Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20/01/2025, 09:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
af78e48fef3a8e61bcaa9572c96bb9b26349dd3ff2de2c75e02de817198c5078.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
af78e48fef3a8e61bcaa9572c96bb9b26349dd3ff2de2c75e02de817198c5078.exe
-
Size
455KB
-
MD5
503b529a3e435e72201e90abd74f3650
-
SHA1
04b4b0ecc574d9d1bb299b049746515eb37f7510
-
SHA256
af78e48fef3a8e61bcaa9572c96bb9b26349dd3ff2de2c75e02de817198c5078
-
SHA512
efc2e6eaeb496513ebaa1ca31936274546be1454637e0060368f004a62e57f9001c943b56353f1c60b92e92b6e0fea531101f4962ebe6a3a0c37e0538540e8e9
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeJB:q7Tc2NYHUrAwfMp3CDJB
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 54 IoCs
resource yara_rule behavioral1/memory/2504-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2144-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1792-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-48-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2164-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-77-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2696-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/648-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/648-134-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2000-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1860-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1692-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1464-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1312-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1312-171-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1268-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-190-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2448-199-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2200-209-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2200-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1456-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1304-269-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1848-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1588-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2152-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2024-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1160-401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2420-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1428-429-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1652-436-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1312-450-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2104-525-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2028-572-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/756-579-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1792-586-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/2548-594-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2132-612-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2804-620-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/3028-658-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1492-677-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1820-691-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2040-698-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/840-718-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/472-784-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2152-873-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2544 nnhnbh.exe 2144 fxrxfff.exe 1792 3httnn.exe 2924 jdvjp.exe 2164 9hbtbb.exe 2812 5pjvd.exe 2704 frrxxlr.exe 2696 fxlllll.exe 2604 jpvvv.exe 2636 xlllfff.exe 2656 vjppp.exe 2000 vvpdd.exe 648 lrxlxrr.exe 1860 9bbbhb.exe 1464 jvdvv.exe 1692 lxlllfl.exe 1312 hnbbbb.exe 1268 xlrxfxx.exe 2832 thhhnh.exe 2448 thtthh.exe 2200 1flffxf.exe 788 bhhttt.exe 1608 dpdjj.exe 1456 bbnhnb.exe 2900 jddpj.exe 2100 5rfrrll.exe 1448 5thbbt.exe 1304 5vvpp.exe 1848 ddppp.exe 1500 5lxlrrx.exe 1516 tnhttt.exe 1588 pppdd.exe 2348 llfxrll.exe 2136 nbhhtb.exe 2220 jdppd.exe 2152 xrxflfr.exe 592 rlflxxx.exe 2952 pdpjp.exe 2796 xlxxffl.exe 2876 rlxfxrf.exe 2732 9bhbhb.exe 3032 pdpjj.exe 2024 lxrfrrr.exe 2748 3btthh.exe 2596 bnbthh.exe 3024 jvdvv.exe 1160 3rrrrll.exe 1684 bhnttn.exe 2420 dddjj.exe 1796 fxxxfxf.exe 1428 lflxxrx.exe 1652 hbnntt.exe 1692 dpvpv.exe 1312 xxxflrl.exe 2844 9btbtt.exe 2188 9vjjj.exe 2992 9dvpj.exe 2448 xlrrrxx.exe 2176 htbhhn.exe 444 9nbtnn.exe 1816 pjvdd.exe 1600 fxrrrll.exe 564 frllrrx.exe 776 hbnnnt.exe -
resource yara_rule behavioral1/memory/2504-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/648-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1860-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1860-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1464-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1312-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1268-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1456-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1448-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1848-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1588-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1160-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1428-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1448-526-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-533-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-587-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1492-677-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-684-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/840-718-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-743-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/472-784-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2320-860-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-873-0x00000000002B0000-0x00000000002DA000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9thnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxlxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflffxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bhhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrllff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllfxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7fffxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frllrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdpv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2504 wrote to memory of 2544 2504 af78e48fef3a8e61bcaa9572c96bb9b26349dd3ff2de2c75e02de817198c5078.exe 30 PID 2504 wrote to memory of 2544 2504 af78e48fef3a8e61bcaa9572c96bb9b26349dd3ff2de2c75e02de817198c5078.exe 30 PID 2504 wrote to memory of 2544 2504 af78e48fef3a8e61bcaa9572c96bb9b26349dd3ff2de2c75e02de817198c5078.exe 30 PID 2504 wrote to memory of 2544 2504 af78e48fef3a8e61bcaa9572c96bb9b26349dd3ff2de2c75e02de817198c5078.exe 30 PID 2544 wrote to memory of 2144 2544 nnhnbh.exe 31 PID 2544 wrote to memory of 2144 2544 nnhnbh.exe 31 PID 2544 wrote to memory of 2144 2544 nnhnbh.exe 31 PID 2544 wrote to memory of 2144 2544 nnhnbh.exe 31 PID 2144 wrote to memory of 1792 2144 fxrxfff.exe 32 PID 2144 wrote to memory of 1792 2144 fxrxfff.exe 32 PID 2144 wrote to memory of 1792 2144 fxrxfff.exe 32 PID 2144 wrote to memory of 1792 2144 fxrxfff.exe 32 PID 1792 wrote to memory of 2924 1792 3httnn.exe 33 PID 1792 wrote to memory of 2924 1792 3httnn.exe 33 PID 1792 wrote to memory of 2924 1792 3httnn.exe 33 PID 1792 wrote to memory of 2924 1792 3httnn.exe 33 PID 2924 wrote to memory of 2164 2924 jdvjp.exe 34 PID 2924 wrote to memory of 2164 2924 jdvjp.exe 34 PID 2924 wrote to memory of 2164 2924 jdvjp.exe 34 PID 2924 wrote to memory of 2164 2924 jdvjp.exe 34 PID 2164 wrote to memory of 2812 2164 9hbtbb.exe 35 PID 2164 wrote to memory of 2812 2164 9hbtbb.exe 35 PID 2164 wrote to memory of 2812 2164 9hbtbb.exe 35 PID 2164 wrote to memory of 2812 2164 9hbtbb.exe 35 PID 2812 wrote to memory of 2704 2812 5pjvd.exe 36 PID 2812 wrote to memory of 2704 2812 5pjvd.exe 36 PID 2812 wrote to memory of 2704 2812 5pjvd.exe 36 PID 2812 wrote to memory of 2704 2812 5pjvd.exe 36 PID 2704 wrote to memory of 2696 2704 frrxxlr.exe 37 PID 2704 wrote to memory of 2696 2704 frrxxlr.exe 37 PID 2704 wrote to memory of 2696 2704 frrxxlr.exe 37 PID 2704 wrote to memory of 2696 2704 frrxxlr.exe 37 PID 2696 wrote to memory of 2604 2696 fxlllll.exe 38 PID 2696 wrote to memory of 2604 2696 fxlllll.exe 38 PID 2696 wrote to memory of 2604 2696 fxlllll.exe 38 PID 2696 wrote to memory of 2604 2696 fxlllll.exe 38 PID 2604 wrote to memory of 2636 2604 jpvvv.exe 39 PID 2604 wrote to memory of 2636 2604 jpvvv.exe 39 PID 2604 wrote to memory of 2636 2604 jpvvv.exe 39 PID 2604 wrote to memory of 2636 2604 jpvvv.exe 39 PID 2636 wrote to memory of 2656 2636 xlllfff.exe 40 PID 2636 wrote to memory of 2656 2636 xlllfff.exe 40 PID 2636 wrote to memory of 2656 2636 xlllfff.exe 40 PID 2636 wrote to memory of 2656 2636 xlllfff.exe 40 PID 2656 wrote to memory of 2000 2656 vjppp.exe 41 PID 2656 wrote to memory of 2000 2656 vjppp.exe 41 PID 2656 wrote to memory of 2000 2656 vjppp.exe 41 PID 2656 wrote to memory of 2000 2656 vjppp.exe 41 PID 2000 wrote to memory of 648 2000 vvpdd.exe 42 PID 2000 wrote to memory of 648 2000 vvpdd.exe 42 PID 2000 wrote to memory of 648 2000 vvpdd.exe 42 PID 2000 wrote to memory of 648 2000 vvpdd.exe 42 PID 648 wrote to memory of 1860 648 lrxlxrr.exe 43 PID 648 wrote to memory of 1860 648 lrxlxrr.exe 43 PID 648 wrote to memory of 1860 648 lrxlxrr.exe 43 PID 648 wrote to memory of 1860 648 lrxlxrr.exe 43 PID 1860 wrote to memory of 1464 1860 9bbbhb.exe 44 PID 1860 wrote to memory of 1464 1860 9bbbhb.exe 44 PID 1860 wrote to memory of 1464 1860 9bbbhb.exe 44 PID 1860 wrote to memory of 1464 1860 9bbbhb.exe 44 PID 1464 wrote to memory of 1692 1464 jvdvv.exe 45 PID 1464 wrote to memory of 1692 1464 jvdvv.exe 45 PID 1464 wrote to memory of 1692 1464 jvdvv.exe 45 PID 1464 wrote to memory of 1692 1464 jvdvv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\af78e48fef3a8e61bcaa9572c96bb9b26349dd3ff2de2c75e02de817198c5078.exe"C:\Users\Admin\AppData\Local\Temp\af78e48fef3a8e61bcaa9572c96bb9b26349dd3ff2de2c75e02de817198c5078.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\nnhnbh.exec:\nnhnbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\fxrxfff.exec:\fxrxfff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\3httnn.exec:\3httnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\jdvjp.exec:\jdvjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\9hbtbb.exec:\9hbtbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\5pjvd.exec:\5pjvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\frrxxlr.exec:\frrxxlr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\fxlllll.exec:\fxlllll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\jpvvv.exec:\jpvvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\xlllfff.exec:\xlllfff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\vjppp.exec:\vjppp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\vvpdd.exec:\vvpdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\lrxlxrr.exec:\lrxlxrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:648 -
\??\c:\9bbbhb.exec:\9bbbhb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\jvdvv.exec:\jvdvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
\??\c:\lxlllfl.exec:\lxlllfl.exe17⤵
- Executes dropped EXE
PID:1692 -
\??\c:\hnbbbb.exec:\hnbbbb.exe18⤵
- Executes dropped EXE
PID:1312 -
\??\c:\xlrxfxx.exec:\xlrxfxx.exe19⤵
- Executes dropped EXE
PID:1268 -
\??\c:\thhhnh.exec:\thhhnh.exe20⤵
- Executes dropped EXE
PID:2832 -
\??\c:\thtthh.exec:\thtthh.exe21⤵
- Executes dropped EXE
PID:2448 -
\??\c:\1flffxf.exec:\1flffxf.exe22⤵
- Executes dropped EXE
PID:2200 -
\??\c:\bhhttt.exec:\bhhttt.exe23⤵
- Executes dropped EXE
PID:788 -
\??\c:\dpdjj.exec:\dpdjj.exe24⤵
- Executes dropped EXE
PID:1608 -
\??\c:\bbnhnb.exec:\bbnhnb.exe25⤵
- Executes dropped EXE
PID:1456 -
\??\c:\jddpj.exec:\jddpj.exe26⤵
- Executes dropped EXE
PID:2900 -
\??\c:\5rfrrll.exec:\5rfrrll.exe27⤵
- Executes dropped EXE
PID:2100 -
\??\c:\5thbbt.exec:\5thbbt.exe28⤵
- Executes dropped EXE
PID:1448 -
\??\c:\5vvpp.exec:\5vvpp.exe29⤵
- Executes dropped EXE
PID:1304 -
\??\c:\ddppp.exec:\ddppp.exe30⤵
- Executes dropped EXE
PID:1848 -
\??\c:\5lxlrrx.exec:\5lxlrrx.exe31⤵
- Executes dropped EXE
PID:1500 -
\??\c:\tnhttt.exec:\tnhttt.exe32⤵
- Executes dropped EXE
PID:1516 -
\??\c:\pppdd.exec:\pppdd.exe33⤵
- Executes dropped EXE
PID:1588 -
\??\c:\llfxrll.exec:\llfxrll.exe34⤵
- Executes dropped EXE
PID:2348 -
\??\c:\nbhhtb.exec:\nbhhtb.exe35⤵
- Executes dropped EXE
PID:2136 -
\??\c:\jdppd.exec:\jdppd.exe36⤵
- Executes dropped EXE
PID:2220 -
\??\c:\xrxflfr.exec:\xrxflfr.exe37⤵
- Executes dropped EXE
PID:2152 -
\??\c:\rlflxxx.exec:\rlflxxx.exe38⤵
- Executes dropped EXE
PID:592 -
\??\c:\pdpjp.exec:\pdpjp.exe39⤵
- Executes dropped EXE
PID:2952 -
\??\c:\xlxxffl.exec:\xlxxffl.exe40⤵
- Executes dropped EXE
PID:2796 -
\??\c:\rlxfxrf.exec:\rlxfxrf.exe41⤵
- Executes dropped EXE
PID:2876 -
\??\c:\9bhbhb.exec:\9bhbhb.exe42⤵
- Executes dropped EXE
PID:2732 -
\??\c:\pdpjj.exec:\pdpjj.exe43⤵
- Executes dropped EXE
PID:3032 -
\??\c:\lxrfrrr.exec:\lxrfrrr.exe44⤵
- Executes dropped EXE
PID:2024 -
\??\c:\3btthh.exec:\3btthh.exe45⤵
- Executes dropped EXE
PID:2748 -
\??\c:\bnbthh.exec:\bnbthh.exe46⤵
- Executes dropped EXE
PID:2596 -
\??\c:\jvdvv.exec:\jvdvv.exe47⤵
- Executes dropped EXE
PID:3024 -
\??\c:\3rrrrll.exec:\3rrrrll.exe48⤵
- Executes dropped EXE
PID:1160 -
\??\c:\bhnttn.exec:\bhnttn.exe49⤵
- Executes dropped EXE
PID:1684 -
\??\c:\dddjj.exec:\dddjj.exe50⤵
- Executes dropped EXE
PID:2420 -
\??\c:\fxxxfxf.exec:\fxxxfxf.exe51⤵
- Executes dropped EXE
PID:1796 -
\??\c:\lflxxrx.exec:\lflxxrx.exe52⤵
- Executes dropped EXE
PID:1428 -
\??\c:\hbnntt.exec:\hbnntt.exe53⤵
- Executes dropped EXE
PID:1652 -
\??\c:\dpvpv.exec:\dpvpv.exe54⤵
- Executes dropped EXE
PID:1692 -
\??\c:\xxxflrl.exec:\xxxflrl.exe55⤵
- Executes dropped EXE
PID:1312 -
\??\c:\9btbtt.exec:\9btbtt.exe56⤵
- Executes dropped EXE
PID:2844 -
\??\c:\9vjjj.exec:\9vjjj.exe57⤵
- Executes dropped EXE
PID:2188 -
\??\c:\9dvpj.exec:\9dvpj.exe58⤵
- Executes dropped EXE
PID:2992 -
\??\c:\xlrrrxx.exec:\xlrrrxx.exe59⤵
- Executes dropped EXE
PID:2448 -
\??\c:\htbhhn.exec:\htbhhn.exe60⤵
- Executes dropped EXE
PID:2176 -
\??\c:\9nbtnn.exec:\9nbtnn.exe61⤵
- Executes dropped EXE
PID:444 -
\??\c:\pjvdd.exec:\pjvdd.exe62⤵
- Executes dropped EXE
PID:1816 -
\??\c:\fxrrrll.exec:\fxrrrll.exe63⤵
- Executes dropped EXE
PID:1600 -
\??\c:\frllrrx.exec:\frllrrx.exe64⤵
- Executes dropped EXE
PID:564 -
\??\c:\hbnnnt.exec:\hbnnnt.exe65⤵
- Executes dropped EXE
PID:776 -
\??\c:\pvjjd.exec:\pvjjd.exe66⤵PID:2240
-
\??\c:\5djpj.exec:\5djpj.exe67⤵PID:2104
-
\??\c:\rxfxxxf.exec:\rxfxxxf.exe68⤵PID:1448
-
\??\c:\thbbbb.exec:\thbbbb.exe69⤵PID:2120
-
\??\c:\5nbtht.exec:\5nbtht.exe70⤵PID:1656
-
\??\c:\pjvpv.exec:\pjvpv.exe71⤵PID:2028
-
\??\c:\lxxrrrr.exec:\lxxrrrr.exe72⤵PID:1508
-
\??\c:\tnhbnh.exec:\tnhbnh.exe73⤵PID:2544
-
\??\c:\9dvvp.exec:\9dvvp.exe74⤵PID:2548
-
\??\c:\vjvvd.exec:\vjvvd.exe75⤵PID:756
-
\??\c:\rfrlllx.exec:\rfrlllx.exe76⤵PID:1792
-
\??\c:\nbntbt.exec:\nbntbt.exe77⤵PID:2132
-
\??\c:\hhhhtn.exec:\hhhhtn.exe78⤵PID:2688
-
\??\c:\9frrrrx.exec:\9frrrrx.exe79⤵PID:2816
-
\??\c:\lxlflfr.exec:\lxlflfr.exe80⤵PID:2808
-
\??\c:\bnbhhh.exec:\bnbhhh.exe81⤵PID:2804
-
\??\c:\5btbbh.exec:\5btbbh.exe82⤵PID:2588
-
\??\c:\jvjjj.exec:\jvjjj.exe83⤵PID:2696
-
\??\c:\rlxxrrx.exec:\rlxxrrx.exe84⤵PID:2376
-
\??\c:\thtbbt.exec:\thtbbt.exe85⤵PID:2628
-
\??\c:\thttbt.exec:\thttbt.exe86⤵PID:2652
-
\??\c:\5jjjv.exec:\5jjjv.exe87⤵PID:3028
-
\??\c:\xrlffxx.exec:\xrlffxx.exe88⤵PID:1300
-
\??\c:\1lllllr.exec:\1lllllr.exe89⤵PID:1820
-
\??\c:\1nbhnn.exec:\1nbhnn.exe90⤵PID:1492
-
\??\c:\pjddd.exec:\pjddd.exe91⤵PID:1208
-
\??\c:\3dppj.exec:\3dppj.exe92⤵PID:2124
-
\??\c:\flfxxlr.exec:\flfxxlr.exe93⤵PID:2040
-
\??\c:\9xxxffl.exec:\9xxxffl.exe94⤵PID:1700
-
\??\c:\5nhhnh.exec:\5nhhnh.exe95⤵PID:2032
-
\??\c:\vpjjp.exec:\vpjjp.exe96⤵PID:840
-
\??\c:\fxlllll.exec:\fxlllll.exe97⤵PID:2904
-
\??\c:\fxrllff.exec:\fxrllff.exe98⤵
- System Location Discovery: System Language Discovery
PID:532 -
\??\c:\thttbt.exec:\thttbt.exe99⤵PID:2468
-
\??\c:\vjdvd.exec:\vjdvd.exe100⤵PID:1800
-
\??\c:\jjpvd.exec:\jjpvd.exe101⤵PID:2316
-
\??\c:\3xlfxrx.exec:\3xlfxrx.exe102⤵PID:1112
-
\??\c:\nnhnhn.exec:\nnhnhn.exe103⤵PID:1252
-
\??\c:\htnnnh.exec:\htnnnh.exe104⤵PID:632
-
\??\c:\vvpvd.exec:\vvpvd.exe105⤵PID:2276
-
\??\c:\rfrrrrf.exec:\rfrrrrf.exe106⤵PID:472
-
\??\c:\5nbbtn.exec:\5nbbtn.exe107⤵PID:996
-
\??\c:\tntbtb.exec:\tntbtb.exe108⤵PID:3060
-
\??\c:\1jdpp.exec:\1jdpp.exe109⤵PID:2436
-
\??\c:\frfffxf.exec:\frfffxf.exe110⤵PID:2120
-
\??\c:\9rxrfxf.exec:\9rxrfxf.exe111⤵PID:1656
-
\??\c:\tnttnn.exec:\tnttnn.exe112⤵PID:2520
-
\??\c:\1jvdp.exec:\1jvdp.exe113⤵PID:2116
-
\??\c:\1pddv.exec:\1pddv.exe114⤵PID:2544
-
\??\c:\lxflrrx.exec:\lxflrrx.exe115⤵PID:2068
-
\??\c:\lxlfrrl.exec:\lxlfrrl.exe116⤵PID:2248
-
\??\c:\hbtbhh.exec:\hbtbhh.exe117⤵PID:1520
-
\??\c:\vvjjp.exec:\vvjjp.exe118⤵PID:2320
-
\??\c:\3xlrrlr.exec:\3xlrrlr.exe119⤵PID:2152
-
\??\c:\frxflxl.exec:\frxflxl.exe120⤵PID:2800
-
\??\c:\btttbh.exec:\btttbh.exe121⤵PID:2808
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-