Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20/01/2025, 09:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8eed249cfb7093b869805dc0e6c6eb1290c16631ae41440cdc1dae123ced76bc.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
8eed249cfb7093b869805dc0e6c6eb1290c16631ae41440cdc1dae123ced76bc.exe
-
Size
455KB
-
MD5
3a6445c088f2d5d87925f640cb99bb12
-
SHA1
a7c56bab2d798e279bc3a8a72c0e62e1cb1de473
-
SHA256
8eed249cfb7093b869805dc0e6c6eb1290c16631ae41440cdc1dae123ced76bc
-
SHA512
a5028434e5b07b6e85bfc6d71135f19a691279b8223b1bce97f6e7b6f6663cab2a43fcdda54d2baa776245cbbcd9ab1afdb7b269389717be82f3a899636b0d3c
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeq:q7Tc2NYHUrAwfMp3CDq
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 52 IoCs
resource yara_rule behavioral1/memory/2688-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/536-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1896-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1896-27-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2872-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-55-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2732-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1928-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-86-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1548-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1548-109-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2948-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-130-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2816-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1660-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-193-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2588-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1980-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/320-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/320-213-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/320-211-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2468-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/572-256-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2492-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1488-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1488-271-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3052-284-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2184-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1580-310-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2888-324-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2888-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2328-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-352-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2652-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1036-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1196-428-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-527-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-583-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2436-752-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-795-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/536-1109-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2864-1114-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1580-1123-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1928-1145-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2936-1217-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2184 bbbhbb.exe 1896 pdjjp.exe 536 7pjvv.exe 2872 rlxxffl.exe 2732 tnhntb.exe 2972 rxrxfll.exe 1928 ppvvj.exe 2604 7xrfffr.exe 1176 vvvvj.exe 1108 lrrffrx.exe 1548 vvpjv.exe 2948 flrfxff.exe 2816 jjvpj.exe 2348 xrfxffl.exe 2928 vpjpv.exe 1744 ppjpd.exe 3028 jjvdj.exe 3020 dvdpp.exe 1660 nhbhnb.exe 2588 dvjpd.exe 1980 1tntbh.exe 320 7jpdj.exe 268 9rlxffl.exe 1868 btbbnt.exe 1532 hhbhbh.exe 2468 5vjvj.exe 572 hnntnb.exe 2492 pvpvj.exe 1488 bbtbtt.exe 3052 7djjd.exe 2124 nnhnnt.exe 2184 3jdjv.exe 1580 5hhtbh.exe 1896 9vjdj.exe 2888 rxrlfrl.exe 2860 hbtbhh.exe 2328 5pppv.exe 2636 rrlrlrf.exe 2968 btbbtt.exe 2780 jjpdp.exe 2652 5vpvv.exe 2604 rffrlrl.exe 1036 hhthtt.exe 776 pjdvd.exe 2844 llllrrf.exe 3024 lfrrfxf.exe 2836 hbhtbh.exe 2840 dpjjv.exe 2984 ffxlxfl.exe 2944 ffrlrxl.exe 1196 3nnbtt.exe 1860 dvpvp.exe 1744 lfrxflx.exe 1760 rlxxllr.exe 2060 btnbtb.exe 1140 pjjvj.exe 2232 7ffxxrx.exe 1368 7tttbn.exe 1292 ttnbbh.exe 1808 ppjjp.exe 320 9rlrxlr.exe 668 rrlrflf.exe 604 bbtbnb.exe 1868 ppjvj.exe -
resource yara_rule behavioral1/memory/2184-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/536-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1896-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1928-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1548-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/320-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/572-256-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2492-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1488-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-284-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2184-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-324-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2888-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1036-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1196-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-527-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1756-546-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-583-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-602-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1888-634-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-683-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/952-727-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-752-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1992-759-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-795-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1904-827-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1564-1018-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-1124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-1370-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfrlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrrxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7btbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbntnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrxfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxxlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlrlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2688 wrote to memory of 2184 2688 8eed249cfb7093b869805dc0e6c6eb1290c16631ae41440cdc1dae123ced76bc.exe 31 PID 2688 wrote to memory of 2184 2688 8eed249cfb7093b869805dc0e6c6eb1290c16631ae41440cdc1dae123ced76bc.exe 31 PID 2688 wrote to memory of 2184 2688 8eed249cfb7093b869805dc0e6c6eb1290c16631ae41440cdc1dae123ced76bc.exe 31 PID 2688 wrote to memory of 2184 2688 8eed249cfb7093b869805dc0e6c6eb1290c16631ae41440cdc1dae123ced76bc.exe 31 PID 2184 wrote to memory of 1896 2184 bbbhbb.exe 32 PID 2184 wrote to memory of 1896 2184 bbbhbb.exe 32 PID 2184 wrote to memory of 1896 2184 bbbhbb.exe 32 PID 2184 wrote to memory of 1896 2184 bbbhbb.exe 32 PID 1896 wrote to memory of 536 1896 pdjjp.exe 33 PID 1896 wrote to memory of 536 1896 pdjjp.exe 33 PID 1896 wrote to memory of 536 1896 pdjjp.exe 33 PID 1896 wrote to memory of 536 1896 pdjjp.exe 33 PID 536 wrote to memory of 2872 536 7pjvv.exe 34 PID 536 wrote to memory of 2872 536 7pjvv.exe 34 PID 536 wrote to memory of 2872 536 7pjvv.exe 34 PID 536 wrote to memory of 2872 536 7pjvv.exe 34 PID 2872 wrote to memory of 2732 2872 rlxxffl.exe 35 PID 2872 wrote to memory of 2732 2872 rlxxffl.exe 35 PID 2872 wrote to memory of 2732 2872 rlxxffl.exe 35 PID 2872 wrote to memory of 2732 2872 rlxxffl.exe 35 PID 2732 wrote to memory of 2972 2732 tnhntb.exe 36 PID 2732 wrote to memory of 2972 2732 tnhntb.exe 36 PID 2732 wrote to memory of 2972 2732 tnhntb.exe 36 PID 2732 wrote to memory of 2972 2732 tnhntb.exe 36 PID 2972 wrote to memory of 1928 2972 rxrxfll.exe 37 PID 2972 wrote to memory of 1928 2972 rxrxfll.exe 37 PID 2972 wrote to memory of 1928 2972 rxrxfll.exe 37 PID 2972 wrote to memory of 1928 2972 rxrxfll.exe 37 PID 1928 wrote to memory of 2604 1928 ppvvj.exe 38 PID 1928 wrote to memory of 2604 1928 ppvvj.exe 38 PID 1928 wrote to memory of 2604 1928 ppvvj.exe 38 PID 1928 wrote to memory of 2604 1928 ppvvj.exe 38 PID 2604 wrote to memory of 1176 2604 7xrfffr.exe 39 PID 2604 wrote to memory of 1176 2604 7xrfffr.exe 39 PID 2604 wrote to memory of 1176 2604 7xrfffr.exe 39 PID 2604 wrote to memory of 1176 2604 7xrfffr.exe 39 PID 1176 wrote to memory of 1108 1176 vvvvj.exe 40 PID 1176 wrote to memory of 1108 1176 vvvvj.exe 40 PID 1176 wrote to memory of 1108 1176 vvvvj.exe 40 PID 1176 wrote to memory of 1108 1176 vvvvj.exe 40 PID 1108 wrote to memory of 1548 1108 lrrffrx.exe 41 PID 1108 wrote to memory of 1548 1108 lrrffrx.exe 41 PID 1108 wrote to memory of 1548 1108 lrrffrx.exe 41 PID 1108 wrote to memory of 1548 1108 lrrffrx.exe 41 PID 1548 wrote to memory of 2948 1548 vvpjv.exe 42 PID 1548 wrote to memory of 2948 1548 vvpjv.exe 42 PID 1548 wrote to memory of 2948 1548 vvpjv.exe 42 PID 1548 wrote to memory of 2948 1548 vvpjv.exe 42 PID 2948 wrote to memory of 2816 2948 flrfxff.exe 43 PID 2948 wrote to memory of 2816 2948 flrfxff.exe 43 PID 2948 wrote to memory of 2816 2948 flrfxff.exe 43 PID 2948 wrote to memory of 2816 2948 flrfxff.exe 43 PID 2816 wrote to memory of 2348 2816 jjvpj.exe 44 PID 2816 wrote to memory of 2348 2816 jjvpj.exe 44 PID 2816 wrote to memory of 2348 2816 jjvpj.exe 44 PID 2816 wrote to memory of 2348 2816 jjvpj.exe 44 PID 2348 wrote to memory of 2928 2348 xrfxffl.exe 45 PID 2348 wrote to memory of 2928 2348 xrfxffl.exe 45 PID 2348 wrote to memory of 2928 2348 xrfxffl.exe 45 PID 2348 wrote to memory of 2928 2348 xrfxffl.exe 45 PID 2928 wrote to memory of 1744 2928 vpjpv.exe 46 PID 2928 wrote to memory of 1744 2928 vpjpv.exe 46 PID 2928 wrote to memory of 1744 2928 vpjpv.exe 46 PID 2928 wrote to memory of 1744 2928 vpjpv.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\8eed249cfb7093b869805dc0e6c6eb1290c16631ae41440cdc1dae123ced76bc.exe"C:\Users\Admin\AppData\Local\Temp\8eed249cfb7093b869805dc0e6c6eb1290c16631ae41440cdc1dae123ced76bc.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\bbbhbb.exec:\bbbhbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\pdjjp.exec:\pdjjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
\??\c:\7pjvv.exec:\7pjvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\rlxxffl.exec:\rlxxffl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\tnhntb.exec:\tnhntb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\rxrxfll.exec:\rxrxfll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\ppvvj.exec:\ppvvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\7xrfffr.exec:\7xrfffr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\vvvvj.exec:\vvvvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
\??\c:\lrrffrx.exec:\lrrffrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
\??\c:\vvpjv.exec:\vvpjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\flrfxff.exec:\flrfxff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\jjvpj.exec:\jjvpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\xrfxffl.exec:\xrfxffl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\vpjpv.exec:\vpjpv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\ppjpd.exec:\ppjpd.exe17⤵
- Executes dropped EXE
PID:1744 -
\??\c:\jjvdj.exec:\jjvdj.exe18⤵
- Executes dropped EXE
PID:3028 -
\??\c:\dvdpp.exec:\dvdpp.exe19⤵
- Executes dropped EXE
PID:3020 -
\??\c:\nhbhnb.exec:\nhbhnb.exe20⤵
- Executes dropped EXE
PID:1660 -
\??\c:\dvjpd.exec:\dvjpd.exe21⤵
- Executes dropped EXE
PID:2588 -
\??\c:\1tntbh.exec:\1tntbh.exe22⤵
- Executes dropped EXE
PID:1980 -
\??\c:\7jpdj.exec:\7jpdj.exe23⤵
- Executes dropped EXE
PID:320 -
\??\c:\9rlxffl.exec:\9rlxffl.exe24⤵
- Executes dropped EXE
PID:268 -
\??\c:\btbbnt.exec:\btbbnt.exe25⤵
- Executes dropped EXE
PID:1868 -
\??\c:\hhbhbh.exec:\hhbhbh.exe26⤵
- Executes dropped EXE
PID:1532 -
\??\c:\5vjvj.exec:\5vjvj.exe27⤵
- Executes dropped EXE
PID:2468 -
\??\c:\hnntnb.exec:\hnntnb.exe28⤵
- Executes dropped EXE
PID:572 -
\??\c:\pvpvj.exec:\pvpvj.exe29⤵
- Executes dropped EXE
PID:2492 -
\??\c:\bbtbtt.exec:\bbtbtt.exe30⤵
- Executes dropped EXE
PID:1488 -
\??\c:\7djjd.exec:\7djjd.exe31⤵
- Executes dropped EXE
PID:3052 -
\??\c:\nnhnnt.exec:\nnhnnt.exe32⤵
- Executes dropped EXE
PID:2124 -
\??\c:\3jdjv.exec:\3jdjv.exe33⤵
- Executes dropped EXE
PID:2184 -
\??\c:\5hhtbh.exec:\5hhtbh.exe34⤵
- Executes dropped EXE
PID:1580 -
\??\c:\9vjdj.exec:\9vjdj.exe35⤵
- Executes dropped EXE
PID:1896 -
\??\c:\rxrlfrl.exec:\rxrlfrl.exe36⤵
- Executes dropped EXE
PID:2888 -
\??\c:\hbtbhh.exec:\hbtbhh.exe37⤵
- Executes dropped EXE
PID:2860 -
\??\c:\5pppv.exec:\5pppv.exe38⤵
- Executes dropped EXE
PID:2328 -
\??\c:\rrlrlrf.exec:\rrlrlrf.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2636 -
\??\c:\btbbtt.exec:\btbbtt.exe40⤵
- Executes dropped EXE
PID:2968 -
\??\c:\jjpdp.exec:\jjpdp.exe41⤵
- Executes dropped EXE
PID:2780 -
\??\c:\5vpvv.exec:\5vpvv.exe42⤵
- Executes dropped EXE
PID:2652 -
\??\c:\rffrlrl.exec:\rffrlrl.exe43⤵
- Executes dropped EXE
PID:2604 -
\??\c:\hhthtt.exec:\hhthtt.exe44⤵
- Executes dropped EXE
PID:1036 -
\??\c:\pjdvd.exec:\pjdvd.exe45⤵
- Executes dropped EXE
PID:776 -
\??\c:\llllrrf.exec:\llllrrf.exe46⤵
- Executes dropped EXE
PID:2844 -
\??\c:\lfrrfxf.exec:\lfrrfxf.exe47⤵
- Executes dropped EXE
PID:3024 -
\??\c:\hbhtbh.exec:\hbhtbh.exe48⤵
- Executes dropped EXE
PID:2836 -
\??\c:\dpjjv.exec:\dpjjv.exe49⤵
- Executes dropped EXE
PID:2840 -
\??\c:\ffxlxfl.exec:\ffxlxfl.exe50⤵
- Executes dropped EXE
PID:2984 -
\??\c:\ffrlrxl.exec:\ffrlrxl.exe51⤵
- Executes dropped EXE
PID:2944 -
\??\c:\3nnbtt.exec:\3nnbtt.exe52⤵
- Executes dropped EXE
PID:1196 -
\??\c:\dvpvp.exec:\dvpvp.exe53⤵
- Executes dropped EXE
PID:1860 -
\??\c:\lfrxflx.exec:\lfrxflx.exe54⤵
- Executes dropped EXE
PID:1744 -
\??\c:\rlxxllr.exec:\rlxxllr.exe55⤵
- Executes dropped EXE
PID:1760 -
\??\c:\btnbtb.exec:\btnbtb.exe56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2060 -
\??\c:\pjjvj.exec:\pjjvj.exe57⤵
- Executes dropped EXE
PID:1140 -
\??\c:\7ffxxrx.exec:\7ffxxrx.exe58⤵
- Executes dropped EXE
PID:2232 -
\??\c:\7tttbn.exec:\7tttbn.exe59⤵
- Executes dropped EXE
PID:1368 -
\??\c:\ttnbbh.exec:\ttnbbh.exe60⤵
- Executes dropped EXE
PID:1292 -
\??\c:\ppjjp.exec:\ppjjp.exe61⤵
- Executes dropped EXE
PID:1808 -
\??\c:\9rlrxlr.exec:\9rlrxlr.exe62⤵
- Executes dropped EXE
PID:320 -
\??\c:\rrlrflf.exec:\rrlrflf.exe63⤵
- Executes dropped EXE
PID:668 -
\??\c:\bbtbnb.exec:\bbtbnb.exe64⤵
- Executes dropped EXE
PID:604 -
\??\c:\ppjvj.exec:\ppjvj.exe65⤵
- Executes dropped EXE
PID:1868 -
\??\c:\rlxlfrx.exec:\rlxlfrx.exe66⤵PID:2500
-
\??\c:\ffxfrfx.exec:\ffxfrfx.exe67⤵PID:2356
-
\??\c:\hbthtt.exec:\hbthtt.exe68⤵PID:2488
-
\??\c:\3ddpj.exec:\3ddpj.exe69⤵PID:2056
-
\??\c:\xrflxlr.exec:\xrflxlr.exe70⤵PID:1680
-
\??\c:\rxxlflx.exec:\rxxlflx.exe71⤵PID:1676
-
\??\c:\hhbhtb.exec:\hhbhtb.exe72⤵PID:1756
-
\??\c:\3ppdv.exec:\3ppdv.exe73⤵PID:2428
-
\??\c:\pvpjv.exec:\pvpjv.exe74⤵PID:3044
-
\??\c:\5frrrxx.exec:\5frrrxx.exe75⤵PID:1596
-
\??\c:\9nntbh.exec:\9nntbh.exe76⤵PID:2180
-
\??\c:\djjdd.exec:\djjdd.exe77⤵PID:2712
-
\??\c:\1pjpd.exec:\1pjpd.exe78⤵PID:2760
-
\??\c:\rrfflrx.exec:\rrfflrx.exe79⤵PID:3068
-
\??\c:\htbbhh.exec:\htbbhh.exe80⤵PID:2876
-
\??\c:\ttnbnb.exec:\ttnbnb.exe81⤵PID:3056
-
\??\c:\dpjjp.exec:\dpjjp.exe82⤵PID:2740
-
\??\c:\llrxfxf.exec:\llrxfxf.exe83⤵
- System Location Discovery: System Language Discovery
PID:2608 -
\??\c:\nhtthh.exec:\nhtthh.exe84⤵PID:2640
-
\??\c:\djdvd.exec:\djdvd.exe85⤵PID:380
-
\??\c:\xrlrflr.exec:\xrlrflr.exe86⤵PID:1888
-
\??\c:\ffrlfll.exec:\ffrlfll.exe87⤵PID:980
-
\??\c:\bthnhn.exec:\bthnhn.exe88⤵PID:2940
-
\??\c:\1pjpj.exec:\1pjpj.exe89⤵PID:1548
-
\??\c:\xxrflrl.exec:\xxrflrl.exe90⤵PID:2828
-
\??\c:\lfxxfxl.exec:\lfxxfxl.exe91⤵PID:2916
-
\??\c:\tntttb.exec:\tntttb.exe92⤵PID:3016
-
\??\c:\jvjjv.exec:\jvjjv.exe93⤵PID:2216
-
\??\c:\ffxrffx.exec:\ffxrffx.exe94⤵PID:2036
-
\??\c:\7lfflrl.exec:\7lfflrl.exe95⤵PID:1244
-
\??\c:\tbtnbn.exec:\tbtnbn.exe96⤵PID:2460
-
\??\c:\7vpdd.exec:\7vpdd.exe97⤵PID:2648
-
\??\c:\1pvdj.exec:\1pvdj.exe98⤵PID:2288
-
\??\c:\5rfflfl.exec:\5rfflfl.exe99⤵PID:448
-
\??\c:\tnbbhn.exec:\tnbbhn.exe100⤵PID:2244
-
\??\c:\vjddp.exec:\vjddp.exe101⤵PID:952
-
\??\c:\xrxrxxl.exec:\xrxrxxl.exe102⤵PID:2208
-
\??\c:\rxrxffr.exec:\rxrxffr.exe103⤵PID:2412
-
\??\c:\3btthn.exec:\3btthn.exe104⤵PID:2436
-
\??\c:\jjpvd.exec:\jjpvd.exe105⤵PID:1672
-
\??\c:\vdjpp.exec:\vdjpp.exe106⤵
- System Location Discovery: System Language Discovery
PID:1992 -
\??\c:\lfxllxf.exec:\lfxllxf.exe107⤵PID:604
-
\??\c:\5ntttt.exec:\5ntttt.exe108⤵PID:2452
-
\??\c:\nnbnbb.exec:\nnbnbb.exe109⤵PID:1532
-
\??\c:\pjdjv.exec:\pjdjv.exe110⤵PID:2476
-
\??\c:\ffflxfr.exec:\ffflxfr.exe111⤵PID:2252
-
\??\c:\lfrxflr.exec:\lfrxflr.exe112⤵PID:1948
-
\??\c:\nhbhth.exec:\nhbhth.exe113⤵PID:2492
-
\??\c:\ffxlflx.exec:\ffxlflx.exe114⤵PID:2136
-
\??\c:\ttnntb.exec:\ttnntb.exe115⤵PID:3052
-
\??\c:\9jvjp.exec:\9jvjp.exe116⤵PID:2804
-
\??\c:\pjddj.exec:\pjddj.exe117⤵PID:1904
-
\??\c:\5fxxfff.exec:\5fxxfff.exe118⤵PID:2008
-
\??\c:\9tnhbt.exec:\9tnhbt.exe119⤵PID:2464
-
\??\c:\9jvvp.exec:\9jvvp.exe120⤵PID:2756
-
\??\c:\frffflf.exec:\frffflf.exe121⤵PID:2760
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-