Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 09:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ae592a168b5ea08cebf3bb5a17eaaa89369eb300fa4a849a7efb8f7e65a03678.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
ae592a168b5ea08cebf3bb5a17eaaa89369eb300fa4a849a7efb8f7e65a03678.exe
-
Size
454KB
-
MD5
34cd1863be9d6312e65dea806126112d
-
SHA1
8442565f46a1e04be775c81bf36f94e252322619
-
SHA256
ae592a168b5ea08cebf3bb5a17eaaa89369eb300fa4a849a7efb8f7e65a03678
-
SHA512
7e06db0c05569305711c9826bb91eb4fdbe4179b0c5f7261204d77fdf24a430d92d617119d6113060f9ec89f0d8aaf9e3548f72dd4540db6111ca9f1c6ee945a
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbep:q7Tc2NYHUrAwfMp3CDp
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/2092-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2100-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1788-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1224-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2036-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/684-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1652-127-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/588-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1952-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/388-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1768-180-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1952-198-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/1040-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1552-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1552-223-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/976-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2024-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/696-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/548-266-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2096-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-294-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1740-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1224-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/684-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1764-403-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/700-408-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-558-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-569-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2608-626-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-641-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2440-697-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-761-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2648-907-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2152-1006-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1696-1019-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-1068-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1784-1300-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2496-1308-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1860-1362-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/3016-2340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2092 xlxxffr.exe 1788 htnntb.exe 1224 hbntbb.exe 1948 vdppd.exe 2732 dvdjj.exe 2844 tntthn.exe 2968 5pjdj.exe 2688 5lxxxff.exe 2776 pjdpj.exe 2616 rfrlxrr.exe 2036 5bntbb.exe 684 vvvvj.exe 1652 lfxfffr.exe 1964 jdppd.exe 588 dvvvv.exe 2508 1tbttt.exe 388 5vppp.exe 1952 5lxflrf.exe 1768 hbnttt.exe 2912 pjjpj.exe 2300 xlxxxxl.exe 1040 3vppd.exe 2948 lfllxxl.exe 1552 bthhbb.exe 2024 nhnntt.exe 976 jjvvj.exe 696 rfflxfl.exe 2364 djdjv.exe 548 xrfxfxf.exe 2096 hthbbh.exe 2236 dvpvv.exe 2108 fxlrxfl.exe 2392 tnhtbb.exe 1740 pdpjv.exe 1736 1flxxxr.exe 2088 7lflrxl.exe 1224 9nhbtt.exe 2744 5dvdj.exe 2840 3rxxxxf.exe 2736 lrlrxxx.exe 2728 nbbhth.exe 2832 vppvj.exe 2656 pppvj.exe 2604 lfxlxfr.exe 2644 bthntn.exe 2180 pdppd.exe 3068 5dpjj.exe 684 lfrrrrf.exe 1764 bnbbbt.exe 700 bthhnt.exe 2588 vpjjv.exe 552 xrrxllx.exe 2508 rlffrrf.exe 2904 9nttht.exe 1588 djvjv.exe 1644 pdjdj.exe 2900 lfxxlfr.exe 3056 5ttthn.exe 2640 1hbhnt.exe 2076 9jvvd.exe 2228 lfrrffr.exe 1152 xlfxffl.exe 2980 ntnhnn.exe 1784 1jvjp.exe -
resource yara_rule behavioral1/memory/2100-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1788-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1224-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/684-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/588-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/388-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1040-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1552-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/976-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/696-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1224-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/684-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-403-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/700-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-558-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-569-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2608-626-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-697-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-722-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-761-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2648-907-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-950-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-993-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-1019-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-1027-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-1083-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-1167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-1351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-2340-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffllrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrrxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hnhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rxxxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxlxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frllxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2100 wrote to memory of 2092 2100 ae592a168b5ea08cebf3bb5a17eaaa89369eb300fa4a849a7efb8f7e65a03678.exe 30 PID 2100 wrote to memory of 2092 2100 ae592a168b5ea08cebf3bb5a17eaaa89369eb300fa4a849a7efb8f7e65a03678.exe 30 PID 2100 wrote to memory of 2092 2100 ae592a168b5ea08cebf3bb5a17eaaa89369eb300fa4a849a7efb8f7e65a03678.exe 30 PID 2100 wrote to memory of 2092 2100 ae592a168b5ea08cebf3bb5a17eaaa89369eb300fa4a849a7efb8f7e65a03678.exe 30 PID 2092 wrote to memory of 1788 2092 xlxxffr.exe 31 PID 2092 wrote to memory of 1788 2092 xlxxffr.exe 31 PID 2092 wrote to memory of 1788 2092 xlxxffr.exe 31 PID 2092 wrote to memory of 1788 2092 xlxxffr.exe 31 PID 1788 wrote to memory of 1224 1788 htnntb.exe 32 PID 1788 wrote to memory of 1224 1788 htnntb.exe 32 PID 1788 wrote to memory of 1224 1788 htnntb.exe 32 PID 1788 wrote to memory of 1224 1788 htnntb.exe 32 PID 1224 wrote to memory of 1948 1224 hbntbb.exe 33 PID 1224 wrote to memory of 1948 1224 hbntbb.exe 33 PID 1224 wrote to memory of 1948 1224 hbntbb.exe 33 PID 1224 wrote to memory of 1948 1224 hbntbb.exe 33 PID 1948 wrote to memory of 2732 1948 vdppd.exe 34 PID 1948 wrote to memory of 2732 1948 vdppd.exe 34 PID 1948 wrote to memory of 2732 1948 vdppd.exe 34 PID 1948 wrote to memory of 2732 1948 vdppd.exe 34 PID 2732 wrote to memory of 2844 2732 dvdjj.exe 35 PID 2732 wrote to memory of 2844 2732 dvdjj.exe 35 PID 2732 wrote to memory of 2844 2732 dvdjj.exe 35 PID 2732 wrote to memory of 2844 2732 dvdjj.exe 35 PID 2844 wrote to memory of 2968 2844 tntthn.exe 36 PID 2844 wrote to memory of 2968 2844 tntthn.exe 36 PID 2844 wrote to memory of 2968 2844 tntthn.exe 36 PID 2844 wrote to memory of 2968 2844 tntthn.exe 36 PID 2968 wrote to memory of 2688 2968 5pjdj.exe 37 PID 2968 wrote to memory of 2688 2968 5pjdj.exe 37 PID 2968 wrote to memory of 2688 2968 5pjdj.exe 37 PID 2968 wrote to memory of 2688 2968 5pjdj.exe 37 PID 2688 wrote to memory of 2776 2688 5lxxxff.exe 38 PID 2688 wrote to memory of 2776 2688 5lxxxff.exe 38 PID 2688 wrote to memory of 2776 2688 5lxxxff.exe 38 PID 2688 wrote to memory of 2776 2688 5lxxxff.exe 38 PID 2776 wrote to memory of 2616 2776 pjdpj.exe 39 PID 2776 wrote to memory of 2616 2776 pjdpj.exe 39 PID 2776 wrote to memory of 2616 2776 pjdpj.exe 39 PID 2776 wrote to memory of 2616 2776 pjdpj.exe 39 PID 2616 wrote to memory of 2036 2616 rfrlxrr.exe 40 PID 2616 wrote to memory of 2036 2616 rfrlxrr.exe 40 PID 2616 wrote to memory of 2036 2616 rfrlxrr.exe 40 PID 2616 wrote to memory of 2036 2616 rfrlxrr.exe 40 PID 2036 wrote to memory of 684 2036 5bntbb.exe 41 PID 2036 wrote to memory of 684 2036 5bntbb.exe 41 PID 2036 wrote to memory of 684 2036 5bntbb.exe 41 PID 2036 wrote to memory of 684 2036 5bntbb.exe 41 PID 684 wrote to memory of 1652 684 vvvvj.exe 42 PID 684 wrote to memory of 1652 684 vvvvj.exe 42 PID 684 wrote to memory of 1652 684 vvvvj.exe 42 PID 684 wrote to memory of 1652 684 vvvvj.exe 42 PID 1652 wrote to memory of 1964 1652 lfxfffr.exe 43 PID 1652 wrote to memory of 1964 1652 lfxfffr.exe 43 PID 1652 wrote to memory of 1964 1652 lfxfffr.exe 43 PID 1652 wrote to memory of 1964 1652 lfxfffr.exe 43 PID 1964 wrote to memory of 588 1964 jdppd.exe 44 PID 1964 wrote to memory of 588 1964 jdppd.exe 44 PID 1964 wrote to memory of 588 1964 jdppd.exe 44 PID 1964 wrote to memory of 588 1964 jdppd.exe 44 PID 588 wrote to memory of 2508 588 dvvvv.exe 45 PID 588 wrote to memory of 2508 588 dvvvv.exe 45 PID 588 wrote to memory of 2508 588 dvvvv.exe 45 PID 588 wrote to memory of 2508 588 dvvvv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae592a168b5ea08cebf3bb5a17eaaa89369eb300fa4a849a7efb8f7e65a03678.exe"C:\Users\Admin\AppData\Local\Temp\ae592a168b5ea08cebf3bb5a17eaaa89369eb300fa4a849a7efb8f7e65a03678.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\xlxxffr.exec:\xlxxffr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\htnntb.exec:\htnntb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\hbntbb.exec:\hbntbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
\??\c:\vdppd.exec:\vdppd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\dvdjj.exec:\dvdjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\tntthn.exec:\tntthn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\5pjdj.exec:\5pjdj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\5lxxxff.exec:\5lxxxff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\pjdpj.exec:\pjdpj.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\rfrlxrr.exec:\rfrlxrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\5bntbb.exec:\5bntbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\vvvvj.exec:\vvvvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
\??\c:\lfxfffr.exec:\lfxfffr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\jdppd.exec:\jdppd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\dvvvv.exec:\dvvvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:588 -
\??\c:\1tbttt.exec:\1tbttt.exe17⤵
- Executes dropped EXE
PID:2508 -
\??\c:\5vppp.exec:\5vppp.exe18⤵
- Executes dropped EXE
PID:388 -
\??\c:\5lxflrf.exec:\5lxflrf.exe19⤵
- Executes dropped EXE
PID:1952 -
\??\c:\hbnttt.exec:\hbnttt.exe20⤵
- Executes dropped EXE
PID:1768 -
\??\c:\pjjpj.exec:\pjjpj.exe21⤵
- Executes dropped EXE
PID:2912 -
\??\c:\xlxxxxl.exec:\xlxxxxl.exe22⤵
- Executes dropped EXE
PID:2300 -
\??\c:\3vppd.exec:\3vppd.exe23⤵
- Executes dropped EXE
PID:1040 -
\??\c:\lfllxxl.exec:\lfllxxl.exe24⤵
- Executes dropped EXE
PID:2948 -
\??\c:\bthhbb.exec:\bthhbb.exe25⤵
- Executes dropped EXE
PID:1552 -
\??\c:\nhnntt.exec:\nhnntt.exe26⤵
- Executes dropped EXE
PID:2024 -
\??\c:\jjvvj.exec:\jjvvj.exe27⤵
- Executes dropped EXE
PID:976 -
\??\c:\rfflxfl.exec:\rfflxfl.exe28⤵
- Executes dropped EXE
PID:696 -
\??\c:\djdjv.exec:\djdjv.exe29⤵
- Executes dropped EXE
PID:2364 -
\??\c:\xrfxfxf.exec:\xrfxfxf.exe30⤵
- Executes dropped EXE
PID:548 -
\??\c:\hthbbh.exec:\hthbbh.exe31⤵
- Executes dropped EXE
PID:2096 -
\??\c:\dvpvv.exec:\dvpvv.exe32⤵
- Executes dropped EXE
PID:2236 -
\??\c:\fxlrxfl.exec:\fxlrxfl.exe33⤵
- Executes dropped EXE
PID:2108 -
\??\c:\tnhtbb.exec:\tnhtbb.exe34⤵
- Executes dropped EXE
PID:2392 -
\??\c:\pdpjv.exec:\pdpjv.exe35⤵
- Executes dropped EXE
PID:1740 -
\??\c:\1flxxxr.exec:\1flxxxr.exe36⤵
- Executes dropped EXE
PID:1736 -
\??\c:\7lflrxl.exec:\7lflrxl.exe37⤵
- Executes dropped EXE
PID:2088 -
\??\c:\9nhbtt.exec:\9nhbtt.exe38⤵
- Executes dropped EXE
PID:1224 -
\??\c:\5dvdj.exec:\5dvdj.exe39⤵
- Executes dropped EXE
PID:2744 -
\??\c:\3rxxxxf.exec:\3rxxxxf.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2840 -
\??\c:\lrlrxxx.exec:\lrlrxxx.exe41⤵
- Executes dropped EXE
PID:2736 -
\??\c:\nbbhth.exec:\nbbhth.exe42⤵
- Executes dropped EXE
PID:2728 -
\??\c:\vppvj.exec:\vppvj.exe43⤵
- Executes dropped EXE
PID:2832 -
\??\c:\pppvj.exec:\pppvj.exe44⤵
- Executes dropped EXE
PID:2656 -
\??\c:\lfxlxfr.exec:\lfxlxfr.exe45⤵
- Executes dropped EXE
PID:2604 -
\??\c:\bthntn.exec:\bthntn.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2644 -
\??\c:\pdppd.exec:\pdppd.exe47⤵
- Executes dropped EXE
PID:2180 -
\??\c:\5dpjj.exec:\5dpjj.exe48⤵
- Executes dropped EXE
PID:3068 -
\??\c:\lfrrrrf.exec:\lfrrrrf.exe49⤵
- Executes dropped EXE
PID:684 -
\??\c:\bnbbbt.exec:\bnbbbt.exe50⤵
- Executes dropped EXE
PID:1764 -
\??\c:\bthhnt.exec:\bthhnt.exe51⤵
- Executes dropped EXE
PID:700 -
\??\c:\vpjjv.exec:\vpjjv.exe52⤵
- Executes dropped EXE
PID:2588 -
\??\c:\xrrxllx.exec:\xrrxllx.exe53⤵
- Executes dropped EXE
PID:552 -
\??\c:\rlffrrf.exec:\rlffrrf.exe54⤵
- Executes dropped EXE
PID:2508 -
\??\c:\9nttht.exec:\9nttht.exe55⤵
- Executes dropped EXE
PID:2904 -
\??\c:\djvjv.exec:\djvjv.exe56⤵
- Executes dropped EXE
PID:1588 -
\??\c:\pdjdj.exec:\pdjdj.exe57⤵
- Executes dropped EXE
PID:1644 -
\??\c:\lfxxlfr.exec:\lfxxlfr.exe58⤵
- Executes dropped EXE
PID:2900 -
\??\c:\5ttthn.exec:\5ttthn.exe59⤵
- Executes dropped EXE
PID:3056 -
\??\c:\1hbhnt.exec:\1hbhnt.exe60⤵
- Executes dropped EXE
PID:2640 -
\??\c:\9jvvd.exec:\9jvvd.exe61⤵
- Executes dropped EXE
PID:2076 -
\??\c:\lfrrffr.exec:\lfrrffr.exe62⤵
- Executes dropped EXE
PID:2228 -
\??\c:\xlfxffl.exec:\xlfxffl.exe63⤵
- Executes dropped EXE
PID:1152 -
\??\c:\ntnhnn.exec:\ntnhnn.exe64⤵
- Executes dropped EXE
PID:2980 -
\??\c:\1jvjp.exec:\1jvjp.exe65⤵
- Executes dropped EXE
PID:1784 -
\??\c:\9vjjv.exec:\9vjjv.exe66⤵PID:2024
-
\??\c:\lrfxffx.exec:\lrfxffx.exe67⤵PID:780
-
\??\c:\7ttthh.exec:\7ttthh.exe68⤵PID:2420
-
\??\c:\jdppd.exec:\jdppd.exe69⤵PID:1680
-
\??\c:\fxrfrxl.exec:\fxrfrxl.exe70⤵PID:2364
-
\??\c:\rrfllrf.exec:\rrfllrf.exe71⤵PID:3036
-
\??\c:\hbtnbb.exec:\hbtnbb.exe72⤵PID:1520
-
\??\c:\vjdjv.exec:\vjdjv.exe73⤵PID:2416
-
\??\c:\ppdpj.exec:\ppdpj.exe74⤵PID:2236
-
\??\c:\xflxxrx.exec:\xflxxrx.exe75⤵PID:2536
-
\??\c:\bbtbht.exec:\bbtbht.exe76⤵PID:2380
-
\??\c:\nnbntb.exec:\nnbntb.exe77⤵PID:2544
-
\??\c:\jdvdv.exec:\jdvdv.exe78⤵PID:2336
-
\??\c:\fxfffff.exec:\fxfffff.exe79⤵PID:2692
-
\??\c:\1bnntt.exec:\1bnntt.exe80⤵PID:2464
-
\??\c:\nbnttt.exec:\nbnttt.exe81⤵PID:2812
-
\??\c:\dvjpd.exec:\dvjpd.exe82⤵PID:2756
-
\??\c:\djjjp.exec:\djjjp.exe83⤵PID:2840
-
\??\c:\rxfllfl.exec:\rxfllfl.exe84⤵PID:2824
-
\??\c:\5bbbbh.exec:\5bbbbh.exe85⤵PID:2608
-
\??\c:\vjppp.exec:\vjppp.exe86⤵PID:2716
-
\??\c:\pjvjv.exec:\pjvjv.exe87⤵PID:2600
-
\??\c:\llffllf.exec:\llffllf.exe88⤵PID:2612
-
\??\c:\5tnntb.exec:\5tnntb.exe89⤵PID:2664
-
\??\c:\pdppd.exec:\pdppd.exe90⤵PID:1572
-
\??\c:\1jpdd.exec:\1jpdd.exe91⤵PID:3068
-
\??\c:\xllfflr.exec:\xllfflr.exe92⤵PID:684
-
\??\c:\lfxrxrf.exec:\lfxrxrf.exe93⤵PID:1976
-
\??\c:\hbtbnn.exec:\hbtbnn.exe94⤵PID:2884
-
\??\c:\pjdjp.exec:\pjdjp.exe95⤵PID:1496
-
\??\c:\jdvvv.exec:\jdvvv.exe96⤵PID:600
-
\??\c:\1ffflrr.exec:\1ffflrr.exe97⤵PID:2440
-
\??\c:\bthhhn.exec:\bthhhn.exe98⤵PID:1640
-
\??\c:\3nhhnn.exec:\3nhhnn.exe99⤵PID:2176
-
\??\c:\ddvpv.exec:\ddvpv.exe100⤵PID:1916
-
\??\c:\rlxxxxx.exec:\rlxxxxx.exe101⤵PID:2220
-
\??\c:\rlxxllx.exec:\rlxxllx.exe102⤵PID:2152
-
\??\c:\btbhtb.exec:\btbhtb.exe103⤵PID:1404
-
\??\c:\5vjjj.exec:\5vjjj.exe104⤵PID:1796
-
\??\c:\dpjdj.exec:\dpjdj.exe105⤵PID:444
-
\??\c:\3xrllll.exec:\3xrllll.exe106⤵PID:2948
-
\??\c:\hhbhbh.exec:\hhbhbh.exe107⤵PID:2996
-
\??\c:\ttnhtt.exec:\ttnhtt.exe108⤵PID:1324
-
\??\c:\vpdvj.exec:\vpdvj.exe109⤵PID:1932
-
\??\c:\xrrlrfx.exec:\xrrlrfx.exe110⤵PID:3016
-
\??\c:\xrxfllf.exec:\xrxfllf.exe111⤵PID:2312
-
\??\c:\bhnntt.exec:\bhnntt.exe112⤵PID:2080
-
\??\c:\vpjpj.exec:\vpjpj.exe113⤵PID:2472
-
\??\c:\xxrrrxf.exec:\xxrrrxf.exe114⤵PID:2396
-
\??\c:\fxllflx.exec:\fxllflx.exe115⤵PID:2096
-
\??\c:\5nhnbb.exec:\5nhnbb.exe116⤵PID:2100
-
\??\c:\jpvdj.exec:\jpvdj.exe117⤵PID:1724
-
\??\c:\dvjjp.exec:\dvjjp.exe118⤵PID:1860
-
\??\c:\frfxlfl.exec:\frfxlfl.exe119⤵PID:2552
-
\??\c:\rfxxxfl.exec:\rfxxxfl.exe120⤵PID:2380
-
\??\c:\hthhhh.exec:\hthhhh.exe121⤵PID:1736
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-