Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 09:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
58ac7f9e3f872889c0c3e8b3500b5cd38e289ee4e10b450454548fc90bc05b61.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
58ac7f9e3f872889c0c3e8b3500b5cd38e289ee4e10b450454548fc90bc05b61.exe
-
Size
455KB
-
MD5
55046182ee9cc44c8d95de89c37ecc42
-
SHA1
a65d3c6075d43808d74027812a3a9574d7be4e04
-
SHA256
58ac7f9e3f872889c0c3e8b3500b5cd38e289ee4e10b450454548fc90bc05b61
-
SHA512
c4323504809397003d10817e02d51ac5bdc7291580a824dc03cc82e6efc6070ed650d4cc64fc6b924bf0d465c88cca1b49494102e59fd51d5eba6f4015772923
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbez:q7Tc2NYHUrAwfMp3CDz
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/1740-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-55-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2616-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2376-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1768-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-185-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2128-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2392-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1048-204-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/1048-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1796-215-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3028-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3028-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/876-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1980-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2052-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-428-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-448-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-462-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-483-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2536-497-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2492-526-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-565-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-577-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/3060-580-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-594-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2096-609-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-668-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1820-743-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2836 jdpvd.exe 2300 5thbbb.exe 2856 jdpjp.exe 2912 xlxrfff.exe 2616 hthhbb.exe 2608 fxllrrx.exe 2612 hhtbnt.exe 2628 7jvvv.exe 2376 9tnntb.exe 1768 ddppv.exe 1920 7frlrrr.exe 2780 jdpvj.exe 976 3dpvj.exe 2904 hnhnbh.exe 3068 vdvvv.exe 380 xrfflrx.exe 2980 ttbbth.exe 2544 lfxxrrf.exe 2128 nbbtbt.exe 2392 fxrlxxf.exe 1048 fxlflll.exe 1796 vjvdj.exe 1620 xlxxffl.exe 704 3nnnnn.exe 1544 jvddj.exe 3028 lllxrxl.exe 3012 nhtttt.exe 3008 xlxxxfl.exe 876 fxlrflx.exe 2500 jvjpv.exe 2832 rlxfrxf.exe 1032 nhtbbb.exe 2720 1pjpj.exe 2596 frrlfxf.exe 2588 bhnhnh.exe 2076 nhnttb.exe 2572 pdvpp.exe 1980 7xffxlr.exe 2052 rfrxxfx.exe 3032 tbttbt.exe 348 dpdvp.exe 1104 flfrrrx.exe 2164 9fllrrx.exe 2388 5bhhtt.exe 2916 1jddj.exe 1920 dpjjj.exe 2780 lfrrxfr.exe 2660 hnthhb.exe 1576 9vjjp.exe 2024 dpdjj.exe 3068 frllrlx.exe 880 htnnbb.exe 2988 pvvjp.exe 2992 1xllxfr.exe 2008 lffffrf.exe 2124 btnnbb.exe 956 dvjpd.exe 1944 5vjpp.exe 2512 lxlfxxf.exe 1648 9ttnnn.exe 2536 7jvdv.exe 704 9jppv.exe 2408 lfrxflx.exe 284 hhbbbb.exe -
resource yara_rule behavioral1/memory/1740-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1768-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-166-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2544-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1048-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/876-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-483-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-484-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-497-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/704-498-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/284-512-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-526-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-539-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-565-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-580-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-609-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1104-637-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-668-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-675-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1456-702-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1820-743-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-750-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrrfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxllrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbthbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrlffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxfffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1flllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tnhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1740 wrote to memory of 2836 1740 58ac7f9e3f872889c0c3e8b3500b5cd38e289ee4e10b450454548fc90bc05b61.exe 31 PID 1740 wrote to memory of 2836 1740 58ac7f9e3f872889c0c3e8b3500b5cd38e289ee4e10b450454548fc90bc05b61.exe 31 PID 1740 wrote to memory of 2836 1740 58ac7f9e3f872889c0c3e8b3500b5cd38e289ee4e10b450454548fc90bc05b61.exe 31 PID 1740 wrote to memory of 2836 1740 58ac7f9e3f872889c0c3e8b3500b5cd38e289ee4e10b450454548fc90bc05b61.exe 31 PID 2836 wrote to memory of 2300 2836 jdpvd.exe 32 PID 2836 wrote to memory of 2300 2836 jdpvd.exe 32 PID 2836 wrote to memory of 2300 2836 jdpvd.exe 32 PID 2836 wrote to memory of 2300 2836 jdpvd.exe 32 PID 2300 wrote to memory of 2856 2300 5thbbb.exe 33 PID 2300 wrote to memory of 2856 2300 5thbbb.exe 33 PID 2300 wrote to memory of 2856 2300 5thbbb.exe 33 PID 2300 wrote to memory of 2856 2300 5thbbb.exe 33 PID 2856 wrote to memory of 2912 2856 jdpjp.exe 34 PID 2856 wrote to memory of 2912 2856 jdpjp.exe 34 PID 2856 wrote to memory of 2912 2856 jdpjp.exe 34 PID 2856 wrote to memory of 2912 2856 jdpjp.exe 34 PID 2912 wrote to memory of 2616 2912 xlxrfff.exe 35 PID 2912 wrote to memory of 2616 2912 xlxrfff.exe 35 PID 2912 wrote to memory of 2616 2912 xlxrfff.exe 35 PID 2912 wrote to memory of 2616 2912 xlxrfff.exe 35 PID 2616 wrote to memory of 2608 2616 hthhbb.exe 36 PID 2616 wrote to memory of 2608 2616 hthhbb.exe 36 PID 2616 wrote to memory of 2608 2616 hthhbb.exe 36 PID 2616 wrote to memory of 2608 2616 hthhbb.exe 36 PID 2608 wrote to memory of 2612 2608 fxllrrx.exe 37 PID 2608 wrote to memory of 2612 2608 fxllrrx.exe 37 PID 2608 wrote to memory of 2612 2608 fxllrrx.exe 37 PID 2608 wrote to memory of 2612 2608 fxllrrx.exe 37 PID 2612 wrote to memory of 2628 2612 hhtbnt.exe 38 PID 2612 wrote to memory of 2628 2612 hhtbnt.exe 38 PID 2612 wrote to memory of 2628 2612 hhtbnt.exe 38 PID 2612 wrote to memory of 2628 2612 hhtbnt.exe 38 PID 2628 wrote to memory of 2376 2628 7jvvv.exe 39 PID 2628 wrote to memory of 2376 2628 7jvvv.exe 39 PID 2628 wrote to memory of 2376 2628 7jvvv.exe 39 PID 2628 wrote to memory of 2376 2628 7jvvv.exe 39 PID 2376 wrote to memory of 1768 2376 9tnntb.exe 40 PID 2376 wrote to memory of 1768 2376 9tnntb.exe 40 PID 2376 wrote to memory of 1768 2376 9tnntb.exe 40 PID 2376 wrote to memory of 1768 2376 9tnntb.exe 40 PID 1768 wrote to memory of 1920 1768 ddppv.exe 41 PID 1768 wrote to memory of 1920 1768 ddppv.exe 41 PID 1768 wrote to memory of 1920 1768 ddppv.exe 41 PID 1768 wrote to memory of 1920 1768 ddppv.exe 41 PID 1920 wrote to memory of 2780 1920 7frlrrr.exe 42 PID 1920 wrote to memory of 2780 1920 7frlrrr.exe 42 PID 1920 wrote to memory of 2780 1920 7frlrrr.exe 42 PID 1920 wrote to memory of 2780 1920 7frlrrr.exe 42 PID 2780 wrote to memory of 976 2780 jdpvj.exe 43 PID 2780 wrote to memory of 976 2780 jdpvj.exe 43 PID 2780 wrote to memory of 976 2780 jdpvj.exe 43 PID 2780 wrote to memory of 976 2780 jdpvj.exe 43 PID 976 wrote to memory of 2904 976 3dpvj.exe 44 PID 976 wrote to memory of 2904 976 3dpvj.exe 44 PID 976 wrote to memory of 2904 976 3dpvj.exe 44 PID 976 wrote to memory of 2904 976 3dpvj.exe 44 PID 2904 wrote to memory of 3068 2904 hnhnbh.exe 45 PID 2904 wrote to memory of 3068 2904 hnhnbh.exe 45 PID 2904 wrote to memory of 3068 2904 hnhnbh.exe 45 PID 2904 wrote to memory of 3068 2904 hnhnbh.exe 45 PID 3068 wrote to memory of 380 3068 vdvvv.exe 46 PID 3068 wrote to memory of 380 3068 vdvvv.exe 46 PID 3068 wrote to memory of 380 3068 vdvvv.exe 46 PID 3068 wrote to memory of 380 3068 vdvvv.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\58ac7f9e3f872889c0c3e8b3500b5cd38e289ee4e10b450454548fc90bc05b61.exe"C:\Users\Admin\AppData\Local\Temp\58ac7f9e3f872889c0c3e8b3500b5cd38e289ee4e10b450454548fc90bc05b61.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\jdpvd.exec:\jdpvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\5thbbb.exec:\5thbbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\jdpjp.exec:\jdpjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\xlxrfff.exec:\xlxrfff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\hthhbb.exec:\hthhbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\fxllrrx.exec:\fxllrrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\hhtbnt.exec:\hhtbnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\7jvvv.exec:\7jvvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\9tnntb.exec:\9tnntb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\ddppv.exec:\ddppv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
\??\c:\7frlrrr.exec:\7frlrrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\jdpvj.exec:\jdpvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\3dpvj.exec:\3dpvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:976 -
\??\c:\hnhnbh.exec:\hnhnbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\vdvvv.exec:\vdvvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\xrfflrx.exec:\xrfflrx.exe17⤵
- Executes dropped EXE
PID:380 -
\??\c:\ttbbth.exec:\ttbbth.exe18⤵
- Executes dropped EXE
PID:2980 -
\??\c:\lfxxrrf.exec:\lfxxrrf.exe19⤵
- Executes dropped EXE
PID:2544 -
\??\c:\nbbtbt.exec:\nbbtbt.exe20⤵
- Executes dropped EXE
PID:2128 -
\??\c:\fxrlxxf.exec:\fxrlxxf.exe21⤵
- Executes dropped EXE
PID:2392 -
\??\c:\fxlflll.exec:\fxlflll.exe22⤵
- Executes dropped EXE
PID:1048 -
\??\c:\vjvdj.exec:\vjvdj.exe23⤵
- Executes dropped EXE
PID:1796 -
\??\c:\xlxxffl.exec:\xlxxffl.exe24⤵
- Executes dropped EXE
PID:1620 -
\??\c:\3nnnnn.exec:\3nnnnn.exe25⤵
- Executes dropped EXE
PID:704 -
\??\c:\jvddj.exec:\jvddj.exe26⤵
- Executes dropped EXE
PID:1544 -
\??\c:\lllxrxl.exec:\lllxrxl.exe27⤵
- Executes dropped EXE
PID:3028 -
\??\c:\nhtttt.exec:\nhtttt.exe28⤵
- Executes dropped EXE
PID:3012 -
\??\c:\xlxxxfl.exec:\xlxxxfl.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3008 -
\??\c:\fxlrflx.exec:\fxlrflx.exe30⤵
- Executes dropped EXE
PID:876 -
\??\c:\jvjpv.exec:\jvjpv.exe31⤵
- Executes dropped EXE
PID:2500 -
\??\c:\rlxfrxf.exec:\rlxfrxf.exe32⤵
- Executes dropped EXE
PID:2832 -
\??\c:\nhtbbb.exec:\nhtbbb.exe33⤵
- Executes dropped EXE
PID:1032 -
\??\c:\1pjpj.exec:\1pjpj.exe34⤵
- Executes dropped EXE
PID:2720 -
\??\c:\frrlfxf.exec:\frrlfxf.exe35⤵
- Executes dropped EXE
PID:2596 -
\??\c:\bhnhnh.exec:\bhnhnh.exe36⤵
- Executes dropped EXE
PID:2588 -
\??\c:\nhnttb.exec:\nhnttb.exe37⤵
- Executes dropped EXE
PID:2076 -
\??\c:\pdvpp.exec:\pdvpp.exe38⤵
- Executes dropped EXE
PID:2572 -
\??\c:\7xffxlr.exec:\7xffxlr.exe39⤵
- Executes dropped EXE
PID:1980 -
\??\c:\rfrxxfx.exec:\rfrxxfx.exe40⤵
- Executes dropped EXE
PID:2052 -
\??\c:\tbttbt.exec:\tbttbt.exe41⤵
- Executes dropped EXE
PID:3032 -
\??\c:\dpdvp.exec:\dpdvp.exe42⤵
- Executes dropped EXE
PID:348 -
\??\c:\flfrrrx.exec:\flfrrrx.exe43⤵
- Executes dropped EXE
PID:1104 -
\??\c:\9fllrrx.exec:\9fllrrx.exe44⤵
- Executes dropped EXE
PID:2164 -
\??\c:\5bhhtt.exec:\5bhhtt.exe45⤵
- Executes dropped EXE
PID:2388 -
\??\c:\1jddj.exec:\1jddj.exe46⤵
- Executes dropped EXE
PID:2916 -
\??\c:\dpjjj.exec:\dpjjj.exe47⤵
- Executes dropped EXE
PID:1920 -
\??\c:\lfrrxfr.exec:\lfrrxfr.exe48⤵
- Executes dropped EXE
PID:2780 -
\??\c:\hnthhb.exec:\hnthhb.exe49⤵
- Executes dropped EXE
PID:2660 -
\??\c:\9vjjp.exec:\9vjjp.exe50⤵
- Executes dropped EXE
PID:1576 -
\??\c:\dpdjj.exec:\dpdjj.exe51⤵
- Executes dropped EXE
PID:2024 -
\??\c:\frllrlx.exec:\frllrlx.exe52⤵
- Executes dropped EXE
PID:3068 -
\??\c:\htnnbb.exec:\htnnbb.exe53⤵
- Executes dropped EXE
PID:880 -
\??\c:\pvvjp.exec:\pvvjp.exe54⤵
- Executes dropped EXE
PID:2988 -
\??\c:\1xllxfr.exec:\1xllxfr.exe55⤵
- Executes dropped EXE
PID:2992 -
\??\c:\lffffrf.exec:\lffffrf.exe56⤵
- Executes dropped EXE
PID:2008 -
\??\c:\btnnbb.exec:\btnnbb.exe57⤵
- Executes dropped EXE
PID:2124 -
\??\c:\dvjpd.exec:\dvjpd.exe58⤵
- Executes dropped EXE
PID:956 -
\??\c:\5vjpp.exec:\5vjpp.exe59⤵
- Executes dropped EXE
PID:1944 -
\??\c:\lxlfxxf.exec:\lxlfxxf.exe60⤵
- Executes dropped EXE
PID:2512 -
\??\c:\9ttnnn.exec:\9ttnnn.exe61⤵
- Executes dropped EXE
PID:1648 -
\??\c:\7jvdv.exec:\7jvdv.exe62⤵
- Executes dropped EXE
PID:2536 -
\??\c:\9jppv.exec:\9jppv.exe63⤵
- Executes dropped EXE
PID:704 -
\??\c:\lfrxflx.exec:\lfrxflx.exe64⤵
- Executes dropped EXE
PID:2408 -
\??\c:\hhbbbb.exec:\hhbbbb.exe65⤵
- Executes dropped EXE
PID:284 -
\??\c:\tnhnnn.exec:\tnhnnn.exe66⤵PID:2492
-
\??\c:\jdppp.exec:\jdppp.exe67⤵PID:1492
-
\??\c:\frffffl.exec:\frffffl.exe68⤵PID:3008
-
\??\c:\rfxflll.exec:\rfxflll.exe69⤵PID:1800
-
\??\c:\9nbnnh.exec:\9nbnnh.exe70⤵PID:2664
-
\??\c:\nbthbb.exec:\nbthbb.exe71⤵
- System Location Discovery: System Language Discovery
PID:1712 -
\??\c:\ppdvd.exec:\ppdvd.exe72⤵PID:2668
-
\??\c:\fxlfllr.exec:\fxlfllr.exe73⤵PID:1600
-
\??\c:\lfllfff.exec:\lfllfff.exe74⤵PID:2692
-
\??\c:\nhtbhb.exec:\nhtbhb.exe75⤵PID:3060
-
\??\c:\1dvdj.exec:\1dvdj.exe76⤵PID:2672
-
\??\c:\rfllllx.exec:\rfllllx.exe77⤵PID:2604
-
\??\c:\ffxrxrl.exec:\ffxrxrl.exe78⤵PID:2680
-
\??\c:\bthtbb.exec:\bthtbb.exe79⤵PID:2096
-
\??\c:\nhtnnh.exec:\nhtnnh.exe80⤵PID:3056
-
\??\c:\vpppj.exec:\vpppj.exe81⤵PID:3032
-
\??\c:\xlffrxf.exec:\xlffrxf.exe82⤵PID:2068
-
\??\c:\fxxfrrf.exec:\fxxfrrf.exe83⤵PID:1104
-
\??\c:\nhhhnn.exec:\nhhhnn.exe84⤵PID:688
-
\??\c:\9jjpp.exec:\9jjpp.exe85⤵PID:788
-
\??\c:\jdppd.exec:\jdppd.exe86⤵PID:2916
-
\??\c:\xlrfrfl.exec:\xlrfrfl.exe87⤵PID:1920
-
\??\c:\bnbtbb.exec:\bnbtbb.exe88⤵PID:1404
-
\??\c:\jjvvd.exec:\jjvvd.exe89⤵PID:2548
-
\??\c:\jvdjj.exec:\jvdjj.exe90⤵PID:2072
-
\??\c:\fxfxlfl.exec:\fxfxlfl.exe91⤵PID:2024
-
\??\c:\nhthtt.exec:\nhthtt.exe92⤵PID:572
-
\??\c:\tnttbh.exec:\tnttbh.exe93⤵PID:1456
-
\??\c:\3jvvp.exec:\3jvvp.exe94⤵PID:1708
-
\??\c:\jjdpd.exec:\jjdpd.exe95⤵PID:2420
-
\??\c:\5rlfflr.exec:\5rlfflr.exe96⤵PID:2008
-
\??\c:\bnttbb.exec:\bnttbb.exe97⤵PID:448
-
\??\c:\7htbhn.exec:\7htbhn.exe98⤵PID:956
-
\??\c:\7pppv.exec:\7pppv.exe99⤵PID:1820
-
\??\c:\lfrxllr.exec:\lfrxllr.exe100⤵PID:2512
-
\??\c:\tnntbb.exec:\tnntbb.exe101⤵PID:1704
-
\??\c:\1bbhbb.exec:\1bbhbb.exe102⤵PID:1620
-
\??\c:\9pddj.exec:\9pddj.exe103⤵PID:704
-
\??\c:\lxflrll.exec:\lxflrll.exe104⤵PID:1948
-
\??\c:\rlflrlf.exec:\rlflrlf.exe105⤵PID:1360
-
\??\c:\7bbnhn.exec:\7bbnhn.exe106⤵PID:2092
-
\??\c:\dvvpj.exec:\dvvpj.exe107⤵PID:1824
-
\??\c:\1rxllfx.exec:\1rxllfx.exe108⤵PID:1236
-
\??\c:\nhhtbh.exec:\nhhtbh.exe109⤵PID:888
-
\??\c:\5nbtbb.exec:\5nbtbb.exe110⤵PID:1572
-
\??\c:\dpddd.exec:\dpddd.exe111⤵PID:1596
-
\??\c:\ffxxffr.exec:\ffxxffr.exe112⤵PID:2848
-
\??\c:\xrxxffl.exec:\xrxxffl.exe113⤵PID:1600
-
\??\c:\1nttnn.exec:\1nttnn.exe114⤵PID:2928
-
\??\c:\ddvpv.exec:\ddvpv.exe115⤵PID:2824
-
\??\c:\9pjpv.exec:\9pjpv.exe116⤵PID:2912
-
\??\c:\xrrrfrf.exec:\xrrrfrf.exe117⤵
- System Location Discovery: System Language Discovery
PID:2580 -
\??\c:\hthhhh.exec:\hthhhh.exe118⤵PID:2624
-
\??\c:\vvjjp.exec:\vvjjp.exe119⤵PID:3048
-
\??\c:\frlrxfl.exec:\frlrxfl.exe120⤵PID:1348
-
\??\c:\lffrrlr.exec:\lffrrlr.exe121⤵PID:3064
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-