Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 09:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ae592a168b5ea08cebf3bb5a17eaaa89369eb300fa4a849a7efb8f7e65a03678.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
ae592a168b5ea08cebf3bb5a17eaaa89369eb300fa4a849a7efb8f7e65a03678.exe
-
Size
454KB
-
MD5
34cd1863be9d6312e65dea806126112d
-
SHA1
8442565f46a1e04be775c81bf36f94e252322619
-
SHA256
ae592a168b5ea08cebf3bb5a17eaaa89369eb300fa4a849a7efb8f7e65a03678
-
SHA512
7e06db0c05569305711c9826bb91eb4fdbe4179b0c5f7261204d77fdf24a430d92d617119d6113060f9ec89f0d8aaf9e3548f72dd4540db6111ca9f1c6ee945a
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbep:q7Tc2NYHUrAwfMp3CDp
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/2184-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-17-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2816-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-48-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2768-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1980-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/944-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/880-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/840-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1996-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/800-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1064-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1276-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1276-276-0x0000000077030000-0x000000007714F000-memory.dmp family_blackmoon behavioral1/memory/2836-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-319-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2884-360-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1576-401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2260-440-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2008-453-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1660-473-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/1660-474-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1872-491-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1828-518-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/468-519-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1696-540-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-541-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-557-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3056-616-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/536-688-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2508-698-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1136-721-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-767-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2696-838-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2844 lfflfxr.exe 2684 jjdpd.exe 2816 rrlxffr.exe 2768 ththth.exe 2812 ppppj.exe 1980 nhnntn.exe 2564 vjvvd.exe 2248 bhbnht.exe 2236 jdvdd.exe 2788 llxxfrf.exe 944 tthtnt.exe 2908 vvvdv.exe 2660 rlxfxfl.exe 2224 vpjjv.exe 2364 xlxrxxf.exe 880 5nhbbt.exe 2188 ppjdp.exe 2180 hbtbnt.exe 2420 nntntt.exe 956 rlxfffl.exe 2220 3nbhhh.exe 840 pddjv.exe 1872 rrlrxlr.exe 1996 jvjpp.exe 800 lllfllr.exe 1064 btnntt.exe 3008 tbnntt.exe 1324 9rffllr.exe 1276 1tnbhn.exe 1712 rxlxflx.exe 2960 frlrxxx.exe 2720 tbbtth.exe 2824 ddvdj.exe 2556 3lxlfrx.exe 2636 5bnhhb.exe 2884 dvppv.exe 692 5llrffl.exe 1348 rlfrrxl.exe 2376 htnhnn.exe 2524 pddjd.exe 1156 llfxllx.exe 1272 9llxffl.exe 2772 hbtbhh.exe 1496 dpddj.exe 2764 frxfllf.exe 1308 fxrrxxf.exe 1576 bbhhhb.exe 2072 jdppv.exe 1260 1ffflrx.exe 1772 3fxrxfl.exe 2976 7ttbnt.exe 2260 5vjjp.exe 1932 rrxlxfr.exe 2008 hbttbb.exe 1944 dvpdj.exe 1448 llxxflx.exe 1660 fxllrxf.exe 2512 bnbttt.exe 2536 pdddp.exe 1872 9frrxxr.exe 2256 hthtbh.exe 2332 1jppd.exe 2532 3pvpp.exe 1828 lfflxfl.exe -
resource yara_rule behavioral1/memory/2844-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-17-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2816-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/944-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/880-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/840-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/800-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1064-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1276-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/692-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1576-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1260-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1828-518-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/468-519-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-533-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-540-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-549-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-557-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-589-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-616-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/536-681-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/536-688-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-698-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1136-721-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1872-754-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-794-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-801-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lllrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bhnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2184 wrote to memory of 2844 2184 ae592a168b5ea08cebf3bb5a17eaaa89369eb300fa4a849a7efb8f7e65a03678.exe 31 PID 2184 wrote to memory of 2844 2184 ae592a168b5ea08cebf3bb5a17eaaa89369eb300fa4a849a7efb8f7e65a03678.exe 31 PID 2184 wrote to memory of 2844 2184 ae592a168b5ea08cebf3bb5a17eaaa89369eb300fa4a849a7efb8f7e65a03678.exe 31 PID 2184 wrote to memory of 2844 2184 ae592a168b5ea08cebf3bb5a17eaaa89369eb300fa4a849a7efb8f7e65a03678.exe 31 PID 2844 wrote to memory of 2684 2844 lfflfxr.exe 32 PID 2844 wrote to memory of 2684 2844 lfflfxr.exe 32 PID 2844 wrote to memory of 2684 2844 lfflfxr.exe 32 PID 2844 wrote to memory of 2684 2844 lfflfxr.exe 32 PID 2684 wrote to memory of 2816 2684 jjdpd.exe 33 PID 2684 wrote to memory of 2816 2684 jjdpd.exe 33 PID 2684 wrote to memory of 2816 2684 jjdpd.exe 33 PID 2684 wrote to memory of 2816 2684 jjdpd.exe 33 PID 2816 wrote to memory of 2768 2816 rrlxffr.exe 34 PID 2816 wrote to memory of 2768 2816 rrlxffr.exe 34 PID 2816 wrote to memory of 2768 2816 rrlxffr.exe 34 PID 2816 wrote to memory of 2768 2816 rrlxffr.exe 34 PID 2768 wrote to memory of 2812 2768 ththth.exe 35 PID 2768 wrote to memory of 2812 2768 ththth.exe 35 PID 2768 wrote to memory of 2812 2768 ththth.exe 35 PID 2768 wrote to memory of 2812 2768 ththth.exe 35 PID 2812 wrote to memory of 1980 2812 ppppj.exe 36 PID 2812 wrote to memory of 1980 2812 ppppj.exe 36 PID 2812 wrote to memory of 1980 2812 ppppj.exe 36 PID 2812 wrote to memory of 1980 2812 ppppj.exe 36 PID 1980 wrote to memory of 2564 1980 nhnntn.exe 37 PID 1980 wrote to memory of 2564 1980 nhnntn.exe 37 PID 1980 wrote to memory of 2564 1980 nhnntn.exe 37 PID 1980 wrote to memory of 2564 1980 nhnntn.exe 37 PID 2564 wrote to memory of 2248 2564 vjvvd.exe 38 PID 2564 wrote to memory of 2248 2564 vjvvd.exe 38 PID 2564 wrote to memory of 2248 2564 vjvvd.exe 38 PID 2564 wrote to memory of 2248 2564 vjvvd.exe 38 PID 2248 wrote to memory of 2236 2248 bhbnht.exe 39 PID 2248 wrote to memory of 2236 2248 bhbnht.exe 39 PID 2248 wrote to memory of 2236 2248 bhbnht.exe 39 PID 2248 wrote to memory of 2236 2248 bhbnht.exe 39 PID 2236 wrote to memory of 2788 2236 jdvdd.exe 40 PID 2236 wrote to memory of 2788 2236 jdvdd.exe 40 PID 2236 wrote to memory of 2788 2236 jdvdd.exe 40 PID 2236 wrote to memory of 2788 2236 jdvdd.exe 40 PID 2788 wrote to memory of 944 2788 llxxfrf.exe 41 PID 2788 wrote to memory of 944 2788 llxxfrf.exe 41 PID 2788 wrote to memory of 944 2788 llxxfrf.exe 41 PID 2788 wrote to memory of 944 2788 llxxfrf.exe 41 PID 944 wrote to memory of 2908 944 tthtnt.exe 42 PID 944 wrote to memory of 2908 944 tthtnt.exe 42 PID 944 wrote to memory of 2908 944 tthtnt.exe 42 PID 944 wrote to memory of 2908 944 tthtnt.exe 42 PID 2908 wrote to memory of 2660 2908 vvvdv.exe 43 PID 2908 wrote to memory of 2660 2908 vvvdv.exe 43 PID 2908 wrote to memory of 2660 2908 vvvdv.exe 43 PID 2908 wrote to memory of 2660 2908 vvvdv.exe 43 PID 2660 wrote to memory of 2224 2660 rlxfxfl.exe 44 PID 2660 wrote to memory of 2224 2660 rlxfxfl.exe 44 PID 2660 wrote to memory of 2224 2660 rlxfxfl.exe 44 PID 2660 wrote to memory of 2224 2660 rlxfxfl.exe 44 PID 2224 wrote to memory of 2364 2224 vpjjv.exe 45 PID 2224 wrote to memory of 2364 2224 vpjjv.exe 45 PID 2224 wrote to memory of 2364 2224 vpjjv.exe 45 PID 2224 wrote to memory of 2364 2224 vpjjv.exe 45 PID 2364 wrote to memory of 880 2364 xlxrxxf.exe 46 PID 2364 wrote to memory of 880 2364 xlxrxxf.exe 46 PID 2364 wrote to memory of 880 2364 xlxrxxf.exe 46 PID 2364 wrote to memory of 880 2364 xlxrxxf.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae592a168b5ea08cebf3bb5a17eaaa89369eb300fa4a849a7efb8f7e65a03678.exe"C:\Users\Admin\AppData\Local\Temp\ae592a168b5ea08cebf3bb5a17eaaa89369eb300fa4a849a7efb8f7e65a03678.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\lfflfxr.exec:\lfflfxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\jjdpd.exec:\jjdpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\rrlxffr.exec:\rrlxffr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\ththth.exec:\ththth.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\ppppj.exec:\ppppj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\nhnntn.exec:\nhnntn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\vjvvd.exec:\vjvvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\bhbnht.exec:\bhbnht.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\jdvdd.exec:\jdvdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\llxxfrf.exec:\llxxfrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\tthtnt.exec:\tthtnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
\??\c:\vvvdv.exec:\vvvdv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\rlxfxfl.exec:\rlxfxfl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\vpjjv.exec:\vpjjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\xlxrxxf.exec:\xlxrxxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\5nhbbt.exec:\5nhbbt.exe17⤵
- Executes dropped EXE
PID:880 -
\??\c:\ppjdp.exec:\ppjdp.exe18⤵
- Executes dropped EXE
PID:2188 -
\??\c:\hbtbnt.exec:\hbtbnt.exe19⤵
- Executes dropped EXE
PID:2180 -
\??\c:\nntntt.exec:\nntntt.exe20⤵
- Executes dropped EXE
PID:2420 -
\??\c:\rlxfffl.exec:\rlxfffl.exe21⤵
- Executes dropped EXE
PID:956 -
\??\c:\3nbhhh.exec:\3nbhhh.exe22⤵
- Executes dropped EXE
PID:2220 -
\??\c:\pddjv.exec:\pddjv.exe23⤵
- Executes dropped EXE
PID:840 -
\??\c:\rrlrxlr.exec:\rrlrxlr.exe24⤵
- Executes dropped EXE
PID:1872 -
\??\c:\jvjpp.exec:\jvjpp.exe25⤵
- Executes dropped EXE
PID:1996 -
\??\c:\lllfllr.exec:\lllfllr.exe26⤵
- Executes dropped EXE
PID:800 -
\??\c:\btnntt.exec:\btnntt.exe27⤵
- Executes dropped EXE
PID:1064 -
\??\c:\tbnntt.exec:\tbnntt.exe28⤵
- Executes dropped EXE
PID:3008 -
\??\c:\9rffllr.exec:\9rffllr.exe29⤵
- Executes dropped EXE
PID:1324 -
\??\c:\1tnbhn.exec:\1tnbhn.exe30⤵
- Executes dropped EXE
PID:1276 -
\??\c:\rfffflr.exec:\rfffflr.exe31⤵PID:2836
-
\??\c:\rxlxflx.exec:\rxlxflx.exe32⤵
- Executes dropped EXE
PID:1712 -
\??\c:\frlrxxx.exec:\frlrxxx.exe33⤵
- Executes dropped EXE
PID:2960 -
\??\c:\tbbtth.exec:\tbbtth.exe34⤵
- Executes dropped EXE
PID:2720 -
\??\c:\ddvdj.exec:\ddvdj.exe35⤵
- Executes dropped EXE
PID:2824 -
\??\c:\3lxlfrx.exec:\3lxlfrx.exe36⤵
- Executes dropped EXE
PID:2556 -
\??\c:\5bnhhb.exec:\5bnhhb.exe37⤵
- Executes dropped EXE
PID:2636 -
\??\c:\dvppv.exec:\dvppv.exe38⤵
- Executes dropped EXE
PID:2884 -
\??\c:\5llrffl.exec:\5llrffl.exe39⤵
- Executes dropped EXE
PID:692 -
\??\c:\rlfrrxl.exec:\rlfrrxl.exe40⤵
- Executes dropped EXE
PID:1348 -
\??\c:\htnhnn.exec:\htnhnn.exe41⤵
- Executes dropped EXE
PID:2376 -
\??\c:\pddjd.exec:\pddjd.exe42⤵
- Executes dropped EXE
PID:2524 -
\??\c:\llfxllx.exec:\llfxllx.exe43⤵
- Executes dropped EXE
PID:1156 -
\??\c:\9llxffl.exec:\9llxffl.exe44⤵
- Executes dropped EXE
PID:1272 -
\??\c:\hbtbhh.exec:\hbtbhh.exe45⤵
- Executes dropped EXE
PID:2772 -
\??\c:\dpddj.exec:\dpddj.exe46⤵
- Executes dropped EXE
PID:1496 -
\??\c:\frxfllf.exec:\frxfllf.exe47⤵
- Executes dropped EXE
PID:2764 -
\??\c:\fxrrxxf.exec:\fxrrxxf.exe48⤵
- Executes dropped EXE
PID:1308 -
\??\c:\bbhhhb.exec:\bbhhhb.exe49⤵
- Executes dropped EXE
PID:1576 -
\??\c:\jdppv.exec:\jdppv.exe50⤵
- Executes dropped EXE
PID:2072 -
\??\c:\1ffflrx.exec:\1ffflrx.exe51⤵
- Executes dropped EXE
PID:1260 -
\??\c:\3fxrxfl.exec:\3fxrxfl.exe52⤵
- Executes dropped EXE
PID:1772 -
\??\c:\7ttbnt.exec:\7ttbnt.exe53⤵
- Executes dropped EXE
PID:2976 -
\??\c:\5vjjp.exec:\5vjjp.exe54⤵
- Executes dropped EXE
PID:2260 -
\??\c:\rrxlxfr.exec:\rrxlxfr.exe55⤵
- Executes dropped EXE
PID:1932 -
\??\c:\hbttbb.exec:\hbttbb.exe56⤵
- Executes dropped EXE
PID:2008 -
\??\c:\dvpdj.exec:\dvpdj.exe57⤵
- Executes dropped EXE
PID:1944 -
\??\c:\llxxflx.exec:\llxxflx.exe58⤵
- Executes dropped EXE
PID:1448 -
\??\c:\fxllrxf.exec:\fxllrxf.exe59⤵
- Executes dropped EXE
PID:1660 -
\??\c:\bnbttt.exec:\bnbttt.exe60⤵
- Executes dropped EXE
PID:2512 -
\??\c:\pdddp.exec:\pdddp.exe61⤵
- Executes dropped EXE
PID:2536 -
\??\c:\9frrxxr.exec:\9frrxxr.exe62⤵
- Executes dropped EXE
PID:1872 -
\??\c:\hthtbh.exec:\hthtbh.exe63⤵
- Executes dropped EXE
PID:2256 -
\??\c:\1jppd.exec:\1jppd.exe64⤵
- Executes dropped EXE
PID:2332 -
\??\c:\3pvpp.exec:\3pvpp.exe65⤵
- Executes dropped EXE
PID:2532 -
\??\c:\lfflxfl.exec:\lfflxfl.exe66⤵
- Executes dropped EXE
PID:1828 -
\??\c:\tbhbtn.exec:\tbhbtn.exe67⤵PID:468
-
\??\c:\jpvjj.exec:\jpvjj.exe68⤵PID:1300
-
\??\c:\lxrxllx.exec:\lxrxllx.exe69⤵PID:1696
-
\??\c:\xrfllrl.exec:\xrfllrl.exe70⤵PID:2832
-
\??\c:\nhhthn.exec:\nhhthn.exe71⤵PID:2716
-
\??\c:\ppvjp.exec:\ppvjp.exe72⤵PID:2820
-
\??\c:\rfrrrrx.exec:\rfrrrrx.exe73⤵PID:2920
-
\??\c:\hhbhnt.exec:\hhbhnt.exe74⤵PID:2840
-
\??\c:\5htbbb.exec:\5htbbb.exe75⤵PID:2592
-
\??\c:\dvjjj.exec:\dvjjj.exe76⤵PID:2580
-
\??\c:\fxrlxxf.exec:\fxrlxxf.exe77⤵PID:3048
-
\??\c:\tttbht.exec:\tttbht.exe78⤵PID:2628
-
\??\c:\dvddp.exec:\dvddp.exe79⤵PID:3040
-
\??\c:\fxrlrrr.exec:\fxrlrrr.exe80⤵PID:2432
-
\??\c:\5xfxfll.exec:\5xfxfll.exe81⤵PID:3056
-
\??\c:\nhbbnh.exec:\nhbbnh.exe82⤵PID:2524
-
\??\c:\dvjjv.exec:\dvjjv.exe83⤵PID:1920
-
\??\c:\fxlxrxl.exec:\fxlxrxl.exe84⤵PID:2056
-
\??\c:\lxrfllx.exec:\lxrfllx.exe85⤵PID:1200
-
\??\c:\9bhbbb.exec:\9bhbbb.exe86⤵PID:2796
-
\??\c:\jvddd.exec:\jvddd.exe87⤵PID:2740
-
\??\c:\3lflrxf.exec:\3lflrxf.exe88⤵PID:2660
-
\??\c:\xrffllr.exec:\xrffllr.exe89⤵PID:592
-
\??\c:\bhhnhn.exec:\bhhnhn.exe90⤵PID:572
-
\??\c:\dpvvv.exec:\dpvvv.exe91⤵PID:536
-
\??\c:\fxlffff.exec:\fxlffff.exe92⤵PID:2876
-
\??\c:\3nhntt.exec:\3nhntt.exe93⤵PID:2508
-
\??\c:\bnbbnn.exec:\bnbbnn.exe94⤵PID:2212
-
\??\c:\ddvdp.exec:\ddvdp.exe95⤵PID:2112
-
\??\c:\7xlffff.exec:\7xlffff.exe96⤵PID:2140
-
\??\c:\nhbntt.exec:\nhbntt.exe97⤵PID:1136
-
\??\c:\nhtbbt.exec:\nhtbbt.exe98⤵PID:2220
-
\??\c:\jjvdp.exec:\jjvdp.exe99⤵PID:2360
-
\??\c:\rxllxxl.exec:\rxllxxl.exe100⤵PID:916
-
\??\c:\lflrffl.exec:\lflrffl.exe101⤵PID:2252
-
\??\c:\nbnnhh.exec:\nbnnhh.exe102⤵PID:1872
-
\??\c:\dvpvj.exec:\dvpvj.exe103⤵PID:2488
-
\??\c:\9dpvj.exec:\9dpvj.exe104⤵PID:1064
-
\??\c:\fxrrxfl.exec:\fxrrxfl.exe105⤵PID:2328
-
\??\c:\htnnnn.exec:\htnnnn.exe106⤵PID:1028
-
\??\c:\5hhntt.exec:\5hhntt.exe107⤵PID:2184
-
\??\c:\9pjdp.exec:\9pjdp.exe108⤵PID:2500
-
\??\c:\9xllxfl.exec:\9xllxfl.exe109⤵PID:2900
-
\??\c:\hbthhb.exec:\hbthhb.exe110⤵PID:1040
-
\??\c:\hbtbhn.exec:\hbtbhn.exe111⤵PID:2844
-
\??\c:\vvjpv.exec:\vvjpv.exe112⤵PID:2584
-
\??\c:\5rffllr.exec:\5rffllr.exe113⤵PID:2816
-
\??\c:\bnbbhh.exec:\bnbbhh.exe114⤵PID:2696
-
\??\c:\hthntn.exec:\hthntn.exe115⤵PID:2624
-
\??\c:\ppjjv.exec:\ppjjv.exe116⤵PID:2580
-
\??\c:\frllllr.exec:\frllllr.exe117⤵PID:304
-
\??\c:\9hbhnn.exec:\9hbhnn.exe118⤵PID:1956
-
\??\c:\3hbnhh.exec:\3hbnhh.exe119⤵PID:1556
-
\??\c:\pjpvd.exec:\pjpvd.exe120⤵PID:2164
-
\??\c:\xfxxrrf.exec:\xfxxrrf.exe121⤵PID:2916
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-