule behavioral1/memory/2396-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2040-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1200-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2040-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/320-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1312-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/940-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1296-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/820-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1400-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/112-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-513-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/940-521-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-534-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-539-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/1424-542-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-569-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/628-655-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/628-662-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1716-676-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1396-677-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/576-696-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-734-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/688-796-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1200-872-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-912-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-1026-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-1088-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-1138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-1237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-1298-0x0000000000400000-0x000000000042A000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9frrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bnhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5htttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jddp.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2396 wrote to memory of 2320 2396 f5d5452e1909611271ca16013b3e69c3d55a4581aaa20967a059a8135af7ff07.exe 30 PID 2396 wrote to memory of 2320 2396 f5d5452e1909611271ca16013b3e69c3d55a4581aaa20967a059a8135af7ff07.exe 30 PID 2396 wrote to memory of 2320 2396 f5d5452e1909611271ca16013b3e69c3d55a4581aaa20967a059a8135af7ff07.exe 30 PID 2396 wrote to memory of 2320 2396 f5d5452e1909611271ca16013b3e69c3d55a4581aaa20967a059a8135af7ff07.exe 30 PID 2320 wrote to memory of 2524 2320 jdppp.exe 31 PID 2320 wrote to memory of 2524 2320 jdppp.exe 31 PID 2320 wrote to memory of 2524 2320 jdppp.exe 31 PID 2320 wrote to memory of 2524 2320 jdppp.exe 31 PID 2524 wrote to memory of 1200 2524 3xfxrxr.exe 32 PID 2524 wrote to memory of 1200 2524 3xfxrxr.exe 32 PID 2524 wrote to memory of 1200 2524 3xfxrxr.exe 32 PID 2524 wrote to memory of 1200 2524 3xfxrxr.exe 32 PID 1200 wrote to memory of 2040 1200 ttnbtb.exe 33 PID 1200 wrote to memory of 2040 1200 ttnbtb.exe 33 PID 1200 wrote to memory of 2040 1200 ttnbtb.exe 33 PID 1200 wrote to memory of 2040 1200 ttnbtb.exe 33 PID 2040 wrote to memory of 2820 2040 9xffrlr.exe 34 PID 2040 wrote to memory of 2820 2040 9xffrlr.exe 34 PID 2040 wrote to memory of 2820 2040 9xffrlr.exe 34 PID 2040 wrote to memory of 2820 2040 9xffrlr.exe 34 PID 2820 wrote to memory of 2756 2820 bhhtht.exe 35 PID 2820 wrote to memory of 2756 2820 bhhtht.exe 35 PID 2820 wrote to memory of 2756 2820 bhhtht.exe 35 PID 2820 wrote to memory of 2756 2820 bhhtht.exe 35 PID 2756 wrote to memory of 2640 2756 7xxxxxl.exe 36 PID 2756 wrote to memory of 2640 2756 7xxxxxl.exe 36 PID 2756 wrote to memory of 2640 2756 7xxxxxl.exe 36 PID 2756 wrote to memory of 2640 2756 7xxxxxl.exe 36 PID 2640 wrote to memory of 2736 2640 nttbnt.exe 37 PID 2640 wrote to memory of 2736 2640 nttbnt.exe 37 PID 2640 wrote to memory of 2736 2640 nttbnt.exe 37 PID 2640 wrote to memory of 2736 2640 nttbnt.exe 37 PID 2736 wrote to memory of 2604 2736 ddpvd.exe 38 PID 2736 wrote to memory of 2604 2736 ddpvd.exe 38 PID 2736 wrote to memory of 2604 2736 ddpvd.exe 38 PID 2736 wrote to memory of 2604 2736 ddpvd.exe 38 PID 2604 wrote to memory of 2720 2604 rfllrrr.exe 39 PID 2604 wrote to memory of 2720 2604 rfllrrr.exe 39 PID 2604 wrote to memory of 2720 2604 rfllrrr.exe 39 PID 2604 wrote to memory of 2720 2604 rfllrrr.exe 39 PID 2720 wrote to memory of 2068 2720 ddpvp.exe 40 PID 2720 wrote to memory of 2068 2720 ddpvp.exe 40 PID 2720 wrote to memory of 2068 2720 ddpvp.exe 40 PID 2720 wrote to memory of 2068 2720 ddpvp.exe 40 PID 2068 wrote to memory of 540 2068 rxlffrf.exe 41 PID 2068 wrote to memory of 540 2068 rxlffrf.exe 41 PID 2068 wrote to memory of 540 2068 rxlffrf.exe 41 PID 2068 wrote to memory of 540 2068 rxlffrf.exe 41 PID 540 wrote to memory of 2796 540 tbtttn.exe 42 PID 540 wrote to memory of 2796 540 tbtttn.exe 42 PID 540 wrote to memory of 2796 540 tbtttn.exe 42 PID 540 wrote to memory of 2796 540 tbtttn.exe 42 PID 2796 wrote to memory of 1956 2796 dvdpp.exe 43 PID 2796 wrote to memory of 1956 2796 dvdpp.exe 43 PID 2796 wrote to memory of 1956 2796 dvdpp.exe 43 PID 2796 wrote to memory of 1956 2796 dvdpp.exe 43 PID 1956 wrote to memory of 320 1956 1bhnhh.exe 44 PID 1956 wrote to memory of 320 1956 1bhnhh.exe 44 PID 1956 wrote to memory of 320 1956 1bhnhh.exe 44 PID 1956 wrote to memory of 320 1956 1bhnhh.exe 44 PID 320 wrote to memory of 2664 320 nhhthh.exe 45 PID 320 wrote to memory of 2664 320 nhhthh.exe 45 PID 320 wrote to memory of 2664 320 nhhthh.exe 45 PID 320 wrote to memory of 2664 320 nhhthh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\f5d5452e1909611271ca16013b3e69c3d55a4581aaa20967a059a8135af7ff07.exe"C:\Users\Admin\AppData\Local\Temp\f5d5452e1909611271ca16013b3e69c3d55a4581aaa20967a059a8135af7ff07.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\jdppp.exec:\jdppp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\3xfxrxr.exec:\3xfxrxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\ttnbtb.exec:\ttnbtb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
\??\c:\9xffrlr.exec:\9xffrlr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\bhhtht.exec:\bhhtht.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\7xxxxxl.exec:\7xxxxxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\nttbnt.exec:\nttbnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\ddpvd.exec:\ddpvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\rfllrrr.exec:\rfllrrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\ddpvp.exec:\ddpvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\rxlffrf.exec:\rxlffrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\tbtttn.exec:\tbtttn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
\??\c:\dvdpp.exec:\dvdpp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\1bhnhh.exec:\1bhnhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\nhhthh.exec:\nhhthh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\fxlrffl.exec:\fxlrffl.exe17⤵
- Executes dropped EXE
PID:2664 -
\??\c:\nbhbbt.exec:\nbhbbt.exe18⤵
- Executes dropped EXE
PID:1696 -
\??\c:\jvjjj.exec:\jvjjj.exe19⤵
- Executes dropped EXE
PID:1312 -
\??\c:\7xxlfxr.exec:\7xxlfxr.exe20⤵
- Executes dropped EXE
PID:2196 -
\??\c:\ttnhhn.exec:\ttnhhn.exe21⤵
- Executes dropped EXE
PID:2244 -
\??\c:\5jvjd.exec:\5jvjd.exe22⤵
- Executes dropped EXE
PID:1772 -
\??\c:\5bnntb.exec:\5bnntb.exe23⤵
- Executes dropped EXE
PID:2164 -
\??\c:\jvjjp.exec:\jvjjp.exe24⤵
- Executes dropped EXE
PID:2256 -
\??\c:\fxrxxxl.exec:\fxrxxxl.exe25⤵
- Executes dropped EXE
PID:2984 -
\??\c:\nntthb.exec:\nntthb.exe26⤵
- Executes dropped EXE
PID:2152 -
\??\c:\dpjdp.exec:\dpjdp.exe27⤵
- Executes dropped EXE
PID:940 -
\??\c:\nhbhbh.exec:\nhbhbh.exe28⤵
- Executes dropped EXE
PID:1268 -
\??\c:\jjdjp.exec:\jjdjp.exe29⤵
- Executes dropped EXE
PID:2148 -
\??\c:\xrllxxl.exec:\xrllxxl.exe30⤵
- Executes dropped EXE
PID:1296 -
\??\c:\hbnthb.exec:\hbnthb.exe31⤵
- Executes dropped EXE
PID:3032 -
\??\c:\jdppj.exec:\jdppj.exe32⤵
- Executes dropped EXE
PID:2064 -
\??\c:\btntht.exec:\btntht.exe33⤵
- Executes dropped EXE
PID:2084 -
\??\c:\ntbhbt.exec:\ntbhbt.exe34⤵
- Executes dropped EXE
PID:1532 -
\??\c:\pjvdd.exec:\pjvdd.exe35⤵
- Executes dropped EXE
PID:2536 -
\??\c:\7xxlrrx.exec:\7xxlrrx.exe36⤵
- Executes dropped EXE
PID:2496 -
\??\c:\1bnnbt.exec:\1bnnbt.exe37⤵
- Executes dropped EXE
PID:2260 -
\??\c:\nhbbhh.exec:\nhbbhh.exe38⤵
- Executes dropped EXE
PID:2008 -
\??\c:\vjpdp.exec:\vjpdp.exe39⤵
- Executes dropped EXE
PID:2880 -
\??\c:\5frrflf.exec:\5frrflf.exe40⤵
- Executes dropped EXE
PID:2612 -
\??\c:\3nnbth.exec:\3nnbth.exe41⤵
- Executes dropped EXE
PID:2756 -
\??\c:\ntbhhh.exec:\ntbhhh.exe42⤵
- Executes dropped EXE
PID:2916 -
\??\c:\3jvvd.exec:\3jvvd.exe43⤵
- Executes dropped EXE
PID:2884 -
\??\c:\llffrrf.exec:\llffrrf.exe44⤵
- Executes dropped EXE
PID:2600 -
\??\c:\htttbh.exec:\htttbh.exe45⤵
- Executes dropped EXE
PID:2668 -
\??\c:\hhbtbb.exec:\hhbtbb.exe46⤵
- Executes dropped EXE
PID:2116 -
\??\c:\pvppd.exec:\pvppd.exe47⤵
- Executes dropped EXE
PID:1404 -
\??\c:\fxrxxxf.exec:\fxrxxxf.exe48⤵
- Executes dropped EXE
PID:820 -
\??\c:\9lrxrfl.exec:\9lrxrfl.exe49⤵
- Executes dropped EXE
PID:1400 -
\??\c:\bthtnt.exec:\bthtnt.exe50⤵
- Executes dropped EXE
PID:2440 -
\??\c:\7jppp.exec:\7jppp.exe51⤵
- Executes dropped EXE
PID:2796 -
\??\c:\xrxfxxl.exec:\xrxfxxl.exe52⤵
- Executes dropped EXE
PID:572 -
\??\c:\5fxflff.exec:\5fxflff.exe53⤵
- Executes dropped EXE
PID:1300 -
\??\c:\bnhhbb.exec:\bnhhbb.exe54⤵
- Executes dropped EXE
PID:1116 -
\??\c:\9hnhnn.exec:\9hnhnn.exe55⤵
- Executes dropped EXE
PID:2944 -
\??\c:\jpjvd.exec:\jpjvd.exe56⤵
- Executes dropped EXE
PID:112 -
\??\c:\rlrrffl.exec:\rlrrffl.exe57⤵
- Executes dropped EXE
PID:2936 -
\??\c:\rrrrffr.exec:\rrrrffr.exe58⤵
- Executes dropped EXE
PID:2276 -
\??\c:\hbhhtn.exec:\hbhhtn.exe59⤵
- Executes dropped EXE
PID:2304 -
\??\c:\jjdjp.exec:\jjdjp.exe60⤵
- Executes dropped EXE
PID:2244 -
\??\c:\7xxxlrr.exec:\7xxxlrr.exe61⤵
- Executes dropped EXE
PID:2076 -
\??\c:\7lxflrl.exec:\7lxflrl.exe62⤵
- Executes dropped EXE
PID:3060 -
\??\c:\hbnhnt.exec:\hbnhnt.exe63⤵
- Executes dropped EXE
PID:924 -
\??\c:\pjvdj.exec:\pjvdj.exe64⤵
- Executes dropped EXE
PID:2996 -
\??\c:\pppvj.exec:\pppvj.exe65⤵
- Executes dropped EXE
PID:1304 -
\??\c:\lfflllr.exec:\lfflllr.exe66⤵PID:1692
-
\??\c:\3hnttt.exec:\3hnttt.exe67⤵PID:2152
-
\??\c:\tthntb.exec:\tthntb.exe68⤵PID:940
-
\??\c:\vddpj.exec:\vddpj.exe69⤵PID:344
-
\??\c:\5rrxflr.exec:\5rrxflr.exe70⤵PID:2236
-
\??\c:\3thntb.exec:\3thntb.exe71⤵PID:1424
-
\??\c:\pjddj.exec:\pjddj.exe72⤵PID:1928
-
\??\c:\jjddp.exec:\jjddp.exe73⤵PID:1624
-
\??\c:\xlffrrf.exec:\xlffrrf.exe74⤵PID:1620
-
\??\c:\tnhnhb.exec:\tnhnhb.exe75⤵PID:2960
-
\??\c:\vpdjd.exec:\vpdjd.exe76⤵PID:1528
-
\??\c:\ddpjp.exec:\ddpjp.exe77⤵PID:2956
-
\??\c:\1lfrfrf.exec:\1lfrfrf.exe78⤵PID:2688
-
\??\c:\bthnbb.exec:\bthnbb.exe79⤵PID:1200
-
\??\c:\jdvvv.exec:\jdvvv.exe80⤵PID:2040
-
\??\c:\vjpvd.exec:\vjpvd.exe81⤵PID:2972
-
\??\c:\xrllxxl.exec:\xrllxxl.exe82⤵PID:2816
-
\??\c:\bhthbh.exec:\bhthbh.exe83⤵PID:2612
-
\??\c:\1thhtt.exec:\1thhtt.exe84⤵PID:2316
-
\??\c:\lffxlfx.exec:\lffxlfx.exe85⤵PID:2640
-
\??\c:\lxrrfxf.exec:\lxrrfxf.exe86⤵PID:2912
-
\??\c:\ththnn.exec:\ththnn.exe87⤵PID:2768
-
\??\c:\pjjjv.exec:\pjjjv.exe88⤵PID:3068
-
\??\c:\dvjpd.exec:\dvjpd.exe89⤵PID:628
-
\??\c:\frfxrxf.exec:\frfxrxf.exe90⤵PID:2648
-
\??\c:\5hthnt.exec:\5hthnt.exe91⤵PID:1716
-
\??\c:\1pvjd.exec:\1pvjd.exe92⤵PID:1396
-
\??\c:\llfffxx.exec:\llfffxx.exe93⤵PID:2440
-
\??\c:\xxrxlrl.exec:\xxrxlrl.exe94⤵PID:2796
-
\??\c:\tbthbt.exec:\tbthbt.exe95⤵PID:576
-
\??\c:\vpddp.exec:\vpddp.exe96⤵PID:1560
-
\??\c:\1pdjj.exec:\1pdjj.exe97⤵PID:1116
-
\??\c:\9xllrxf.exec:\9xllrxf.exe98⤵PID:2944
-
\??\c:\lfxxxxf.exec:\lfxxxxf.exe99⤵PID:112
-
\??\c:\nnntnn.exec:\nnntnn.exe100⤵PID:3056
-
\??\c:\1jjpj.exec:\1jjpj.exe101⤵PID:2108
-
\??\c:\1vpjd.exec:\1vpjd.exe102⤵PID:2576
-
\??\c:\1xxrxlf.exec:\1xxrxlf.exe103⤵PID:2244
-
\??\c:\5bnnbb.exec:\5bnnbb.exe104⤵PID:2076
-
\??\c:\ddpjd.exec:\ddpjd.exe105⤵PID:2472
-
\??\c:\dvpvd.exec:\dvpvd.exe106⤵PID:1464
-
\??\c:\lfxrflr.exec:\lfxrflr.exe107⤵PID:2996
-
\??\c:\hbtbtb.exec:\hbtbtb.exe108⤵PID:1304
-
\??\c:\bnhhhh.exec:\bnhhhh.exe109⤵PID:1252
-
\??\c:\vdvvj.exec:\vdvvj.exe110⤵PID:2280
-
\??\c:\7llxxrx.exec:\7llxxrx.exe111⤵PID:688
-
\??\c:\rlflxxr.exec:\rlflxxr.exe112⤵PID:1204
-
\??\c:\hhbhht.exec:\hhbhht.exe113⤵PID:2060
-
\??\c:\vjjpv.exec:\vjjpv.exe114⤵PID:1948
-
\??\c:\rfrlrxl.exec:\rfrlrxl.exe115⤵PID:2360
-
\??\c:\5xlffll.exec:\5xlffll.exe116⤵PID:896
-
\??\c:\1bnthn.exec:\1bnthn.exe117⤵PID:1520
-
\??\c:\3dddp.exec:\3dddp.exe118⤵PID:2528
-
\??\c:\jjddj.exec:\jjddj.exe119⤵PID:1532
-
\??\c:\xxxfllx.exec:\xxxfllx.exe120⤵PID:1528
-
\??\c:\bnbhtt.exec:\bnbhtt.exe121⤵PID:2412
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-