Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/03/2025, 22:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5ee9eb2450ce82c8d4279a4a589134bd505f8e6f0e3e682d2a94b59ba0a7f4e2.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
5ee9eb2450ce82c8d4279a4a589134bd505f8e6f0e3e682d2a94b59ba0a7f4e2.exe
-
Size
459KB
-
MD5
f33df94e8b76d59cd54eb8fa7327106f
-
SHA1
502d3345dc5484c6145363611468d9d48440c434
-
SHA256
5ee9eb2450ce82c8d4279a4a589134bd505f8e6f0e3e682d2a94b59ba0a7f4e2
-
SHA512
e20fb84ca4ebd2e5609b8dcb5a5bc1094aa70d0a26dacccca48d0d139522f43573c3290f83046afeb2c80339109c85d79d7f9eae41994b14b6b6f19c428fecf0
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeWP:q7Tc2NYHUrAwfMp3CDWP
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/2496-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2240-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1916-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2240-26-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2196-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2080-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1488-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1728-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1648-155-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1076-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1648-154-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1160-174-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2824-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2160-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/912-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2388-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1124-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1740-411-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/332-430-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1780-443-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1592-477-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1948-494-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2368-562-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2648-576-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1624-584-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1624-579-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/3060-598-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-640-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2972-749-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2072-831-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1352-952-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1284-957-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1388-972-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-1155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2060 9dvdp.exe 2240 fxlxllf.exe 1916 1dvvd.exe 2196 1flrflx.exe 2080 ttnthn.exe 2760 rlflrxl.exe 2860 hbbhtb.exe 2604 jddjp.exe 2188 1frrffx.exe 2572 tnbbnt.exe 2688 ddppd.exe 1532 xxrrflr.exe 1488 pjvvj.exe 1728 vpddd.exe 692 tnbhtb.exe 1648 btnhtn.exe 1076 7lfxxfl.exe 1160 lflllxf.exe 2824 hbnnbt.exe 2164 nbnnnh.exe 2160 fxlrrlx.exe 2168 btnhnt.exe 2248 vjddj.exe 1144 9rrrrll.exe 912 jdppv.exe 1564 9rfxffl.exe 764 7jvvv.exe 2968 jjppd.exe 2964 httnbn.exe 1888 tnbntb.exe 3044 9xrfrxx.exe 2512 lrxxfff.exe 2388 vvjvj.exe 1600 9pvpp.exe 1124 xlrfffl.exe 2536 bthntt.exe 2172 5ppvj.exe 2764 rlflxlx.exe 2808 lxfxffr.exe 2156 nhbbbt.exe 2792 jjvdj.exe 2816 pdpjp.exe 3020 frfllll.exe 2680 lxllllf.exe 2588 hbntbt.exe 2572 thbthb.exe 2976 jvdpp.exe 1636 ffrxflf.exe 776 hbtbhb.exe 1740 tthhnn.exe 1596 pdppv.exe 692 9dppv.exe 332 lxllrlr.exe 1952 thtbbb.exe 1780 dvjjp.exe 1524 dvdvv.exe 2432 fxlxllx.exe 2184 hhnnnn.exe 2448 1tbbbb.exe 2972 ppvjp.exe 1592 rrlfllf.exe 2376 5xfxxxf.exe 1948 tnhhhh.exe 664 vvppv.exe -
resource yara_rule behavioral1/memory/2496-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2240-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1916-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1488-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1076-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1160-206-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/912-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1124-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/332-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1780-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-477-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2376-482-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1948-494-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/612-537-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-576-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-584-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-579-0x00000000003D0000-0x00000000003FA000-memory.dmp upx behavioral1/memory/3060-591-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-598-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-650-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/484-668-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/584-705-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-749-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-776-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-782-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-831-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1352-952-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/1388-972-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-1003-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/988-1028-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-1114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-1155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-1344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-1363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1604-1370-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7thnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xfxxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lflrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrxxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrxlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxrllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2496 wrote to memory of 2060 2496 5ee9eb2450ce82c8d4279a4a589134bd505f8e6f0e3e682d2a94b59ba0a7f4e2.exe 30 PID 2496 wrote to memory of 2060 2496 5ee9eb2450ce82c8d4279a4a589134bd505f8e6f0e3e682d2a94b59ba0a7f4e2.exe 30 PID 2496 wrote to memory of 2060 2496 5ee9eb2450ce82c8d4279a4a589134bd505f8e6f0e3e682d2a94b59ba0a7f4e2.exe 30 PID 2496 wrote to memory of 2060 2496 5ee9eb2450ce82c8d4279a4a589134bd505f8e6f0e3e682d2a94b59ba0a7f4e2.exe 30 PID 2060 wrote to memory of 2240 2060 9dvdp.exe 31 PID 2060 wrote to memory of 2240 2060 9dvdp.exe 31 PID 2060 wrote to memory of 2240 2060 9dvdp.exe 31 PID 2060 wrote to memory of 2240 2060 9dvdp.exe 31 PID 2240 wrote to memory of 1916 2240 fxlxllf.exe 32 PID 2240 wrote to memory of 1916 2240 fxlxllf.exe 32 PID 2240 wrote to memory of 1916 2240 fxlxllf.exe 32 PID 2240 wrote to memory of 1916 2240 fxlxllf.exe 32 PID 1916 wrote to memory of 2196 1916 1dvvd.exe 33 PID 1916 wrote to memory of 2196 1916 1dvvd.exe 33 PID 1916 wrote to memory of 2196 1916 1dvvd.exe 33 PID 1916 wrote to memory of 2196 1916 1dvvd.exe 33 PID 2196 wrote to memory of 2080 2196 1flrflx.exe 34 PID 2196 wrote to memory of 2080 2196 1flrflx.exe 34 PID 2196 wrote to memory of 2080 2196 1flrflx.exe 34 PID 2196 wrote to memory of 2080 2196 1flrflx.exe 34 PID 2080 wrote to memory of 2760 2080 ttnthn.exe 35 PID 2080 wrote to memory of 2760 2080 ttnthn.exe 35 PID 2080 wrote to memory of 2760 2080 ttnthn.exe 35 PID 2080 wrote to memory of 2760 2080 ttnthn.exe 35 PID 2760 wrote to memory of 2860 2760 rlflrxl.exe 36 PID 2760 wrote to memory of 2860 2760 rlflrxl.exe 36 PID 2760 wrote to memory of 2860 2760 rlflrxl.exe 36 PID 2760 wrote to memory of 2860 2760 rlflrxl.exe 36 PID 2860 wrote to memory of 2604 2860 hbbhtb.exe 37 PID 2860 wrote to memory of 2604 2860 hbbhtb.exe 37 PID 2860 wrote to memory of 2604 2860 hbbhtb.exe 37 PID 2860 wrote to memory of 2604 2860 hbbhtb.exe 37 PID 2604 wrote to memory of 2188 2604 jddjp.exe 38 PID 2604 wrote to memory of 2188 2604 jddjp.exe 38 PID 2604 wrote to memory of 2188 2604 jddjp.exe 38 PID 2604 wrote to memory of 2188 2604 jddjp.exe 38 PID 2188 wrote to memory of 2572 2188 1frrffx.exe 39 PID 2188 wrote to memory of 2572 2188 1frrffx.exe 39 PID 2188 wrote to memory of 2572 2188 1frrffx.exe 39 PID 2188 wrote to memory of 2572 2188 1frrffx.exe 39 PID 2572 wrote to memory of 2688 2572 tnbbnt.exe 40 PID 2572 wrote to memory of 2688 2572 tnbbnt.exe 40 PID 2572 wrote to memory of 2688 2572 tnbbnt.exe 40 PID 2572 wrote to memory of 2688 2572 tnbbnt.exe 40 PID 2688 wrote to memory of 1532 2688 ddppd.exe 41 PID 2688 wrote to memory of 1532 2688 ddppd.exe 41 PID 2688 wrote to memory of 1532 2688 ddppd.exe 41 PID 2688 wrote to memory of 1532 2688 ddppd.exe 41 PID 1532 wrote to memory of 1488 1532 xxrrflr.exe 42 PID 1532 wrote to memory of 1488 1532 xxrrflr.exe 42 PID 1532 wrote to memory of 1488 1532 xxrrflr.exe 42 PID 1532 wrote to memory of 1488 1532 xxrrflr.exe 42 PID 1488 wrote to memory of 1728 1488 pjvvj.exe 43 PID 1488 wrote to memory of 1728 1488 pjvvj.exe 43 PID 1488 wrote to memory of 1728 1488 pjvvj.exe 43 PID 1488 wrote to memory of 1728 1488 pjvvj.exe 43 PID 1728 wrote to memory of 692 1728 vpddd.exe 44 PID 1728 wrote to memory of 692 1728 vpddd.exe 44 PID 1728 wrote to memory of 692 1728 vpddd.exe 44 PID 1728 wrote to memory of 692 1728 vpddd.exe 44 PID 692 wrote to memory of 1648 692 tnbhtb.exe 45 PID 692 wrote to memory of 1648 692 tnbhtb.exe 45 PID 692 wrote to memory of 1648 692 tnbhtb.exe 45 PID 692 wrote to memory of 1648 692 tnbhtb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ee9eb2450ce82c8d4279a4a589134bd505f8e6f0e3e682d2a94b59ba0a7f4e2.exe"C:\Users\Admin\AppData\Local\Temp\5ee9eb2450ce82c8d4279a4a589134bd505f8e6f0e3e682d2a94b59ba0a7f4e2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\9dvdp.exec:\9dvdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\fxlxllf.exec:\fxlxllf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\1dvvd.exec:\1dvvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\1flrflx.exec:\1flrflx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\ttnthn.exec:\ttnthn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\rlflrxl.exec:\rlflrxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\hbbhtb.exec:\hbbhtb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\jddjp.exec:\jddjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\1frrffx.exec:\1frrffx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\tnbbnt.exec:\tnbbnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\ddppd.exec:\ddppd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\xxrrflr.exec:\xxrrflr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\pjvvj.exec:\pjvvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\vpddd.exec:\vpddd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\tnbhtb.exec:\tnbhtb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:692 -
\??\c:\btnhtn.exec:\btnhtn.exe17⤵
- Executes dropped EXE
PID:1648 -
\??\c:\7lfxxfl.exec:\7lfxxfl.exe18⤵
- Executes dropped EXE
PID:1076 -
\??\c:\lflllxf.exec:\lflllxf.exe19⤵
- Executes dropped EXE
PID:1160 -
\??\c:\hbnnbt.exec:\hbnnbt.exe20⤵
- Executes dropped EXE
PID:2824 -
\??\c:\nbnnnh.exec:\nbnnnh.exe21⤵
- Executes dropped EXE
PID:2164 -
\??\c:\fxlrrlx.exec:\fxlrrlx.exe22⤵
- Executes dropped EXE
PID:2160 -
\??\c:\btnhnt.exec:\btnhnt.exe23⤵
- Executes dropped EXE
PID:2168 -
\??\c:\vjddj.exec:\vjddj.exe24⤵
- Executes dropped EXE
PID:2248 -
\??\c:\9rrrrll.exec:\9rrrrll.exe25⤵
- Executes dropped EXE
PID:1144 -
\??\c:\jdppv.exec:\jdppv.exe26⤵
- Executes dropped EXE
PID:912 -
\??\c:\9rfxffl.exec:\9rfxffl.exe27⤵
- Executes dropped EXE
PID:1564 -
\??\c:\7jvvv.exec:\7jvvv.exe28⤵
- Executes dropped EXE
PID:764 -
\??\c:\jjppd.exec:\jjppd.exe29⤵
- Executes dropped EXE
PID:2968 -
\??\c:\httnbn.exec:\httnbn.exe30⤵
- Executes dropped EXE
PID:2964 -
\??\c:\tnbntb.exec:\tnbntb.exe31⤵
- Executes dropped EXE
PID:1888 -
\??\c:\9xrfrxx.exec:\9xrfrxx.exe32⤵
- Executes dropped EXE
PID:3044 -
\??\c:\lrxxfff.exec:\lrxxfff.exe33⤵
- Executes dropped EXE
PID:2512 -
\??\c:\vvjvj.exec:\vvjvj.exe34⤵
- Executes dropped EXE
PID:2388 -
\??\c:\9pvpp.exec:\9pvpp.exe35⤵
- Executes dropped EXE
PID:1600 -
\??\c:\xlrfffl.exec:\xlrfffl.exe36⤵
- Executes dropped EXE
PID:1124 -
\??\c:\bthntt.exec:\bthntt.exe37⤵
- Executes dropped EXE
PID:2536 -
\??\c:\5ppvj.exec:\5ppvj.exe38⤵
- Executes dropped EXE
PID:2172 -
\??\c:\rlflxlx.exec:\rlflxlx.exe39⤵
- Executes dropped EXE
PID:2764 -
\??\c:\lxfxffr.exec:\lxfxffr.exe40⤵
- Executes dropped EXE
PID:2808 -
\??\c:\nhbbbt.exec:\nhbbbt.exe41⤵
- Executes dropped EXE
PID:2156 -
\??\c:\jjvdj.exec:\jjvdj.exe42⤵
- Executes dropped EXE
PID:2792 -
\??\c:\pdpjp.exec:\pdpjp.exe43⤵
- Executes dropped EXE
PID:2816 -
\??\c:\frfllll.exec:\frfllll.exe44⤵
- Executes dropped EXE
PID:3020 -
\??\c:\lxllllf.exec:\lxllllf.exe45⤵
- Executes dropped EXE
PID:2680 -
\??\c:\hbntbt.exec:\hbntbt.exe46⤵
- Executes dropped EXE
PID:2588 -
\??\c:\thbthb.exec:\thbthb.exe47⤵
- Executes dropped EXE
PID:2572 -
\??\c:\jvdpp.exec:\jvdpp.exe48⤵
- Executes dropped EXE
PID:2976 -
\??\c:\ffrxflf.exec:\ffrxflf.exe49⤵
- Executes dropped EXE
PID:1636 -
\??\c:\hbtbhb.exec:\hbtbhb.exe50⤵
- Executes dropped EXE
PID:776 -
\??\c:\tthhnn.exec:\tthhnn.exe51⤵
- Executes dropped EXE
PID:1740 -
\??\c:\pdppv.exec:\pdppv.exe52⤵
- Executes dropped EXE
PID:1596 -
\??\c:\9dppv.exec:\9dppv.exe53⤵
- Executes dropped EXE
PID:692 -
\??\c:\lxllrlr.exec:\lxllrlr.exe54⤵
- Executes dropped EXE
PID:332 -
\??\c:\thtbbb.exec:\thtbbb.exe55⤵
- Executes dropped EXE
PID:1952 -
\??\c:\dvjjp.exec:\dvjjp.exe56⤵
- Executes dropped EXE
PID:1780 -
\??\c:\dvdvv.exec:\dvdvv.exe57⤵
- Executes dropped EXE
PID:1524 -
\??\c:\fxlxllx.exec:\fxlxllx.exe58⤵
- Executes dropped EXE
PID:2432 -
\??\c:\hhnnnn.exec:\hhnnnn.exe59⤵
- Executes dropped EXE
PID:2184 -
\??\c:\1tbbbb.exec:\1tbbbb.exe60⤵
- Executes dropped EXE
PID:2448 -
\??\c:\ppvjp.exec:\ppvjp.exe61⤵
- Executes dropped EXE
PID:2972 -
\??\c:\rrlfllf.exec:\rrlfllf.exe62⤵
- Executes dropped EXE
PID:1592 -
\??\c:\5xfxxxf.exec:\5xfxxxf.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2376 -
\??\c:\tnhhhh.exec:\tnhhhh.exe64⤵
- Executes dropped EXE
PID:1948 -
\??\c:\vvppv.exec:\vvppv.exe65⤵
- Executes dropped EXE
PID:664 -
\??\c:\dvppv.exec:\dvppv.exe66⤵PID:1860
-
\??\c:\lxrlrrx.exec:\lxrlrrx.exe67⤵PID:1960
-
\??\c:\hthhhh.exec:\hthhhh.exe68⤵PID:1372
-
\??\c:\1nhhhh.exec:\1nhhhh.exe69⤵PID:2896
-
\??\c:\3jpjp.exec:\3jpjp.exe70⤵PID:2956
-
\??\c:\vpdpv.exec:\vpdpv.exe71⤵PID:2968
-
\??\c:\rfxxfxf.exec:\rfxxfxf.exe72⤵PID:612
-
\??\c:\hbttbh.exec:\hbttbh.exe73⤵PID:884
-
\??\c:\7btnnn.exec:\7btnnn.exe74⤵PID:1628
-
\??\c:\dppjp.exec:\dppjp.exe75⤵PID:2368
-
\??\c:\fxffffl.exec:\fxffffl.exe76⤵PID:1056
-
\??\c:\rfrxxxl.exec:\rfrxxxl.exe77⤵PID:2648
-
\??\c:\1thhbn.exec:\1thhbn.exe78⤵PID:1624
-
\??\c:\thtbbb.exec:\thtbbb.exe79⤵PID:2888
-
\??\c:\5djjp.exec:\5djjp.exe80⤵PID:3060
-
\??\c:\frfxxll.exec:\frfxxll.exe81⤵PID:2796
-
\??\c:\1hnntb.exec:\1hnntb.exe82⤵PID:2708
-
\??\c:\3btttb.exec:\3btttb.exe83⤵PID:2720
-
\??\c:\pdddd.exec:\pdddd.exe84⤵PID:2848
-
\??\c:\frrllff.exec:\frrllff.exe85⤵PID:2780
-
\??\c:\3lxxffr.exec:\3lxxffr.exe86⤵PID:1708
-
\??\c:\htnthb.exec:\htnthb.exe87⤵PID:2188
-
\??\c:\dvppv.exec:\dvppv.exe88⤵PID:2640
-
\??\c:\frxxllx.exec:\frxxllx.exe89⤵PID:3024
-
\??\c:\bbnttb.exec:\bbnttb.exe90⤵PID:672
-
\??\c:\nhtttt.exec:\nhtttt.exe91⤵PID:1532
-
\??\c:\jvdvv.exec:\jvdvv.exe92⤵PID:484
-
\??\c:\rfrrfrf.exec:\rfrrfrf.exe93⤵PID:1352
-
\??\c:\lxllllx.exec:\lxllllx.exe94⤵PID:1928
-
\??\c:\tnbbnn.exec:\tnbbnn.exe95⤵PID:1724
-
\??\c:\5httbh.exec:\5httbh.exe96⤵PID:2020
-
\??\c:\ddvdp.exec:\ddvdp.exe97⤵PID:1476
-
\??\c:\7xrrxxl.exec:\7xrrxxl.exe98⤵PID:584
-
\??\c:\nnnntt.exec:\nnnntt.exe99⤵PID:376
-
\??\c:\nhtttb.exec:\nhtttb.exe100⤵PID:2396
-
\??\c:\dpjpv.exec:\dpjpv.exe101⤵PID:2308
-
\??\c:\3jddp.exec:\3jddp.exe102⤵PID:2268
-
\??\c:\1xrllrr.exec:\1xrllrr.exe103⤵PID:2160
-
\??\c:\tttttb.exec:\tttttb.exe104⤵PID:2972
-
\??\c:\bbthtb.exec:\bbthtb.exe105⤵PID:2208
-
\??\c:\pjvvd.exec:\pjvvd.exe106⤵PID:2376
-
\??\c:\fxrrrxf.exec:\fxrrrxf.exe107⤵PID:560
-
\??\c:\lffflll.exec:\lffflll.exe108⤵PID:1640
-
\??\c:\tnbnth.exec:\tnbnth.exe109⤵PID:1860
-
\??\c:\5pjpv.exec:\5pjpv.exe110⤵PID:2300
-
\??\c:\jjpvj.exec:\jjpvj.exe111⤵PID:2952
-
\??\c:\7rrrrrr.exec:\7rrrrrr.exe112⤵PID:2100
-
\??\c:\xrfxlrf.exec:\xrfxlrf.exe113⤵PID:3048
-
\??\c:\nhnbnt.exec:\nhnbnt.exe114⤵PID:2964
-
\??\c:\vpjdj.exec:\vpjdj.exe115⤵PID:3012
-
\??\c:\9xlfflr.exec:\9xlfflr.exe116⤵PID:2328
-
\??\c:\rfrlrlx.exec:\rfrlrlx.exe117⤵PID:2072
-
\??\c:\3thnth.exec:\3thnth.exe118⤵PID:2084
-
\??\c:\vvpdp.exec:\vvpdp.exe119⤵PID:2484
-
\??\c:\ffxxfff.exec:\ffxxfff.exe120⤵PID:2856
-
\??\c:\lfrlxfl.exec:\lfrlxfl.exe121⤵PID:2284
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-