Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 09:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
beefb54431ce888b522e18ce48c62a09dae62ddc80a065170018023be14d8550.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
120 seconds
General
-
Target
beefb54431ce888b522e18ce48c62a09dae62ddc80a065170018023be14d8550.exe
-
Size
454KB
-
MD5
a79d4e2c7ce5fb45ecf840f57ed5792a
-
SHA1
74fd8f119ca46774e326087862e69af97594aa1e
-
SHA256
beefb54431ce888b522e18ce48c62a09dae62ddc80a065170018023be14d8550
-
SHA512
05bc256c10186ce7252f575801fa6729e0459bd14dba47ac8705b81d178ab39df516fdec6930a1ed61a4659dd5985b77a109062e62d27231c81aa9b4f2b2f3ca
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbes:q7Tc2NYHUrAwfMp3CDs
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 53 IoCs
resource yara_rule behavioral1/memory/2100-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1296-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2196-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-98-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2996-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2016-124-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2016-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1960-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/536-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2140-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2064-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1020-249-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/808-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/636-272-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1904-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-335-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2600-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-383-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/1436-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-400-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2292-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1944-411-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1968-419-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1584-426-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/588-440-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1968-438-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2424-466-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1148-473-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/1148-498-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/1548-515-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2368-526-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2368-525-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2336-545-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1904-564-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1904-565-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2052-579-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2152-581-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-631-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-638-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2508-720-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1624-758-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1312-770-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1296 jpdpp.exe 2188 ffrxlxr.exe 2196 1hbbnb.exe 2744 vdddv.exe 2916 1ddpv.exe 2812 ddpvj.exe 2560 lrfxflx.exe 2644 pvdjv.exe 2612 jpdpp.exe 2996 hbbbth.exe 1308 1rlrfrl.exe 2860 3hbbhn.exe 2016 1fflfrx.exe 1960 hhhnhh.exe 2856 hntbhn.exe 1408 vdpjp.exe 536 7bbhtb.exe 2180 9vppd.exe 2424 vdvdv.exe 1900 1dvdp.exe 1720 dpdjp.exe 956 ffxllrf.exe 1020 vpjpp.exe 2140 fllxffx.exe 2064 ddjjp.exe 808 xxllxxf.exe 2980 jvjvd.exe 700 tttnth.exe 636 7xlrflx.exe 1904 tbnbnt.exe 2960 pdjpd.exe 2468 llrfffl.exe 1596 1jdpj.exe 1504 lrxffrx.exe 2680 bhbhnt.exe 2808 jdppv.exe 2744 dvjpd.exe 2916 lrffrfl.exe 2784 3tntnt.exe 3040 vvddp.exe 2564 vpdvd.exe 2600 ffxflxl.exe 2612 nhhnhn.exe 1888 3ddpv.exe 1436 ppvdd.exe 1800 ffrfrrx.exe 2292 nntbhh.exe 1944 ppvpj.exe 1968 rlxxfff.exe 1584 tttbhn.exe 628 3tnhnn.exe 588 ddddp.exe 580 fxrrffr.exe 2928 xfllxfl.exe 2428 tbtbbh.exe 2424 vvdvd.exe 1148 3rrllrx.exe 1820 xlrxfll.exe 2240 nhtbhh.exe 1804 djppd.exe 2028 lxrxflf.exe 2140 5lfrxfl.exe 1548 vjpvj.exe 2368 vddvv.exe -
resource yara_rule behavioral1/memory/2100-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1296-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-75-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2644-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/536-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/808-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1904-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1436-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/588-440-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/1820-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-526-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-545-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-566-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1904-565-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-573-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-581-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-618-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-631-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-638-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-645-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-758-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rxllff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xxrxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxllrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxrlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ffrxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2100 wrote to memory of 1296 2100 beefb54431ce888b522e18ce48c62a09dae62ddc80a065170018023be14d8550.exe 31 PID 2100 wrote to memory of 1296 2100 beefb54431ce888b522e18ce48c62a09dae62ddc80a065170018023be14d8550.exe 31 PID 2100 wrote to memory of 1296 2100 beefb54431ce888b522e18ce48c62a09dae62ddc80a065170018023be14d8550.exe 31 PID 2100 wrote to memory of 1296 2100 beefb54431ce888b522e18ce48c62a09dae62ddc80a065170018023be14d8550.exe 31 PID 1296 wrote to memory of 2188 1296 jpdpp.exe 32 PID 1296 wrote to memory of 2188 1296 jpdpp.exe 32 PID 1296 wrote to memory of 2188 1296 jpdpp.exe 32 PID 1296 wrote to memory of 2188 1296 jpdpp.exe 32 PID 2188 wrote to memory of 2196 2188 ffrxlxr.exe 33 PID 2188 wrote to memory of 2196 2188 ffrxlxr.exe 33 PID 2188 wrote to memory of 2196 2188 ffrxlxr.exe 33 PID 2188 wrote to memory of 2196 2188 ffrxlxr.exe 33 PID 2196 wrote to memory of 2744 2196 1hbbnb.exe 34 PID 2196 wrote to memory of 2744 2196 1hbbnb.exe 34 PID 2196 wrote to memory of 2744 2196 1hbbnb.exe 34 PID 2196 wrote to memory of 2744 2196 1hbbnb.exe 34 PID 2744 wrote to memory of 2916 2744 vdddv.exe 35 PID 2744 wrote to memory of 2916 2744 vdddv.exe 35 PID 2744 wrote to memory of 2916 2744 vdddv.exe 35 PID 2744 wrote to memory of 2916 2744 vdddv.exe 35 PID 2916 wrote to memory of 2812 2916 1ddpv.exe 36 PID 2916 wrote to memory of 2812 2916 1ddpv.exe 36 PID 2916 wrote to memory of 2812 2916 1ddpv.exe 36 PID 2916 wrote to memory of 2812 2916 1ddpv.exe 36 PID 2812 wrote to memory of 2560 2812 ddpvj.exe 37 PID 2812 wrote to memory of 2560 2812 ddpvj.exe 37 PID 2812 wrote to memory of 2560 2812 ddpvj.exe 37 PID 2812 wrote to memory of 2560 2812 ddpvj.exe 37 PID 2560 wrote to memory of 2644 2560 lrfxflx.exe 38 PID 2560 wrote to memory of 2644 2560 lrfxflx.exe 38 PID 2560 wrote to memory of 2644 2560 lrfxflx.exe 38 PID 2560 wrote to memory of 2644 2560 lrfxflx.exe 38 PID 2644 wrote to memory of 2612 2644 pvdjv.exe 39 PID 2644 wrote to memory of 2612 2644 pvdjv.exe 39 PID 2644 wrote to memory of 2612 2644 pvdjv.exe 39 PID 2644 wrote to memory of 2612 2644 pvdjv.exe 39 PID 2612 wrote to memory of 2996 2612 jpdpp.exe 40 PID 2612 wrote to memory of 2996 2612 jpdpp.exe 40 PID 2612 wrote to memory of 2996 2612 jpdpp.exe 40 PID 2612 wrote to memory of 2996 2612 jpdpp.exe 40 PID 2996 wrote to memory of 1308 2996 hbbbth.exe 41 PID 2996 wrote to memory of 1308 2996 hbbbth.exe 41 PID 2996 wrote to memory of 1308 2996 hbbbth.exe 41 PID 2996 wrote to memory of 1308 2996 hbbbth.exe 41 PID 1308 wrote to memory of 2860 1308 1rlrfrl.exe 42 PID 1308 wrote to memory of 2860 1308 1rlrfrl.exe 42 PID 1308 wrote to memory of 2860 1308 1rlrfrl.exe 42 PID 1308 wrote to memory of 2860 1308 1rlrfrl.exe 42 PID 2860 wrote to memory of 2016 2860 3hbbhn.exe 43 PID 2860 wrote to memory of 2016 2860 3hbbhn.exe 43 PID 2860 wrote to memory of 2016 2860 3hbbhn.exe 43 PID 2860 wrote to memory of 2016 2860 3hbbhn.exe 43 PID 2016 wrote to memory of 1960 2016 1fflfrx.exe 44 PID 2016 wrote to memory of 1960 2016 1fflfrx.exe 44 PID 2016 wrote to memory of 1960 2016 1fflfrx.exe 44 PID 2016 wrote to memory of 1960 2016 1fflfrx.exe 44 PID 1960 wrote to memory of 2856 1960 hhhnhh.exe 45 PID 1960 wrote to memory of 2856 1960 hhhnhh.exe 45 PID 1960 wrote to memory of 2856 1960 hhhnhh.exe 45 PID 1960 wrote to memory of 2856 1960 hhhnhh.exe 45 PID 2856 wrote to memory of 1408 2856 hntbhn.exe 46 PID 2856 wrote to memory of 1408 2856 hntbhn.exe 46 PID 2856 wrote to memory of 1408 2856 hntbhn.exe 46 PID 2856 wrote to memory of 1408 2856 hntbhn.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\beefb54431ce888b522e18ce48c62a09dae62ddc80a065170018023be14d8550.exe"C:\Users\Admin\AppData\Local\Temp\beefb54431ce888b522e18ce48c62a09dae62ddc80a065170018023be14d8550.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\jpdpp.exec:\jpdpp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
\??\c:\ffrxlxr.exec:\ffrxlxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\1hbbnb.exec:\1hbbnb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\vdddv.exec:\vdddv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\1ddpv.exec:\1ddpv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\ddpvj.exec:\ddpvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\lrfxflx.exec:\lrfxflx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\pvdjv.exec:\pvdjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\jpdpp.exec:\jpdpp.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\hbbbth.exec:\hbbbth.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\1rlrfrl.exec:\1rlrfrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
\??\c:\3hbbhn.exec:\3hbbhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\1fflfrx.exec:\1fflfrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\hhhnhh.exec:\hhhnhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\hntbhn.exec:\hntbhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\vdpjp.exec:\vdpjp.exe17⤵
- Executes dropped EXE
PID:1408 -
\??\c:\7bbhtb.exec:\7bbhtb.exe18⤵
- Executes dropped EXE
PID:536 -
\??\c:\9vppd.exec:\9vppd.exe19⤵
- Executes dropped EXE
PID:2180 -
\??\c:\vdvdv.exec:\vdvdv.exe20⤵
- Executes dropped EXE
PID:2424 -
\??\c:\1dvdp.exec:\1dvdp.exe21⤵
- Executes dropped EXE
PID:1900 -
\??\c:\dpdjp.exec:\dpdjp.exe22⤵
- Executes dropped EXE
PID:1720 -
\??\c:\ffxllrf.exec:\ffxllrf.exe23⤵
- Executes dropped EXE
PID:956 -
\??\c:\vpjpp.exec:\vpjpp.exe24⤵
- Executes dropped EXE
PID:1020 -
\??\c:\fllxffx.exec:\fllxffx.exe25⤵
- Executes dropped EXE
PID:2140 -
\??\c:\ddjjp.exec:\ddjjp.exe26⤵
- Executes dropped EXE
PID:2064 -
\??\c:\xxllxxf.exec:\xxllxxf.exe27⤵
- Executes dropped EXE
PID:808 -
\??\c:\jvjvd.exec:\jvjvd.exe28⤵
- Executes dropped EXE
PID:2980 -
\??\c:\tttnth.exec:\tttnth.exe29⤵
- Executes dropped EXE
PID:700 -
\??\c:\7xlrflx.exec:\7xlrflx.exe30⤵
- Executes dropped EXE
PID:636 -
\??\c:\tbnbnt.exec:\tbnbnt.exe31⤵
- Executes dropped EXE
PID:1904 -
\??\c:\pdjpd.exec:\pdjpd.exe32⤵
- Executes dropped EXE
PID:2960 -
\??\c:\llrfffl.exec:\llrfffl.exe33⤵
- Executes dropped EXE
PID:2468 -
\??\c:\1jdpj.exec:\1jdpj.exe34⤵
- Executes dropped EXE
PID:1596 -
\??\c:\lrxffrx.exec:\lrxffrx.exe35⤵
- Executes dropped EXE
PID:1504 -
\??\c:\bhbhnt.exec:\bhbhnt.exe36⤵
- Executes dropped EXE
PID:2680 -
\??\c:\jdppv.exec:\jdppv.exe37⤵
- Executes dropped EXE
PID:2808 -
\??\c:\dvjpd.exec:\dvjpd.exe38⤵
- Executes dropped EXE
PID:2744 -
\??\c:\lrffrfl.exec:\lrffrfl.exe39⤵
- Executes dropped EXE
PID:2916 -
\??\c:\3tntnt.exec:\3tntnt.exe40⤵
- Executes dropped EXE
PID:2784 -
\??\c:\vvddp.exec:\vvddp.exe41⤵
- Executes dropped EXE
PID:3040 -
\??\c:\vpdvd.exec:\vpdvd.exe42⤵
- Executes dropped EXE
PID:2564 -
\??\c:\ffxflxl.exec:\ffxflxl.exe43⤵
- Executes dropped EXE
PID:2600 -
\??\c:\nhhnhn.exec:\nhhnhn.exe44⤵
- Executes dropped EXE
PID:2612 -
\??\c:\3ddpv.exec:\3ddpv.exe45⤵
- Executes dropped EXE
PID:1888 -
\??\c:\ppvdd.exec:\ppvdd.exe46⤵
- Executes dropped EXE
PID:1436 -
\??\c:\ffrfrrx.exec:\ffrfrrx.exe47⤵
- Executes dropped EXE
PID:1800 -
\??\c:\nntbhh.exec:\nntbhh.exe48⤵
- Executes dropped EXE
PID:2292 -
\??\c:\ppvpj.exec:\ppvpj.exe49⤵
- Executes dropped EXE
PID:1944 -
\??\c:\rlxxfff.exec:\rlxxfff.exe50⤵
- Executes dropped EXE
PID:1968 -
\??\c:\tttbhn.exec:\tttbhn.exe51⤵
- Executes dropped EXE
PID:1584 -
\??\c:\3tnhnn.exec:\3tnhnn.exe52⤵
- Executes dropped EXE
PID:628 -
\??\c:\ddddp.exec:\ddddp.exe53⤵
- Executes dropped EXE
PID:588 -
\??\c:\fxrrffr.exec:\fxrrffr.exe54⤵
- Executes dropped EXE
PID:580 -
\??\c:\xfllxfl.exec:\xfllxfl.exe55⤵
- Executes dropped EXE
PID:2928 -
\??\c:\tbtbbh.exec:\tbtbbh.exe56⤵
- Executes dropped EXE
PID:2428 -
\??\c:\vvdvd.exec:\vvdvd.exe57⤵
- Executes dropped EXE
PID:2424 -
\??\c:\3rrllrx.exec:\3rrllrx.exe58⤵
- Executes dropped EXE
PID:1148 -
\??\c:\xlrxfll.exec:\xlrxfll.exe59⤵
- Executes dropped EXE
PID:1820 -
\??\c:\nhtbhh.exec:\nhtbhh.exe60⤵
- Executes dropped EXE
PID:2240 -
\??\c:\djppd.exec:\djppd.exe61⤵
- Executes dropped EXE
PID:1804 -
\??\c:\lxrxflf.exec:\lxrxflf.exe62⤵
- Executes dropped EXE
PID:2028 -
\??\c:\5lfrxfl.exec:\5lfrxfl.exe63⤵
- Executes dropped EXE
PID:2140 -
\??\c:\vjpvj.exec:\vjpvj.exe64⤵
- Executes dropped EXE
PID:1548 -
\??\c:\vddvv.exec:\vddvv.exe65⤵
- Executes dropped EXE
PID:2368 -
\??\c:\flxlfrf.exec:\flxlfrf.exe66⤵PID:3020
-
\??\c:\tnbbbh.exec:\tnbbbh.exe67⤵PID:1240
-
\??\c:\djvpd.exec:\djvpd.exe68⤵PID:2336
-
\??\c:\9rffllr.exec:\9rffllr.exe69⤵PID:1572
-
\??\c:\bbhhtt.exec:\bbhhtt.exe70⤵PID:2052
-
\??\c:\5btthh.exec:\5btthh.exe71⤵PID:1904
-
\??\c:\jjjpv.exec:\jjjpv.exe72⤵PID:2448
-
\??\c:\llxrlrr.exec:\llxrlrr.exe73⤵
- System Location Discovery: System Language Discovery
PID:1696 -
\??\c:\nthhnt.exec:\nthhnt.exe74⤵PID:2152
-
\??\c:\vvjpj.exec:\vvjpj.exe75⤵PID:2284
-
\??\c:\ddvdp.exec:\ddvdp.exe76⤵PID:2680
-
\??\c:\9rrfrfl.exec:\9rrfrfl.exe77⤵PID:2544
-
\??\c:\hnhthn.exec:\hnhthn.exe78⤵PID:2572
-
\??\c:\tthbhh.exec:\tthbhh.exe79⤵PID:2764
-
\??\c:\vvddd.exec:\vvddd.exe80⤵PID:2668
-
\??\c:\lxrfxxl.exec:\lxrfxxl.exe81⤵PID:2592
-
\??\c:\xxrrfll.exec:\xxrrfll.exe82⤵PID:2540
-
\??\c:\5bhhhh.exec:\5bhhhh.exe83⤵PID:2992
-
\??\c:\vjvvj.exec:\vjvvj.exe84⤵PID:2512
-
\??\c:\5xrxrxf.exec:\5xrxrxf.exe85⤵PID:2996
-
\??\c:\9rxxllr.exec:\9rxxllr.exe86⤵PID:2604
-
\??\c:\5httnn.exec:\5httnn.exe87⤵PID:1728
-
\??\c:\ppvpp.exec:\ppvpp.exe88⤵PID:1360
-
\??\c:\vdpjp.exec:\vdpjp.exe89⤵PID:2360
-
\??\c:\llxrxfr.exec:\llxrxfr.exe90⤵PID:1944
-
\??\c:\1tbthh.exec:\1tbthh.exe91⤵PID:448
-
\??\c:\ppppp.exec:\ppppp.exe92⤵PID:2508
-
\??\c:\jvddj.exec:\jvddj.exe93⤵PID:264
-
\??\c:\lrffllr.exec:\lrffllr.exe94⤵PID:1856
-
\??\c:\7bhnht.exec:\7bhnht.exe95⤵PID:2988
-
\??\c:\9pdjd.exec:\9pdjd.exe96⤵PID:2516
-
\??\c:\vpddj.exec:\vpddj.exe97⤵PID:2024
-
\??\c:\xxlrflr.exec:\xxlrflr.exe98⤵PID:1896
-
\??\c:\7btnhn.exec:\7btnhn.exe99⤵PID:1784
-
\??\c:\5pdjp.exec:\5pdjp.exe100⤵PID:1312
-
\??\c:\pdpvj.exec:\pdpvj.exe101⤵PID:1632
-
\??\c:\rfxrxfl.exec:\rfxrxfl.exe102⤵PID:1624
-
\??\c:\1tbhtb.exec:\1tbhtb.exe103⤵PID:1876
-
\??\c:\ttbhnt.exec:\ttbhnt.exe104⤵PID:2028
-
\??\c:\vvdjp.exec:\vvdjp.exe105⤵PID:2064
-
\??\c:\lrflrrx.exec:\lrflrrx.exe106⤵PID:2220
-
\??\c:\9hnntt.exec:\9hnntt.exe107⤵PID:2368
-
\??\c:\9nbbhn.exec:\9nbbhn.exe108⤵PID:1492
-
\??\c:\vvjjj.exec:\vvjjj.exe109⤵PID:2020
-
\??\c:\7fxxfxl.exec:\7fxxfxl.exe110⤵PID:2968
-
\??\c:\rlxrxfl.exec:\rlxrxfl.exe111⤵PID:1860
-
\??\c:\5htbnb.exec:\5htbnb.exe112⤵PID:1936
-
\??\c:\3vpvd.exec:\3vpvd.exe113⤵PID:1988
-
\??\c:\lxllxxl.exec:\lxllxxl.exe114⤵PID:1568
-
\??\c:\1rffrrr.exec:\1rffrrr.exe115⤵PID:1684
-
\??\c:\bhthnb.exec:\bhthnb.exe116⤵PID:2892
-
\??\c:\jpvjj.exec:\jpvjj.exe117⤵PID:2776
-
\??\c:\ppvdj.exec:\ppvdj.exe118⤵PID:2924
-
\??\c:\rfllxxf.exec:\rfllxxf.exe119⤵PID:2396
-
\??\c:\nbnhnb.exec:\nbnhnb.exe120⤵PID:2716
-
\??\c:\btnnnn.exec:\btnnnn.exe121⤵PID:2828
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-