Analysis
- max time kernel
120s - max time network
118s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system - submitted
09/01/2025, 04:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fff8cd0fce9c98f96a8f9ffafd292da8186f9109d8311454b8fd91db1b6377e1.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
- Target fff8cd0fce9c98f96a8f9ffafd292da8186f9109d8311454b8fd91db1b6377e1.exe
- Size 453KB
- Sample250109-ely51axmds
- SHA256 fff8cd0fce9c98f96a8f9ffafd292da8186f9109d8311454b8fd91db1b6377e1
- MD5 ed8706f7832d104bb46ac4bc57482766
- SHA1 c40a857b00588b07b8cbc57c030ebe2431d851e2
- SHA512 c60264e8f72d82fc0c81e18a1439ac385e77efa6224b3c4cbf000c254055cf585e0b4072335e880341a71447903a39689d1a9784747b1e9b9b595099aeb38d4b
- SSDEEP 6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeG:q7Tc2NYHUrAwfMp3CDG
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Blackmoon family
- Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/2132-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3040-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3056-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1860-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/272-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1772-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1232-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1848-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2352-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2032-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1324-239-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1316-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/932-257-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/932-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1512-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1888-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1904-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/584-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2436-495-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1004-503-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-516-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-647-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2940-666-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-715-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2072-780-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2072-779-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/596-793-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1652-875-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2600-899-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 3040 5vpvj.exe 2684 tnthhh.exe 2612 pjvjd.exe 3056 7lrrfxf.exe 2636 1bhbtn.exe 2572 xlfflrr.exe 2488 5httnn.exe 2936 pdpvp.exe 1860 bbnttt.exe 272 7hnntn.exe 1572 lxlrxxr.exe 2916 hbttbt.exe 2712 jvdpp.exe 1772 xxfxxfl.exe 1232 5jjdj.exe 1960 5vpvp.exe 1848 bhtnht.exe 2776 xrflxfr.exe 1908 7nhbbb.exe 380 pdpvp.exe 2352 fxllffl.exe 2116 bhthnt.exe 596 rlxfflr.exe 2900 lxlrffl.exe 2300 vvjjd.exe 2032 xrrxxrl.exe 1324 5bnthh.exe 1316 dvpvj.exe 932 xlfrrrx.exe 1512 dvjpv.exe 2392 lxrrlrr.exe 2244 nbtbnt.exe 1888 7pjvj.exe 1904 xrflrxf.exe 3068 1hbnbh.exe 2552 ppjpd.exe 3040 fxlrxfl.exe 2732 hbhnbb.exe 2584 nhbhtn.exe 2836 pdjjp.exe 2820 llxxxrf.exe 2596 hhtthh.exe 2632 tnnhhh.exe 2532 llxxflx.exe 2580 thtnnh.exe 2996 jvjpd.exe 2028 1dpvv.exe 584 1lxlxfr.exe 668 nnhtht.exe 2908 7vjpp.exe 2980 lfrrflr.exe 2992 rlfxlrf.exe 1648 nnbhnt.exe 1872 ppjpd.exe 1864 xflflxl.exe 1676 nbhbhb.exe 1724 pvdjj.exe 2756 djdjv.exe 1456 llffllx.exe 2332 tthbtt.exe 2156 jjjpv.exe 2056 fxrxrxl.exe 2436 lllxflf.exe 1004 tbntbn.exe -
resource yara_rule behavioral1/memory/2132-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1860-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/272-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1772-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1232-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1848-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1324-239-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1316-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/932-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1512-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1888-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1904-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1904-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/584-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1456-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-495-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1004-503-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-516-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-555-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-666-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1400-688-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1400-691-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2992-715-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1724-740-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-780-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-814-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1072-827-0x0000000000400000-0x000000000042A000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrflxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xxlrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfxrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rlrrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xlfffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxflfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rxfffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rxxfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xfxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2132 wrote to memory of 3040 2132 fff8cd0fce9c98f96a8f9ffafd292da8186f9109d8311454b8fd91db1b6377e1.exe 28 PID 2132 wrote to memory of 3040 2132 fff8cd0fce9c98f96a8f9ffafd292da8186f9109d8311454b8fd91db1b6377e1.exe 28 PID 2132 wrote to memory of 3040 2132 fff8cd0fce9c98f96a8f9ffafd292da8186f9109d8311454b8fd91db1b6377e1.exe 28 PID 2132 wrote to memory of 3040 2132 fff8cd0fce9c98f96a8f9ffafd292da8186f9109d8311454b8fd91db1b6377e1.exe 28 PID 3040 wrote to memory of 2684 3040 5vpvj.exe 29 PID 3040 wrote to memory of 2684 3040 5vpvj.exe 29 PID 3040 wrote to memory of 2684 3040 5vpvj.exe 29 PID 3040 wrote to memory of 2684 3040 5vpvj.exe 29 PID 2684 wrote to memory of 2612 2684 tnthhh.exe 30 PID 2684 wrote to memory of 2612 2684 tnthhh.exe 30 PID 2684 wrote to memory of 2612 2684 tnthhh.exe 30 PID 2684 wrote to memory of 2612 2684 tnthhh.exe 30 PID 2612 wrote to memory of 3056 2612 pjvjd.exe 31 PID 2612 wrote to memory of 3056 2612 pjvjd.exe 31 PID 2612 wrote to memory of 3056 2612 pjvjd.exe 31 PID 2612 wrote to memory of 3056 2612 pjvjd.exe 31 PID 3056 wrote to memory of 2636 3056 7lrrfxf.exe 32 PID 3056 wrote to memory of 2636 3056 7lrrfxf.exe 32 PID 3056 wrote to memory of 2636 3056 7lrrfxf.exe 32 PID 3056 wrote to memory of 2636 3056 7lrrfxf.exe 32 PID 2636 wrote to memory of 2572 2636 1bhbtn.exe 33 PID 2636 wrote to memory of 2572 2636 1bhbtn.exe 33 PID 2636 wrote to memory of 2572 2636 1bhbtn.exe 33 PID 2636 wrote to memory of 2572 2636 1bhbtn.exe 33 PID 2572 wrote to memory of 2488 2572 xlfflrr.exe 34 PID 2572 wrote to memory of 2488 2572 xlfflrr.exe 34 PID 2572 wrote to memory of 2488 2572 xlfflrr.exe 34 PID 2572 wrote to memory of 2488 2572 xlfflrr.exe 34 PID 2488 wrote to memory of 2936 2488 5httnn.exe 35 PID 2488 wrote to memory of 2936 2488 5httnn.exe 35 PID 2488 wrote to memory of 2936 2488 5httnn.exe 35 PID 2488 wrote to memory of 2936 2488 5httnn.exe 35 PID 2936 wrote to memory of 1860 2936 pdpvp.exe 36 PID 2936 wrote to memory of 1860 2936 pdpvp.exe 36 PID 2936 wrote to memory of 1860 2936 pdpvp.exe 36 PID 2936 wrote to memory of 1860 2936 pdpvp.exe 36 PID 1860 wrote to memory of 272 1860 bbnttt.exe 37 PID 1860 wrote to memory of 272 1860 bbnttt.exe 37 PID 1860 wrote to memory of 272 1860 bbnttt.exe 37 PID 1860 wrote to memory of 272 1860 bbnttt.exe 37 PID 272 wrote to memory of 1572 272 7hnntn.exe 38 PID 272 wrote to memory of 1572 272 7hnntn.exe 38 PID 272 wrote to memory of 1572 272 7hnntn.exe 38 PID 272 wrote to memory of 1572 272 7hnntn.exe 38 PID 1572 wrote to memory of 2916 1572 lxlrxxr.exe 39 PID 1572 wrote to memory of 2916 1572 lxlrxxr.exe 39 PID 1572 wrote to memory of 2916 1572 lxlrxxr.exe 39 PID 1572 wrote to memory of 2916 1572 lxlrxxr.exe 39 PID 2916 wrote to memory of 2712 2916 hbttbt.exe 40 PID 2916 wrote to memory of 2712 2916 hbttbt.exe 40 PID 2916 wrote to memory of 2712 2916 hbttbt.exe 40 PID 2916 wrote to memory of 2712 2916 hbttbt.exe 40 PID 2712 wrote to memory of 1772 2712 jvdpp.exe 41 PID 2712 wrote to memory of 1772 2712 jvdpp.exe 41 PID 2712 wrote to memory of 1772 2712 jvdpp.exe 41 PID 2712 wrote to memory of 1772 2712 jvdpp.exe 41 PID 1772 wrote to memory of 1232 1772 xxfxxfl.exe 42 PID 1772 wrote to memory of 1232 1772 xxfxxfl.exe 42 PID 1772 wrote to memory of 1232 1772 xxfxxfl.exe 42 PID 1772 wrote to memory of 1232 1772 xxfxxfl.exe 42 PID 1232 wrote to memory of 1960 1232 5jjdj.exe 43 PID 1232 wrote to memory of 1960 1232 5jjdj.exe 43 PID 1232 wrote to memory of 1960 1232 5jjdj.exe 43 PID 1232 wrote to memory of 1960 1232 5jjdj.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\fff8cd0fce9c98f96a8f9ffafd292da8186f9109d8311454b8fd91db1b6377e1.exe"C:\Users\Admin\AppData\Local\Temp\fff8cd0fce9c98f96a8f9ffafd292da8186f9109d8311454b8fd91db1b6377e1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\5vpvj.exec:\5vpvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\tnthhh.exec:\tnthhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\pjvjd.exec:\pjvjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\7lrrfxf.exec:\7lrrfxf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\1bhbtn.exec:\1bhbtn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\xlfflrr.exec:\xlfflrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\5httnn.exec:\5httnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\pdpvp.exec:\pdpvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\bbnttt.exec:\bbnttt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\7hnntn.exec:\7hnntn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:272 -
\??\c:\lxlrxxr.exec:\lxlrxxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\hbttbt.exec:\hbttbt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\jvdpp.exec:\jvdpp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\xxfxxfl.exec:\xxfxxfl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
\??\c:\5jjdj.exec:\5jjdj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\5vpvp.exec:\5vpvp.exe17⤵
- Executes dropped EXE
PID:1960 -
\??\c:\bhtnht.exec:\bhtnht.exe18⤵
- Executes dropped EXE
PID:1848 -
\??\c:\xrflxfr.exec:\xrflxfr.exe19⤵
- Executes dropped EXE
PID:2776 -
\??\c:\7nhbbb.exec:\7nhbbb.exe20⤵
- Executes dropped EXE
PID:1908 -
\??\c:\pdpvp.exec:\pdpvp.exe21⤵
- Executes dropped EXE
PID:380 -
\??\c:\fxllffl.exec:\fxllffl.exe22⤵
- Executes dropped EXE
PID:2352 -
\??\c:\bhthnt.exec:\bhthnt.exe23⤵
- Executes dropped EXE
PID:2116 -
\??\c:\rlxfflr.exec:\rlxfflr.exe24⤵
- Executes dropped EXE
PID:596 -
\??\c:\lxlrffl.exec:\lxlrffl.exe25⤵
- Executes dropped EXE
PID:2900 -
\??\c:\vvjjd.exec:\vvjjd.exe26⤵
- Executes dropped EXE
PID:2300 -
\??\c:\xrrxxrl.exec:\xrrxxrl.exe27⤵
- Executes dropped EXE
PID:2032 -
\??\c:\5bnthh.exec:\5bnthh.exe28⤵
- Executes dropped EXE
PID:1324 -
\??\c:\dvpvj.exec:\dvpvj.exe29⤵
- Executes dropped EXE
PID:1316 -
\??\c:\xlfrrrx.exec:\xlfrrrx.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:932 -
\??\c:\dvjpv.exec:\dvjpv.exe31⤵
- Executes dropped EXE
PID:1512 -
\??\c:\lxrrlrr.exec:\lxrrlrr.exe32⤵
- Executes dropped EXE
PID:2392 -
\??\c:\nbtbnt.exec:\nbtbnt.exe33⤵
- Executes dropped EXE
PID:2244 -
\??\c:\7pjvj.exec:\7pjvj.exe34⤵
- Executes dropped EXE
PID:1888 -
\??\c:\xrflrxf.exec:\xrflrxf.exe35⤵
- Executes dropped EXE
PID:1904 -
\??\c:\1hbnbh.exec:\1hbnbh.exe36⤵
- Executes dropped EXE
PID:3068 -
\??\c:\ppjpd.exec:\ppjpd.exe37⤵
- Executes dropped EXE
PID:2552 -
\??\c:\fxlrxfl.exec:\fxlrxfl.exe38⤵
- Executes dropped EXE
PID:3040 -
\??\c:\hbhnbb.exec:\hbhnbb.exe39⤵
- Executes dropped EXE
PID:2732 -
\??\c:\nhbhtn.exec:\nhbhtn.exe40⤵
- Executes dropped EXE
PID:2584 -
\??\c:\pdjjp.exec:\pdjjp.exe41⤵
- Executes dropped EXE
PID:2836 -
\??\c:\llxxxrf.exec:\llxxxrf.exe42⤵
- Executes dropped EXE
PID:2820 -
\??\c:\hhtthh.exec:\hhtthh.exe43⤵
- Executes dropped EXE
PID:2596 -
\??\c:\tnnhhh.exec:\tnnhhh.exe44⤵
- Executes dropped EXE
PID:2632 -
\??\c:\llxxflx.exec:\llxxflx.exe45⤵
- Executes dropped EXE
PID:2532 -
\??\c:\thtnnh.exec:\thtnnh.exe46⤵
- Executes dropped EXE
PID:2580 -
\??\c:\jvjpd.exec:\jvjpd.exe47⤵
- Executes dropped EXE
PID:2996 -
\??\c:\1dpvv.exec:\1dpvv.exe48⤵
- Executes dropped EXE
PID:2028 -
\??\c:\1lxlxfr.exec:\1lxlxfr.exe49⤵
- Executes dropped EXE
PID:584 -
\??\c:\nnhtht.exec:\nnhtht.exe50⤵
- Executes dropped EXE
PID:668 -
\??\c:\7vjpp.exec:\7vjpp.exe51⤵
- Executes dropped EXE
PID:2908 -
\??\c:\lfrrflr.exec:\lfrrflr.exe52⤵
- Executes dropped EXE
PID:2980 -
\??\c:\rlfxlrf.exec:\rlfxlrf.exe53⤵
- Executes dropped EXE
PID:2992 -
\??\c:\nnbhnt.exec:\nnbhnt.exe54⤵
- Executes dropped EXE
PID:1648 -
\??\c:\ppjpd.exec:\ppjpd.exe55⤵
- Executes dropped EXE
PID:1872 -
\??\c:\xflflxl.exec:\xflflxl.exe56⤵
- Executes dropped EXE
PID:1864 -
\??\c:\nbhbhb.exec:\nbhbhb.exe57⤵
- Executes dropped EXE
PID:1676 -
\??\c:\pvdjj.exec:\pvdjj.exe58⤵
- Executes dropped EXE
PID:1724 -
\??\c:\djdjv.exec:\djdjv.exe59⤵
- Executes dropped EXE
PID:2756 -
\??\c:\llffllx.exec:\llffllx.exe60⤵
- Executes dropped EXE
PID:1456 -
\??\c:\tthbtt.exec:\tthbtt.exe61⤵
- Executes dropped EXE
PID:2332 -
\??\c:\jjjpv.exec:\jjjpv.exe62⤵
- Executes dropped EXE
PID:2156 -
\??\c:\fxrxrxl.exec:\fxrxrxl.exe63⤵
- Executes dropped EXE
PID:2056 -
\??\c:\lllxflf.exec:\lllxflf.exe64⤵
- Executes dropped EXE
PID:2436 -
\??\c:\tbntbn.exec:\tbntbn.exe65⤵
- Executes dropped EXE
PID:1004 -
\??\c:\9pjpv.exec:\9pjpv.exe66⤵PID:1168
-
\??\c:\bnthht.exec:\bnthht.exe67⤵PID:2900
-
\??\c:\hhbhth.exec:\hhbhth.exe68⤵PID:1604
-
\??\c:\pvppp.exec:\pvppp.exe69⤵PID:2280
-
\??\c:\9xllllx.exec:\9xllllx.exe70⤵PID:1484
-
\??\c:\thbhbn.exec:\thbhbn.exe71⤵PID:2248
-
\??\c:\dvdjv.exec:\dvdjv.exe72⤵PID:784
-
\??\c:\3lxfrrf.exec:\3lxfrrf.exe73⤵PID:1596
-
\??\c:\9nthnt.exec:\9nthnt.exe74⤵PID:2268
-
\??\c:\jpppd.exec:\jpppd.exe75⤵PID:2324
-
\??\c:\pjvdp.exec:\pjvdp.exe76⤵PID:3024
-
\??\c:\xrflxlx.exec:\xrflxlx.exe77⤵PID:2244
-
\??\c:\9nhbnt.exec:\9nhbnt.exe78⤵PID:2260
-
\??\c:\pjvpd.exec:\pjvpd.exe79⤵PID:1344
-
\??\c:\lrrlxff.exec:\lrrlxff.exe80⤵PID:1504
-
\??\c:\rxlxrfr.exec:\rxlxrfr.exe81⤵PID:2148
-
\??\c:\tnhtbh.exec:\tnhtbh.exe82⤵PID:2604
-
\??\c:\jvjjp.exec:\jvjjp.exe83⤵PID:2588
-
\??\c:\7rlxllx.exec:\7rlxllx.exe84⤵PID:2092
-
\??\c:\fllrfrr.exec:\fllrfrr.exe85⤵PID:2464
-
\??\c:\nnhbht.exec:\nnhbht.exe86⤵PID:2144
-
\??\c:\7dvpv.exec:\7dvpv.exe87⤵PID:2624
-
\??\c:\xrffrrf.exec:\xrffrrf.exe88⤵PID:2452
-
\??\c:\fffrxfl.exec:\fffrxfl.exe89⤵PID:2108
-
\??\c:\5ththh.exec:\5ththh.exe90⤵PID:2940
-
\??\c:\dvjpv.exec:\dvjpv.exe91⤵PID:576
-
\??\c:\rfflrrf.exec:\rfflrrf.exe92⤵PID:1408
-
\??\c:\xrxflrx.exec:\xrxflrx.exe93⤵PID:1060
-
\??\c:\nnhbnt.exec:\nnhbnt.exe94⤵PID:1400
-
\??\c:\3thbhh.exec:\3thbhh.exe95⤵PID:2892
-
\??\c:\jvjvj.exec:\jvjvj.exe96⤵PID:2920
-
\??\c:\frlxxrf.exec:\frlxxrf.exe97⤵PID:2992
-
\??\c:\3rrxrxf.exec:\3rrxrxf.exe98⤵PID:1448
-
\??\c:\tnhnhn.exec:\tnhnhn.exe99⤵PID:1772
-
\??\c:\jppvd.exec:\jppvd.exe100⤵PID:1864
-
\??\c:\1ppvj.exec:\1ppvj.exe101⤵PID:1676
-
\??\c:\3frxxxl.exec:\3frxxxl.exe102⤵PID:1724
-
\??\c:\htbbnh.exec:\htbbnh.exe103⤵PID:2548
-
\??\c:\dvjpd.exec:\dvjpd.exe104⤵PID:712
-
\??\c:\vpdvv.exec:\vpdvv.exe105⤵PID:1752
-
\??\c:\rrlrxxx.exec:\rrlrxxx.exe106⤵PID:2556
-
\??\c:\bthbtn.exec:\bthbtn.exe107⤵PID:2072
-
\??\c:\pjvvd.exec:\pjvvd.exe108⤵PID:2872
-
\??\c:\7dppj.exec:\7dppj.exe109⤵PID:596
-
\??\c:\rfrfllx.exec:\rfrfllx.exe110⤵PID:2084
-
\??\c:\3tnhnn.exec:\3tnhnn.exe111⤵PID:2884
-
\??\c:\ppjpd.exec:\ppjpd.exe112⤵PID:1184
-
\??\c:\jdpdd.exec:\jdpdd.exe113⤵PID:2768
-
\??\c:\lllrfrx.exec:\lllrfrx.exe114⤵PID:1360
-
\??\c:\bbnhnt.exec:\bbnhnt.exe115⤵PID:1072
-
\??\c:\vjvvd.exec:\vjvvd.exe116⤵PID:1852
-
\??\c:\9lxrffr.exec:\9lxrffr.exe117⤵PID:2396
-
\??\c:\3xrxflr.exec:\3xrxflr.exe118⤵PID:2360
-
\??\c:\3thhth.exec:\3thhth.exe119⤵PID:1464
-
\??\c:\pvvjv.exec:\pvvjv.exe120⤵PID:2384
-
\??\c:\7jvvd.exec:\7jvvd.exe121⤵PID:1428
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-