Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
11-01-2025 06:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e2ffaada1a7d7cf6e8c48c4768e8dcd6abd04ce9aa10009911eb873ee49c8a5e.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
120 seconds
General
-
Target
e2ffaada1a7d7cf6e8c48c4768e8dcd6abd04ce9aa10009911eb873ee49c8a5e.exe
-
Size
454KB
-
MD5
04d1b6b41597b21d019113d19cf04a9e
-
SHA1
e9da23c0d17a1894e1f0bb3ca55f5db509f095a4
-
SHA256
e2ffaada1a7d7cf6e8c48c4768e8dcd6abd04ce9aa10009911eb873ee49c8a5e
-
SHA512
e3a140839d779a64c1b8749cdf95ba4240ed24277fc3ee72fe97a9cb9e2cae755e9f4a55f8a8ed53d4e0e24cd2ae212aae0c9277295bf653abd3600f32cd265c
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe1:q7Tc2NYHUrAwfMp3CD1
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/2116-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2340-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3060-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1688-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1560-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1776-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2084-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1108-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2280-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2280-229-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1652-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1036-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1744-273-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2428-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-296-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2380-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-301-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1588-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-344-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2736-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-377-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-421-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2316-422-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1312-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1048-462-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2460-490-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1516-516-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2608-593-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-633-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-716-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2280-795-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/848-796-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/3036-1154-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2340 xfrfrrf.exe 2212 jdpdv.exe 2856 9nnnth.exe 3060 hhhhhn.exe 2188 7fxflrx.exe 3016 bhnbth.exe 2704 pvjjp.exe 2708 3btbbn.exe 1688 5jvvp.exe 1560 1nnnbh.exe 1776 vdppd.exe 2084 hhtbbn.exe 1256 7vpvj.exe 2924 tthhnt.exe 3008 ppvvv.exe 1288 nthtbn.exe 2504 vvjpp.exe 928 bhthtb.exe 1108 7vppd.exe 2484 nhnthh.exe 1376 9vppv.exe 1616 fllxxll.exe 2632 9btntt.exe 2280 ddjjj.exe 868 jjpvd.exe 1652 3flffxr.exe 1036 pvjvd.exe 920 xxlrxfr.exe 1744 jpjjv.exe 1368 7rfrxfl.exe 2428 djvjv.exe 2380 djvdv.exe 1588 fxlrrlr.exe 3036 ddvjp.exe 2768 xlxxlxr.exe 2212 xxlrflx.exe 2784 9jdpd.exe 3048 djvvv.exe 3044 rfxxlxl.exe 2832 tttbtb.exe 2692 djddp.exe 2736 xxrxlfl.exe 2688 5xxfrfl.exe 2132 ttbhnn.exe 1688 pjdpp.exe 752 9xxlflf.exe 2508 frxrlxl.exe 2056 nbbhth.exe 2468 pvjvj.exe 2512 rxlxxfr.exe 2316 rfrrlfr.exe 3028 nnbhnt.exe 1312 ppjvj.exe 2760 lxrrfrf.exe 2076 tthntb.exe 1048 vjppd.exe 3064 3dvjd.exe 624 1rflxrf.exe 2120 nbtbht.exe 2460 5btbth.exe 2452 ddpvp.exe 1092 rrxlrfx.exe 2312 tbntnt.exe 1516 bbhnbn.exe -
resource yara_rule behavioral1/memory/2116-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1560-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1108-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/920-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1036-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1588-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1312-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/996-561-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-586-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-593-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-633-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-696-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-709-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-716-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/848-796-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/2032-803-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1040-835-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-1043-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-1056-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-1115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-1145-0x00000000003D0000-0x00000000003FA000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rlrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lflxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxrlxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrxrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxfflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hhnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxxflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2116 wrote to memory of 2340 2116 e2ffaada1a7d7cf6e8c48c4768e8dcd6abd04ce9aa10009911eb873ee49c8a5e.exe 29 PID 2116 wrote to memory of 2340 2116 e2ffaada1a7d7cf6e8c48c4768e8dcd6abd04ce9aa10009911eb873ee49c8a5e.exe 29 PID 2116 wrote to memory of 2340 2116 e2ffaada1a7d7cf6e8c48c4768e8dcd6abd04ce9aa10009911eb873ee49c8a5e.exe 29 PID 2116 wrote to memory of 2340 2116 e2ffaada1a7d7cf6e8c48c4768e8dcd6abd04ce9aa10009911eb873ee49c8a5e.exe 29 PID 2340 wrote to memory of 2212 2340 xfrfrrf.exe 30 PID 2340 wrote to memory of 2212 2340 xfrfrrf.exe 30 PID 2340 wrote to memory of 2212 2340 xfrfrrf.exe 30 PID 2340 wrote to memory of 2212 2340 xfrfrrf.exe 30 PID 2212 wrote to memory of 2856 2212 jdpdv.exe 31 PID 2212 wrote to memory of 2856 2212 jdpdv.exe 31 PID 2212 wrote to memory of 2856 2212 jdpdv.exe 31 PID 2212 wrote to memory of 2856 2212 jdpdv.exe 31 PID 2856 wrote to memory of 3060 2856 9nnnth.exe 32 PID 2856 wrote to memory of 3060 2856 9nnnth.exe 32 PID 2856 wrote to memory of 3060 2856 9nnnth.exe 32 PID 2856 wrote to memory of 3060 2856 9nnnth.exe 32 PID 3060 wrote to memory of 2188 3060 hhhhhn.exe 33 PID 3060 wrote to memory of 2188 3060 hhhhhn.exe 33 PID 3060 wrote to memory of 2188 3060 hhhhhn.exe 33 PID 3060 wrote to memory of 2188 3060 hhhhhn.exe 33 PID 2188 wrote to memory of 3016 2188 7fxflrx.exe 34 PID 2188 wrote to memory of 3016 2188 7fxflrx.exe 34 PID 2188 wrote to memory of 3016 2188 7fxflrx.exe 34 PID 2188 wrote to memory of 3016 2188 7fxflrx.exe 34 PID 3016 wrote to memory of 2704 3016 bhnbth.exe 35 PID 3016 wrote to memory of 2704 3016 bhnbth.exe 35 PID 3016 wrote to memory of 2704 3016 bhnbth.exe 35 PID 3016 wrote to memory of 2704 3016 bhnbth.exe 35 PID 2704 wrote to memory of 2708 2704 pvjjp.exe 36 PID 2704 wrote to memory of 2708 2704 pvjjp.exe 36 PID 2704 wrote to memory of 2708 2704 pvjjp.exe 36 PID 2704 wrote to memory of 2708 2704 pvjjp.exe 36 PID 2708 wrote to memory of 1688 2708 3btbbn.exe 37 PID 2708 wrote to memory of 1688 2708 3btbbn.exe 37 PID 2708 wrote to memory of 1688 2708 3btbbn.exe 37 PID 2708 wrote to memory of 1688 2708 3btbbn.exe 37 PID 1688 wrote to memory of 1560 1688 5jvvp.exe 38 PID 1688 wrote to memory of 1560 1688 5jvvp.exe 38 PID 1688 wrote to memory of 1560 1688 5jvvp.exe 38 PID 1688 wrote to memory of 1560 1688 5jvvp.exe 38 PID 1560 wrote to memory of 1776 1560 1nnnbh.exe 39 PID 1560 wrote to memory of 1776 1560 1nnnbh.exe 39 PID 1560 wrote to memory of 1776 1560 1nnnbh.exe 39 PID 1560 wrote to memory of 1776 1560 1nnnbh.exe 39 PID 1776 wrote to memory of 2084 1776 vdppd.exe 40 PID 1776 wrote to memory of 2084 1776 vdppd.exe 40 PID 1776 wrote to memory of 2084 1776 vdppd.exe 40 PID 1776 wrote to memory of 2084 1776 vdppd.exe 40 PID 2084 wrote to memory of 1256 2084 hhtbbn.exe 41 PID 2084 wrote to memory of 1256 2084 hhtbbn.exe 41 PID 2084 wrote to memory of 1256 2084 hhtbbn.exe 41 PID 2084 wrote to memory of 1256 2084 hhtbbn.exe 41 PID 1256 wrote to memory of 2924 1256 7vpvj.exe 42 PID 1256 wrote to memory of 2924 1256 7vpvj.exe 42 PID 1256 wrote to memory of 2924 1256 7vpvj.exe 42 PID 1256 wrote to memory of 2924 1256 7vpvj.exe 42 PID 2924 wrote to memory of 3008 2924 tthhnt.exe 43 PID 2924 wrote to memory of 3008 2924 tthhnt.exe 43 PID 2924 wrote to memory of 3008 2924 tthhnt.exe 43 PID 2924 wrote to memory of 3008 2924 tthhnt.exe 43 PID 3008 wrote to memory of 1288 3008 ppvvv.exe 44 PID 3008 wrote to memory of 1288 3008 ppvvv.exe 44 PID 3008 wrote to memory of 1288 3008 ppvvv.exe 44 PID 3008 wrote to memory of 1288 3008 ppvvv.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2ffaada1a7d7cf6e8c48c4768e8dcd6abd04ce9aa10009911eb873ee49c8a5e.exe"C:\Users\Admin\AppData\Local\Temp\e2ffaada1a7d7cf6e8c48c4768e8dcd6abd04ce9aa10009911eb873ee49c8a5e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\xfrfrrf.exec:\xfrfrrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\jdpdv.exec:\jdpdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\9nnnth.exec:\9nnnth.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\hhhhhn.exec:\hhhhhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\7fxflrx.exec:\7fxflrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\bhnbth.exec:\bhnbth.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\pvjjp.exec:\pvjjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\3btbbn.exec:\3btbbn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\5jvvp.exec:\5jvvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\1nnnbh.exec:\1nnnbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\vdppd.exec:\vdppd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\hhtbbn.exec:\hhtbbn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\7vpvj.exec:\7vpvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
\??\c:\tthhnt.exec:\tthhnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\ppvvv.exec:\ppvvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\nthtbn.exec:\nthtbn.exe17⤵
- Executes dropped EXE
PID:1288 -
\??\c:\vvjpp.exec:\vvjpp.exe18⤵
- Executes dropped EXE
PID:2504 -
\??\c:\bhthtb.exec:\bhthtb.exe19⤵
- Executes dropped EXE
PID:928 -
\??\c:\7vppd.exec:\7vppd.exe20⤵
- Executes dropped EXE
PID:1108 -
\??\c:\nhnthh.exec:\nhnthh.exe21⤵
- Executes dropped EXE
PID:2484 -
\??\c:\9vppv.exec:\9vppv.exe22⤵
- Executes dropped EXE
PID:1376 -
\??\c:\fllxxll.exec:\fllxxll.exe23⤵
- Executes dropped EXE
PID:1616 -
\??\c:\9btntt.exec:\9btntt.exe24⤵
- Executes dropped EXE
PID:2632 -
\??\c:\ddjjj.exec:\ddjjj.exe25⤵
- Executes dropped EXE
PID:2280 -
\??\c:\jjpvd.exec:\jjpvd.exe26⤵
- Executes dropped EXE
PID:868 -
\??\c:\3flffxr.exec:\3flffxr.exe27⤵
- Executes dropped EXE
PID:1652 -
\??\c:\pvjvd.exec:\pvjvd.exe28⤵
- Executes dropped EXE
PID:1036 -
\??\c:\xxlrxfr.exec:\xxlrxfr.exe29⤵
- Executes dropped EXE
PID:920 -
\??\c:\jpjjv.exec:\jpjjv.exe30⤵
- Executes dropped EXE
PID:1744 -
\??\c:\7rfrxfl.exec:\7rfrxfl.exe31⤵
- Executes dropped EXE
PID:1368 -
\??\c:\djvjv.exec:\djvjv.exe32⤵
- Executes dropped EXE
PID:2428 -
\??\c:\djvdv.exec:\djvdv.exe33⤵
- Executes dropped EXE
PID:2380 -
\??\c:\fxlrrlr.exec:\fxlrrlr.exe34⤵
- Executes dropped EXE
PID:1588 -
\??\c:\ddvjp.exec:\ddvjp.exe35⤵
- Executes dropped EXE
PID:3036 -
\??\c:\xlxxlxr.exec:\xlxxlxr.exe36⤵
- Executes dropped EXE
PID:2768 -
\??\c:\xxlrflx.exec:\xxlrflx.exe37⤵
- Executes dropped EXE
PID:2212 -
\??\c:\9jdpd.exec:\9jdpd.exe38⤵
- Executes dropped EXE
PID:2784 -
\??\c:\djvvv.exec:\djvvv.exe39⤵
- Executes dropped EXE
PID:3048 -
\??\c:\rfxxlxl.exec:\rfxxlxl.exe40⤵
- Executes dropped EXE
PID:3044 -
\??\c:\tttbtb.exec:\tttbtb.exe41⤵
- Executes dropped EXE
PID:2832 -
\??\c:\djddp.exec:\djddp.exe42⤵
- Executes dropped EXE
PID:2692 -
\??\c:\xxrxlfl.exec:\xxrxlfl.exe43⤵
- Executes dropped EXE
PID:2736 -
\??\c:\5xxfrfl.exec:\5xxfrfl.exe44⤵
- Executes dropped EXE
PID:2688 -
\??\c:\ttbhnn.exec:\ttbhnn.exe45⤵
- Executes dropped EXE
PID:2132 -
\??\c:\pjdpp.exec:\pjdpp.exe46⤵
- Executes dropped EXE
PID:1688 -
\??\c:\9xxlflf.exec:\9xxlflf.exe47⤵
- Executes dropped EXE
PID:752 -
\??\c:\frxrlxl.exec:\frxrlxl.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2508 -
\??\c:\nbbhth.exec:\nbbhth.exe49⤵
- Executes dropped EXE
PID:2056 -
\??\c:\pvjvj.exec:\pvjvj.exe50⤵
- Executes dropped EXE
PID:2468 -
\??\c:\rxlxxfr.exec:\rxlxxfr.exe51⤵
- Executes dropped EXE
PID:2512 -
\??\c:\rfrrlfr.exec:\rfrrlfr.exe52⤵
- Executes dropped EXE
PID:2316 -
\??\c:\nnbhnt.exec:\nnbhnt.exe53⤵
- Executes dropped EXE
PID:3028 -
\??\c:\ppjvj.exec:\ppjvj.exe54⤵
- Executes dropped EXE
PID:1312 -
\??\c:\lxrrfrf.exec:\lxrrfrf.exe55⤵
- Executes dropped EXE
PID:2760 -
\??\c:\tthntb.exec:\tthntb.exe56⤵
- Executes dropped EXE
PID:2076 -
\??\c:\vjppd.exec:\vjppd.exe57⤵
- Executes dropped EXE
PID:1048 -
\??\c:\3dvjd.exec:\3dvjd.exe58⤵
- Executes dropped EXE
PID:3064 -
\??\c:\1rflxrf.exec:\1rflxrf.exe59⤵
- Executes dropped EXE
PID:624 -
\??\c:\nbtbht.exec:\nbtbht.exe60⤵
- Executes dropped EXE
PID:2120 -
\??\c:\5btbth.exec:\5btbth.exe61⤵
- Executes dropped EXE
PID:2460 -
\??\c:\ddpvp.exec:\ddpvp.exe62⤵
- Executes dropped EXE
PID:2452 -
\??\c:\rrxlrfx.exec:\rrxlrfx.exe63⤵
- Executes dropped EXE
PID:1092 -
\??\c:\tbntnt.exec:\tbntnt.exe64⤵
- Executes dropped EXE
PID:2312 -
\??\c:\bbhnbn.exec:\bbhnbn.exe65⤵
- Executes dropped EXE
PID:1516 -
\??\c:\vvjpv.exec:\vvjpv.exe66⤵PID:2124
-
\??\c:\xfxrxfl.exec:\xfxrxfl.exe67⤵PID:1008
-
\??\c:\frrxllr.exec:\frrxllr.exe68⤵PID:1536
-
\??\c:\ntbbht.exec:\ntbbht.exe69⤵PID:852
-
\??\c:\ppjpj.exec:\ppjpj.exe70⤵PID:2392
-
\??\c:\ddvdp.exec:\ddvdp.exe71⤵PID:920
-
\??\c:\ffrxrrf.exec:\ffrxrrf.exe72⤵PID:692
-
\??\c:\hnbhnt.exec:\hnbhnt.exe73⤵PID:996
-
\??\c:\jpvpv.exec:\jpvpv.exe74⤵PID:1968
-
\??\c:\dpddj.exec:\dpddj.exe75⤵PID:1308
-
\??\c:\lfrfllf.exec:\lfrfllf.exe76⤵PID:2164
-
\??\c:\hntthn.exec:\hntthn.exe77⤵PID:2608
-
\??\c:\1pjpv.exec:\1pjpv.exe78⤵PID:2204
-
\??\c:\pvdjp.exec:\pvdjp.exe79⤵PID:944
-
\??\c:\5lxxffr.exec:\5lxxffr.exe80⤵PID:2856
-
\??\c:\hhnnht.exec:\hhnnht.exe81⤵PID:2944
-
\??\c:\hnnhhb.exec:\hnnhhb.exe82⤵PID:2820
-
\??\c:\dpvdj.exec:\dpvdj.exe83⤵PID:2680
-
\??\c:\lrfllrf.exec:\lrfllrf.exe84⤵PID:2828
-
\??\c:\xxlxlxf.exec:\xxlxlxf.exe85⤵PID:2672
-
\??\c:\hhnnbn.exec:\hhnnbn.exe86⤵PID:2700
-
\??\c:\vvdjp.exec:\vvdjp.exe87⤵PID:2724
-
\??\c:\3ppvd.exec:\3ppvd.exe88⤵PID:564
-
\??\c:\9frfrxl.exec:\9frfrxl.exe89⤵PID:2644
-
\??\c:\nbnnht.exec:\nbnnht.exe90⤵PID:1560
-
\??\c:\bbntht.exec:\bbntht.exe91⤵PID:2040
-
\??\c:\5jpvd.exec:\5jpvd.exe92⤵PID:1304
-
\??\c:\frffflr.exec:\frffflr.exe93⤵PID:2496
-
\??\c:\nnbhtb.exec:\nnbhtb.exe94⤵PID:2920
-
\??\c:\bhbnbb.exec:\bhbnbb.exe95⤵PID:2912
-
\??\c:\3jppp.exec:\3jppp.exe96⤵PID:2696
-
\??\c:\flxxxxf.exec:\flxxxxf.exe97⤵PID:840
-
\??\c:\flrrrxf.exec:\flrrrxf.exe98⤵PID:1436
-
\??\c:\bntthn.exec:\bntthn.exe99⤵PID:2100
-
\??\c:\ppjpd.exec:\ppjpd.exe100⤵PID:432
-
\??\c:\vdppv.exec:\vdppv.exe101⤵PID:1124
-
\??\c:\lllxrxl.exec:\lllxrxl.exe102⤵PID:3064
-
\??\c:\nnthnt.exec:\nnthnt.exe103⤵PID:624
-
\??\c:\tbhhtt.exec:\tbhhtt.exe104⤵PID:2236
-
\??\c:\7jdjp.exec:\7jdjp.exe105⤵PID:696
-
\??\c:\9rllrxf.exec:\9rllrxf.exe106⤵PID:848
-
\??\c:\7hbhnt.exec:\7hbhnt.exe107⤵PID:1636
-
\??\c:\tnbbhh.exec:\tnbbhh.exe108⤵PID:3052
-
\??\c:\7ppvv.exec:\7ppvv.exe109⤵PID:2280
-
\??\c:\rfrxlrx.exec:\rfrxlrx.exe110⤵PID:1620
-
\??\c:\tthnth.exec:\tthnth.exe111⤵PID:2032
-
\??\c:\hnhtht.exec:\hnhtht.exe112⤵PID:932
-
\??\c:\9dvvj.exec:\9dvvj.exe113⤵PID:1988
-
\??\c:\lxxlrxx.exec:\lxxlrxx.exe114⤵PID:544
-
\??\c:\hnbbht.exec:\hnbbht.exe115⤵PID:1716
-
\??\c:\3nttbb.exec:\3nttbb.exe116⤵PID:1040
-
\??\c:\ddpvd.exec:\ddpvd.exe117⤵PID:892
-
\??\c:\rrlrfrf.exec:\rrlrfrf.exe118⤵PID:2572
-
\??\c:\lrrrlrr.exec:\lrrrlrr.exe119⤵PID:1552
-
\??\c:\1ttbnt.exec:\1ttbnt.exe120⤵PID:2384
-
\??\c:\djvdj.exec:\djvdj.exe121⤵PID:1588
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-