Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/03/2025, 19:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4802dcc7e09a05cb13c2312de9aeefeeda2e3adb31a64221268d60f4e6f22967.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
4802dcc7e09a05cb13c2312de9aeefeeda2e3adb31a64221268d60f4e6f22967.exe
-
Size
458KB
-
MD5
784872ea17556eb59718107706d52b98
-
SHA1
626bbdd4366e12b055edcfcb944181a17e35d44c
-
SHA256
4802dcc7e09a05cb13c2312de9aeefeeda2e3adb31a64221268d60f4e6f22967
-
SHA512
5369e2b0ae1bbd0476e99e0e2723c1eb20456e137924e3e4bbd56aaf74055381367169398f18e3b2a29d0b895ef04471fedded5a8505a028f7771f6c027a129f
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe5:q7Tc2NYHUrAwfMp3CD5
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/2452-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2084-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1664-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-56-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2768-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1484-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1984-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3060-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1840-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1572-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-216-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1960-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/988-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2092-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2092-294-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2504-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2244-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2036-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2244-348-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2664-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1020-452-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/860-466-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2052-480-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1084-554-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1504-617-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/2912-642-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-784-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2164-838-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2512 pdjjp.exe 2084 tbtttn.exe 1664 pdpvd.exe 1504 rfrrffr.exe 2768 jjdvd.exe 2880 7lxrxxf.exe 2928 tbhbhh.exe 3032 1lxrrrf.exe 2824 1bbbnt.exe 2672 djjpv.exe 1484 xrflrrf.exe 2980 vpvvd.exe 2956 lfrxflx.exe 2936 dvjjp.exe 2688 frflrlr.exe 3012 1tntbn.exe 1984 1pvpp.exe 2204 btnbnn.exe 3060 dpjvp.exe 1840 tnhntt.exe 2104 ddvvd.exe 1572 3hnbbh.exe 1856 pjpvd.exe 1960 bbnthn.exe 1088 vpddd.exe 1408 bhbthh.exe 1300 pdvdp.exe 988 3nbhbh.exe 1708 hbtbnt.exe 2092 1rrrffl.exe 2504 nhbhnn.exe 1528 3rfflll.exe 2244 thtntt.exe 1864 9jddd.exe 2036 jdppv.exe 2260 1nhnhn.exe 2856 bnhhbb.exe 2768 vvjpp.exe 2636 5frrlrx.exe 2664 5bthnn.exe 1644 htnbnt.exe 2044 ddjvj.exe 2660 5jddj.exe 2800 xrlllrr.exe 2796 7bnhhn.exe 2236 ppppd.exe 3036 rlxrrrf.exe 2992 9rfrlll.exe 3040 nhtbhb.exe 3000 1jvpj.exe 2844 dpdvd.exe 1020 rlxxllr.exe 3012 bthhhb.exe 860 7pddv.exe 2192 vjppp.exe 2052 rffrrxf.exe 2208 3htnnh.exe 1232 nnhhhh.exe 956 ddpdv.exe 2104 flxxxxl.exe 1828 lfxxfxf.exe 1852 tnbhtt.exe 1848 3bnnnn.exe 948 jjdvj.exe -
resource yara_rule behavioral1/memory/2452-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1504-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-57-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2880-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1484-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1484-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1840-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1840-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1572-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/988-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/988-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1020-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-473-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1084-554-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-596-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-642-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-655-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-734-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-741-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1728-743-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-784-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/1692-788-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1092-795-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7btbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bbhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xllxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2452 wrote to memory of 2512 2452 4802dcc7e09a05cb13c2312de9aeefeeda2e3adb31a64221268d60f4e6f22967.exe 30 PID 2452 wrote to memory of 2512 2452 4802dcc7e09a05cb13c2312de9aeefeeda2e3adb31a64221268d60f4e6f22967.exe 30 PID 2452 wrote to memory of 2512 2452 4802dcc7e09a05cb13c2312de9aeefeeda2e3adb31a64221268d60f4e6f22967.exe 30 PID 2452 wrote to memory of 2512 2452 4802dcc7e09a05cb13c2312de9aeefeeda2e3adb31a64221268d60f4e6f22967.exe 30 PID 2512 wrote to memory of 2084 2512 pdjjp.exe 31 PID 2512 wrote to memory of 2084 2512 pdjjp.exe 31 PID 2512 wrote to memory of 2084 2512 pdjjp.exe 31 PID 2512 wrote to memory of 2084 2512 pdjjp.exe 31 PID 2084 wrote to memory of 1664 2084 tbtttn.exe 32 PID 2084 wrote to memory of 1664 2084 tbtttn.exe 32 PID 2084 wrote to memory of 1664 2084 tbtttn.exe 32 PID 2084 wrote to memory of 1664 2084 tbtttn.exe 32 PID 1664 wrote to memory of 1504 1664 pdpvd.exe 33 PID 1664 wrote to memory of 1504 1664 pdpvd.exe 33 PID 1664 wrote to memory of 1504 1664 pdpvd.exe 33 PID 1664 wrote to memory of 1504 1664 pdpvd.exe 33 PID 1504 wrote to memory of 2768 1504 rfrrffr.exe 34 PID 1504 wrote to memory of 2768 1504 rfrrffr.exe 34 PID 1504 wrote to memory of 2768 1504 rfrrffr.exe 34 PID 1504 wrote to memory of 2768 1504 rfrrffr.exe 34 PID 2768 wrote to memory of 2880 2768 jjdvd.exe 35 PID 2768 wrote to memory of 2880 2768 jjdvd.exe 35 PID 2768 wrote to memory of 2880 2768 jjdvd.exe 35 PID 2768 wrote to memory of 2880 2768 jjdvd.exe 35 PID 2880 wrote to memory of 2928 2880 7lxrxxf.exe 36 PID 2880 wrote to memory of 2928 2880 7lxrxxf.exe 36 PID 2880 wrote to memory of 2928 2880 7lxrxxf.exe 36 PID 2880 wrote to memory of 2928 2880 7lxrxxf.exe 36 PID 2928 wrote to memory of 3032 2928 tbhbhh.exe 37 PID 2928 wrote to memory of 3032 2928 tbhbhh.exe 37 PID 2928 wrote to memory of 3032 2928 tbhbhh.exe 37 PID 2928 wrote to memory of 3032 2928 tbhbhh.exe 37 PID 3032 wrote to memory of 2824 3032 1lxrrrf.exe 38 PID 3032 wrote to memory of 2824 3032 1lxrrrf.exe 38 PID 3032 wrote to memory of 2824 3032 1lxrrrf.exe 38 PID 3032 wrote to memory of 2824 3032 1lxrrrf.exe 38 PID 2824 wrote to memory of 2672 2824 1bbbnt.exe 39 PID 2824 wrote to memory of 2672 2824 1bbbnt.exe 39 PID 2824 wrote to memory of 2672 2824 1bbbnt.exe 39 PID 2824 wrote to memory of 2672 2824 1bbbnt.exe 39 PID 2672 wrote to memory of 1484 2672 djjpv.exe 40 PID 2672 wrote to memory of 1484 2672 djjpv.exe 40 PID 2672 wrote to memory of 1484 2672 djjpv.exe 40 PID 2672 wrote to memory of 1484 2672 djjpv.exe 40 PID 1484 wrote to memory of 2980 1484 xrflrrf.exe 41 PID 1484 wrote to memory of 2980 1484 xrflrrf.exe 41 PID 1484 wrote to memory of 2980 1484 xrflrrf.exe 41 PID 1484 wrote to memory of 2980 1484 xrflrrf.exe 41 PID 2980 wrote to memory of 2956 2980 vpvvd.exe 42 PID 2980 wrote to memory of 2956 2980 vpvvd.exe 42 PID 2980 wrote to memory of 2956 2980 vpvvd.exe 42 PID 2980 wrote to memory of 2956 2980 vpvvd.exe 42 PID 2956 wrote to memory of 2936 2956 lfrxflx.exe 43 PID 2956 wrote to memory of 2936 2956 lfrxflx.exe 43 PID 2956 wrote to memory of 2936 2956 lfrxflx.exe 43 PID 2956 wrote to memory of 2936 2956 lfrxflx.exe 43 PID 2936 wrote to memory of 2688 2936 dvjjp.exe 44 PID 2936 wrote to memory of 2688 2936 dvjjp.exe 44 PID 2936 wrote to memory of 2688 2936 dvjjp.exe 44 PID 2936 wrote to memory of 2688 2936 dvjjp.exe 44 PID 2688 wrote to memory of 3012 2688 frflrlr.exe 45 PID 2688 wrote to memory of 3012 2688 frflrlr.exe 45 PID 2688 wrote to memory of 3012 2688 frflrlr.exe 45 PID 2688 wrote to memory of 3012 2688 frflrlr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\4802dcc7e09a05cb13c2312de9aeefeeda2e3adb31a64221268d60f4e6f22967.exe"C:\Users\Admin\AppData\Local\Temp\4802dcc7e09a05cb13c2312de9aeefeeda2e3adb31a64221268d60f4e6f22967.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\pdjjp.exec:\pdjjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\tbtttn.exec:\tbtttn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\pdpvd.exec:\pdpvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\rfrrffr.exec:\rfrrffr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
\??\c:\jjdvd.exec:\jjdvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\7lxrxxf.exec:\7lxrxxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\tbhbhh.exec:\tbhbhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\1lxrrrf.exec:\1lxrrrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\1bbbnt.exec:\1bbbnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\djjpv.exec:\djjpv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\xrflrrf.exec:\xrflrrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\vpvvd.exec:\vpvvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\lfrxflx.exec:\lfrxflx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\dvjjp.exec:\dvjjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\frflrlr.exec:\frflrlr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\1tntbn.exec:\1tntbn.exe17⤵
- Executes dropped EXE
PID:3012 -
\??\c:\1pvpp.exec:\1pvpp.exe18⤵
- Executes dropped EXE
PID:1984 -
\??\c:\btnbnn.exec:\btnbnn.exe19⤵
- Executes dropped EXE
PID:2204 -
\??\c:\dpjvp.exec:\dpjvp.exe20⤵
- Executes dropped EXE
PID:3060 -
\??\c:\tnhntt.exec:\tnhntt.exe21⤵
- Executes dropped EXE
PID:1840 -
\??\c:\ddvvd.exec:\ddvvd.exe22⤵
- Executes dropped EXE
PID:2104 -
\??\c:\3hnbbh.exec:\3hnbbh.exe23⤵
- Executes dropped EXE
PID:1572 -
\??\c:\pjpvd.exec:\pjpvd.exe24⤵
- Executes dropped EXE
PID:1856 -
\??\c:\bbnthn.exec:\bbnthn.exe25⤵
- Executes dropped EXE
PID:1960 -
\??\c:\vpddd.exec:\vpddd.exe26⤵
- Executes dropped EXE
PID:1088 -
\??\c:\bhbthh.exec:\bhbthh.exe27⤵
- Executes dropped EXE
PID:1408 -
\??\c:\pdvdp.exec:\pdvdp.exe28⤵
- Executes dropped EXE
PID:1300 -
\??\c:\3nbhbh.exec:\3nbhbh.exe29⤵
- Executes dropped EXE
PID:988 -
\??\c:\hbtbnt.exec:\hbtbnt.exe30⤵
- Executes dropped EXE
PID:1708 -
\??\c:\1rrrffl.exec:\1rrrffl.exe31⤵
- Executes dropped EXE
PID:2092 -
\??\c:\nhbhnn.exec:\nhbhnn.exe32⤵
- Executes dropped EXE
PID:2504 -
\??\c:\3rfflll.exec:\3rfflll.exe33⤵
- Executes dropped EXE
PID:1528 -
\??\c:\thtntt.exec:\thtntt.exe34⤵
- Executes dropped EXE
PID:2244 -
\??\c:\9jddd.exec:\9jddd.exe35⤵
- Executes dropped EXE
PID:1864 -
\??\c:\jdppv.exec:\jdppv.exe36⤵
- Executes dropped EXE
PID:2036 -
\??\c:\1nhnhn.exec:\1nhnhn.exe37⤵
- Executes dropped EXE
PID:2260 -
\??\c:\bnhhbb.exec:\bnhhbb.exe38⤵
- Executes dropped EXE
PID:2856 -
\??\c:\vvjpp.exec:\vvjpp.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2768 -
\??\c:\5frrlrx.exec:\5frrlrx.exe40⤵
- Executes dropped EXE
PID:2636 -
\??\c:\5bthnn.exec:\5bthnn.exe41⤵
- Executes dropped EXE
PID:2664 -
\??\c:\htnbnt.exec:\htnbnt.exe42⤵
- Executes dropped EXE
PID:1644 -
\??\c:\ddjvj.exec:\ddjvj.exe43⤵
- Executes dropped EXE
PID:2044 -
\??\c:\5jddj.exec:\5jddj.exe44⤵
- Executes dropped EXE
PID:2660 -
\??\c:\xrlllrr.exec:\xrlllrr.exe45⤵
- Executes dropped EXE
PID:2800 -
\??\c:\7bnhhn.exec:\7bnhhn.exe46⤵
- Executes dropped EXE
PID:2796 -
\??\c:\ppppd.exec:\ppppd.exe47⤵
- Executes dropped EXE
PID:2236 -
\??\c:\rlxrrrf.exec:\rlxrrrf.exe48⤵
- Executes dropped EXE
PID:3036 -
\??\c:\9rfrlll.exec:\9rfrlll.exe49⤵
- Executes dropped EXE
PID:2992 -
\??\c:\nhtbhb.exec:\nhtbhb.exe50⤵
- Executes dropped EXE
PID:3040 -
\??\c:\1jvpj.exec:\1jvpj.exe51⤵
- Executes dropped EXE
PID:3000 -
\??\c:\dpdvd.exec:\dpdvd.exe52⤵
- Executes dropped EXE
PID:2844 -
\??\c:\rlxxllr.exec:\rlxxllr.exe53⤵
- Executes dropped EXE
PID:1020 -
\??\c:\bthhhb.exec:\bthhhb.exe54⤵
- Executes dropped EXE
PID:3012 -
\??\c:\7pddv.exec:\7pddv.exe55⤵
- Executes dropped EXE
PID:860 -
\??\c:\vjppp.exec:\vjppp.exe56⤵
- Executes dropped EXE
PID:2192 -
\??\c:\rffrrxf.exec:\rffrrxf.exe57⤵
- Executes dropped EXE
PID:2052 -
\??\c:\3htnnh.exec:\3htnnh.exe58⤵
- Executes dropped EXE
PID:2208 -
\??\c:\nnhhhh.exec:\nnhhhh.exe59⤵
- Executes dropped EXE
PID:1232 -
\??\c:\ddpdv.exec:\ddpdv.exe60⤵
- Executes dropped EXE
PID:956 -
\??\c:\flxxxxl.exec:\flxxxxl.exe61⤵
- Executes dropped EXE
PID:2104 -
\??\c:\lfxxfxf.exec:\lfxxfxf.exe62⤵
- Executes dropped EXE
PID:1828 -
\??\c:\tnbhtt.exec:\tnbhtt.exe63⤵
- Executes dropped EXE
PID:1852 -
\??\c:\3bnnnn.exec:\3bnnnn.exe64⤵
- Executes dropped EXE
PID:1848 -
\??\c:\jjdvj.exec:\jjdvj.exe65⤵
- Executes dropped EXE
PID:948 -
\??\c:\1lllrxf.exec:\1lllrxf.exe66⤵PID:2360
-
\??\c:\5nhthh.exec:\5nhthh.exe67⤵PID:1088
-
\??\c:\7nbbtt.exec:\7nbbtt.exe68⤵PID:2536
-
\??\c:\vpddp.exec:\vpddp.exe69⤵PID:1084
-
\??\c:\jvppv.exec:\jvppv.exe70⤵PID:2112
-
\??\c:\rlxrxrx.exec:\rlxrxrx.exe71⤵PID:880
-
\??\c:\nbntbb.exec:\nbntbb.exe72⤵PID:1896
-
\??\c:\jdjpv.exec:\jdjpv.exe73⤵PID:2092
-
\??\c:\3vpjp.exec:\3vpjp.exe74⤵PID:2520
-
\??\c:\xxrrxxl.exec:\xxrrxxl.exe75⤵PID:1628
-
\??\c:\bbntbh.exec:\bbntbh.exe76⤵PID:2564
-
\??\c:\nhbnbb.exec:\nhbnbb.exe77⤵PID:2420
-
\??\c:\pvjpj.exec:\pvjpj.exe78⤵PID:2712
-
\??\c:\3lxxlrf.exec:\3lxxlrf.exe79⤵PID:1504
-
\??\c:\tbhbnh.exec:\tbhbnh.exe80⤵PID:2868
-
\??\c:\hnbhnn.exec:\hnbhnn.exe81⤵PID:2252
-
\??\c:\vvvvd.exec:\vvvvd.exe82⤵PID:2836
-
\??\c:\5xllrxf.exec:\5xllrxf.exe83⤵PID:2912
-
\??\c:\fxrlrfr.exec:\fxrlrfr.exe84⤵PID:2524
-
\??\c:\ntttbb.exec:\ntttbb.exe85⤵PID:2632
-
\??\c:\9pjjj.exec:\9pjjj.exe86⤵PID:2044
-
\??\c:\ppvjd.exec:\ppvjd.exe87⤵PID:2680
-
\??\c:\lxrxffr.exec:\lxrxffr.exe88⤵PID:772
-
\??\c:\htnttb.exec:\htnttb.exe89⤵PID:536
-
\??\c:\hbnntt.exec:\hbnntt.exe90⤵PID:1484
-
\??\c:\pjddd.exec:\pjddd.exe91⤵PID:2816
-
\??\c:\rlrrrfr.exec:\rlrrrfr.exe92⤵PID:3016
-
\??\c:\tntbnn.exec:\tntbnn.exe93⤵PID:1292
-
\??\c:\pvvdd.exec:\pvvdd.exe94⤵PID:2716
-
\??\c:\vjppp.exec:\vjppp.exe95⤵PID:1700
-
\??\c:\frffffl.exec:\frffffl.exe96⤵PID:1740
-
\??\c:\hhbthh.exec:\hhbthh.exe97⤵PID:1440
-
\??\c:\nhnnnn.exec:\nhnnnn.exe98⤵PID:1996
-
\??\c:\jdpvd.exec:\jdpvd.exe99⤵PID:2148
-
\??\c:\fxffllr.exec:\fxffllr.exe100⤵PID:1728
-
\??\c:\rlfxffl.exec:\rlfxffl.exe101⤵PID:352
-
\??\c:\7btbbt.exec:\7btbbt.exe102⤵
- System Location Discovery: System Language Discovery
PID:1840 -
\??\c:\3pdjp.exec:\3pdjp.exe103⤵PID:1148
-
\??\c:\7pjjj.exec:\7pjjj.exe104⤵PID:468
-
\??\c:\rlffllx.exec:\rlffllx.exe105⤵PID:340
-
\??\c:\tnhbhn.exec:\tnhbhn.exe106⤵PID:2292
-
\??\c:\1bnhnn.exec:\1bnhnn.exe107⤵PID:1692
-
\??\c:\dvpvd.exec:\dvpvd.exe108⤵PID:1092
-
\??\c:\3nnhnt.exec:\3nnhnt.exe109⤵PID:2024
-
\??\c:\1nhbbb.exec:\1nhbbb.exe110⤵PID:1652
-
\??\c:\vvppp.exec:\vvppp.exe111⤵PID:2140
-
\??\c:\jdpvj.exec:\jdpvj.exe112⤵PID:1660
-
\??\c:\rrrrrrx.exec:\rrrrrrx.exe113⤵PID:1952
-
\??\c:\bnbhhh.exec:\bnbhhh.exe114⤵PID:2164
-
\??\c:\hbhnnn.exec:\hbhnnn.exe115⤵PID:2328
-
\??\c:\vjjjv.exec:\vjjjv.exe116⤵PID:1496
-
\??\c:\xrfxxrx.exec:\xrfxxrx.exe117⤵PID:2504
-
\??\c:\lfrrllx.exec:\lfrrllx.exe118⤵PID:2212
-
\??\c:\hbnntt.exec:\hbnntt.exe119⤵PID:2564
-
\??\c:\vpvpd.exec:\vpvpd.exe120⤵PID:2420
-
\??\c:\xlffrlx.exec:\xlffrlx.exe121⤵PID:1564
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-