Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/03/2025, 21:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5698484ea82c3111193fad5882f57b08ef7de12a7d6e42c1506f46a7ea2c6b4f.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
5698484ea82c3111193fad5882f57b08ef7de12a7d6e42c1506f46a7ea2c6b4f.exe
-
Size
457KB
-
MD5
66900a973f941e9a8af51fe715e4a112
-
SHA1
3903ee28689e8fad2d6bbc1a7b9363992929fafa
-
SHA256
5698484ea82c3111193fad5882f57b08ef7de12a7d6e42c1506f46a7ea2c6b4f
-
SHA512
a7b11736757d757570efe5cf50bdbe96ff13e314bf6e5203dcf6b9c300b3daf75916c85b8e3f9d5ea8e51a8f71f62da8ec05637056abb8a241b6288e586e7b95
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeSc:q7Tc2NYHUrAwfMp3CDF
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/2480-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2408-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-22-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1308-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2468-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2140-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3060-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2332-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1112-129-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2972-135-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1816-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1816-167-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1720-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1636-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/868-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1520-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2376-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3056-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1740-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2080-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/600-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-378-0x0000000000260000-0x000000000028A000-memory.dmp family_blackmoon behavioral1/memory/2616-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-390-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/340-404-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3004-420-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2384-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1816-460-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1348-525-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2516-570-0x0000000000260000-0x000000000028A000-memory.dmp family_blackmoon behavioral1/memory/1584-586-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-619-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2624-644-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/264-665-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-666-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2408 3fxxlrr.exe 2108 7hthth.exe 1308 dvdjp.exe 2468 lfxlxfl.exe 2756 5ttbhh.exe 2140 vpjjp.exe 3060 pjjjp.exe 2912 fffxxfr.exe 2644 jjdjp.exe 2632 nhbhtt.exe 2332 vpvvj.exe 2860 bbnthn.exe 1112 dvdvd.exe 2972 nbnntt.exe 2696 dvpdj.exe 2036 tnbnbb.exe 1816 pjddp.exe 808 1thbnn.exe 644 9jdjv.exe 2120 nhbhtn.exe 1720 vvpvj.exe 2312 lfrxllx.exe 868 9vppj.exe 1636 tttttb.exe 1532 nhhnbh.exe 1520 hbnntt.exe 3056 vddpv.exe 2376 nhbhnn.exe 1508 7fxfrlf.exe 1740 pjvvj.exe 1852 3vppp.exe 1576 jdvvj.exe 2496 jppvj.exe 2080 3thtbb.exe 2788 tnbhhn.exe 2748 jjvvd.exe 2736 rxrxflx.exe 2764 bthbbb.exe 2880 jdppv.exe 2732 pdvpd.exe 600 1xllflr.exe 2720 3bbnbh.exe 2616 3btbbh.exe 2648 jjjvd.exe 340 1lfllxl.exe 892 btbbnn.exe 3004 thnntt.exe 2660 jdpdj.exe 2972 3rlxxfr.exe 2384 ttnbhh.exe 1004 pjjpv.exe 1912 lflffll.exe 1816 lfrrffr.exe 2340 htbhnn.exe 1044 pppvd.exe 2132 7dpjj.exe 2360 xrxxlrf.exe 2584 tntbhb.exe 2136 nhbbhn.exe 2128 vpjpv.exe 1756 rlflrrf.exe 1736 9lffrrx.exe 924 hnhtnt.exe 1348 pjdvd.exe -
resource yara_rule behavioral1/memory/2480-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1308-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1816-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/868-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1520-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/600-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1816-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-511-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-518-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1348-525-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-573-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-586-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-612-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-644-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-652-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/264-665-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-679-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1480-692-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-705-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xxlllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lffxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lflxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xxxxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thttbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxxffl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2480 wrote to memory of 2408 2480 5698484ea82c3111193fad5882f57b08ef7de12a7d6e42c1506f46a7ea2c6b4f.exe 30 PID 2480 wrote to memory of 2408 2480 5698484ea82c3111193fad5882f57b08ef7de12a7d6e42c1506f46a7ea2c6b4f.exe 30 PID 2480 wrote to memory of 2408 2480 5698484ea82c3111193fad5882f57b08ef7de12a7d6e42c1506f46a7ea2c6b4f.exe 30 PID 2480 wrote to memory of 2408 2480 5698484ea82c3111193fad5882f57b08ef7de12a7d6e42c1506f46a7ea2c6b4f.exe 30 PID 2408 wrote to memory of 2108 2408 3fxxlrr.exe 31 PID 2408 wrote to memory of 2108 2408 3fxxlrr.exe 31 PID 2408 wrote to memory of 2108 2408 3fxxlrr.exe 31 PID 2408 wrote to memory of 2108 2408 3fxxlrr.exe 31 PID 2108 wrote to memory of 1308 2108 7hthth.exe 32 PID 2108 wrote to memory of 1308 2108 7hthth.exe 32 PID 2108 wrote to memory of 1308 2108 7hthth.exe 32 PID 2108 wrote to memory of 1308 2108 7hthth.exe 32 PID 1308 wrote to memory of 2468 1308 dvdjp.exe 33 PID 1308 wrote to memory of 2468 1308 dvdjp.exe 33 PID 1308 wrote to memory of 2468 1308 dvdjp.exe 33 PID 1308 wrote to memory of 2468 1308 dvdjp.exe 33 PID 2468 wrote to memory of 2756 2468 lfxlxfl.exe 34 PID 2468 wrote to memory of 2756 2468 lfxlxfl.exe 34 PID 2468 wrote to memory of 2756 2468 lfxlxfl.exe 34 PID 2468 wrote to memory of 2756 2468 lfxlxfl.exe 34 PID 2756 wrote to memory of 2140 2756 5ttbhh.exe 35 PID 2756 wrote to memory of 2140 2756 5ttbhh.exe 35 PID 2756 wrote to memory of 2140 2756 5ttbhh.exe 35 PID 2756 wrote to memory of 2140 2756 5ttbhh.exe 35 PID 2140 wrote to memory of 3060 2140 vpjjp.exe 36 PID 2140 wrote to memory of 3060 2140 vpjjp.exe 36 PID 2140 wrote to memory of 3060 2140 vpjjp.exe 36 PID 2140 wrote to memory of 3060 2140 vpjjp.exe 36 PID 3060 wrote to memory of 2912 3060 pjjjp.exe 37 PID 3060 wrote to memory of 2912 3060 pjjjp.exe 37 PID 3060 wrote to memory of 2912 3060 pjjjp.exe 37 PID 3060 wrote to memory of 2912 3060 pjjjp.exe 37 PID 2912 wrote to memory of 2644 2912 fffxxfr.exe 38 PID 2912 wrote to memory of 2644 2912 fffxxfr.exe 38 PID 2912 wrote to memory of 2644 2912 fffxxfr.exe 38 PID 2912 wrote to memory of 2644 2912 fffxxfr.exe 38 PID 2644 wrote to memory of 2632 2644 jjdjp.exe 39 PID 2644 wrote to memory of 2632 2644 jjdjp.exe 39 PID 2644 wrote to memory of 2632 2644 jjdjp.exe 39 PID 2644 wrote to memory of 2632 2644 jjdjp.exe 39 PID 2632 wrote to memory of 2332 2632 nhbhtt.exe 40 PID 2632 wrote to memory of 2332 2632 nhbhtt.exe 40 PID 2632 wrote to memory of 2332 2632 nhbhtt.exe 40 PID 2632 wrote to memory of 2332 2632 nhbhtt.exe 40 PID 2332 wrote to memory of 2860 2332 vpvvj.exe 41 PID 2332 wrote to memory of 2860 2332 vpvvj.exe 41 PID 2332 wrote to memory of 2860 2332 vpvvj.exe 41 PID 2332 wrote to memory of 2860 2332 vpvvj.exe 41 PID 2860 wrote to memory of 1112 2860 bbnthn.exe 42 PID 2860 wrote to memory of 1112 2860 bbnthn.exe 42 PID 2860 wrote to memory of 1112 2860 bbnthn.exe 42 PID 2860 wrote to memory of 1112 2860 bbnthn.exe 42 PID 1112 wrote to memory of 2972 1112 dvdvd.exe 43 PID 1112 wrote to memory of 2972 1112 dvdvd.exe 43 PID 1112 wrote to memory of 2972 1112 dvdvd.exe 43 PID 1112 wrote to memory of 2972 1112 dvdvd.exe 43 PID 2972 wrote to memory of 2696 2972 nbnntt.exe 44 PID 2972 wrote to memory of 2696 2972 nbnntt.exe 44 PID 2972 wrote to memory of 2696 2972 nbnntt.exe 44 PID 2972 wrote to memory of 2696 2972 nbnntt.exe 44 PID 2696 wrote to memory of 2036 2696 dvpdj.exe 45 PID 2696 wrote to memory of 2036 2696 dvpdj.exe 45 PID 2696 wrote to memory of 2036 2696 dvpdj.exe 45 PID 2696 wrote to memory of 2036 2696 dvpdj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\5698484ea82c3111193fad5882f57b08ef7de12a7d6e42c1506f46a7ea2c6b4f.exe"C:\Users\Admin\AppData\Local\Temp\5698484ea82c3111193fad5882f57b08ef7de12a7d6e42c1506f46a7ea2c6b4f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\3fxxlrr.exec:\3fxxlrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\7hthth.exec:\7hthth.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\dvdjp.exec:\dvdjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
\??\c:\lfxlxfl.exec:\lfxlxfl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\5ttbhh.exec:\5ttbhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\vpjjp.exec:\vpjjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\pjjjp.exec:\pjjjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\fffxxfr.exec:\fffxxfr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\jjdjp.exec:\jjdjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\nhbhtt.exec:\nhbhtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\vpvvj.exec:\vpvvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\bbnthn.exec:\bbnthn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\dvdvd.exec:\dvdvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
\??\c:\nbnntt.exec:\nbnntt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\dvpdj.exec:\dvpdj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\tnbnbb.exec:\tnbnbb.exe17⤵
- Executes dropped EXE
PID:2036 -
\??\c:\pjddp.exec:\pjddp.exe18⤵
- Executes dropped EXE
PID:1816 -
\??\c:\1thbnn.exec:\1thbnn.exe19⤵
- Executes dropped EXE
PID:808 -
\??\c:\9jdjv.exec:\9jdjv.exe20⤵
- Executes dropped EXE
PID:644 -
\??\c:\nhbhtn.exec:\nhbhtn.exe21⤵
- Executes dropped EXE
PID:2120 -
\??\c:\vvpvj.exec:\vvpvj.exe22⤵
- Executes dropped EXE
PID:1720 -
\??\c:\lfrxllx.exec:\lfrxllx.exe23⤵
- Executes dropped EXE
PID:2312 -
\??\c:\9vppj.exec:\9vppj.exe24⤵
- Executes dropped EXE
PID:868 -
\??\c:\tttttb.exec:\tttttb.exe25⤵
- Executes dropped EXE
PID:1636 -
\??\c:\nhhnbh.exec:\nhhnbh.exe26⤵
- Executes dropped EXE
PID:1532 -
\??\c:\hbnntt.exec:\hbnntt.exe27⤵
- Executes dropped EXE
PID:1520 -
\??\c:\vddpv.exec:\vddpv.exe28⤵
- Executes dropped EXE
PID:3056 -
\??\c:\nhbhnn.exec:\nhbhnn.exe29⤵
- Executes dropped EXE
PID:2376 -
\??\c:\7fxfrlf.exec:\7fxfrlf.exe30⤵
- Executes dropped EXE
PID:1508 -
\??\c:\pjvvj.exec:\pjvvj.exe31⤵
- Executes dropped EXE
PID:1740 -
\??\c:\3vppp.exec:\3vppp.exe32⤵
- Executes dropped EXE
PID:1852 -
\??\c:\jdvvj.exec:\jdvvj.exe33⤵
- Executes dropped EXE
PID:1576 -
\??\c:\jppvj.exec:\jppvj.exe34⤵
- Executes dropped EXE
PID:2496 -
\??\c:\3thtbb.exec:\3thtbb.exe35⤵
- Executes dropped EXE
PID:2080 -
\??\c:\tnbhhn.exec:\tnbhhn.exe36⤵
- Executes dropped EXE
PID:2788 -
\??\c:\jjvvd.exec:\jjvvd.exe37⤵
- Executes dropped EXE
PID:2748 -
\??\c:\rxrxflx.exec:\rxrxflx.exe38⤵
- Executes dropped EXE
PID:2736 -
\??\c:\bthbbb.exec:\bthbbb.exe39⤵
- Executes dropped EXE
PID:2764 -
\??\c:\jdppv.exec:\jdppv.exe40⤵
- Executes dropped EXE
PID:2880 -
\??\c:\pdvpd.exec:\pdvpd.exe41⤵
- Executes dropped EXE
PID:2732 -
\??\c:\1xllflr.exec:\1xllflr.exe42⤵
- Executes dropped EXE
PID:600 -
\??\c:\3bbnbh.exec:\3bbnbh.exe43⤵
- Executes dropped EXE
PID:2720 -
\??\c:\3btbbh.exec:\3btbbh.exe44⤵
- Executes dropped EXE
PID:2616 -
\??\c:\jjjvd.exec:\jjjvd.exe45⤵
- Executes dropped EXE
PID:2648 -
\??\c:\1lfllxl.exec:\1lfllxl.exe46⤵
- Executes dropped EXE
PID:340 -
\??\c:\btbbnn.exec:\btbbnn.exe47⤵
- Executes dropped EXE
PID:892 -
\??\c:\thnntt.exec:\thnntt.exe48⤵
- Executes dropped EXE
PID:3004 -
\??\c:\jdpdj.exec:\jdpdj.exe49⤵
- Executes dropped EXE
PID:2660 -
\??\c:\3rlxxfr.exec:\3rlxxfr.exe50⤵
- Executes dropped EXE
PID:2972 -
\??\c:\ttnbhh.exec:\ttnbhh.exe51⤵
- Executes dropped EXE
PID:2384 -
\??\c:\pjjpv.exec:\pjjpv.exe52⤵
- Executes dropped EXE
PID:1004 -
\??\c:\lflffll.exec:\lflffll.exe53⤵
- Executes dropped EXE
PID:1912 -
\??\c:\lfrrffr.exec:\lfrrffr.exe54⤵
- Executes dropped EXE
PID:1816 -
\??\c:\htbhnn.exec:\htbhnn.exe55⤵
- Executes dropped EXE
PID:2340 -
\??\c:\pppvd.exec:\pppvd.exe56⤵
- Executes dropped EXE
PID:1044 -
\??\c:\7dpjj.exec:\7dpjj.exe57⤵
- Executes dropped EXE
PID:2132 -
\??\c:\xrxxlrf.exec:\xrxxlrf.exe58⤵
- Executes dropped EXE
PID:2360 -
\??\c:\tntbhb.exec:\tntbhb.exe59⤵
- Executes dropped EXE
PID:2584 -
\??\c:\nhbbhn.exec:\nhbbhn.exe60⤵
- Executes dropped EXE
PID:2136 -
\??\c:\vpjpv.exec:\vpjpv.exe61⤵
- Executes dropped EXE
PID:2128 -
\??\c:\rlflrrf.exec:\rlflrrf.exe62⤵
- Executes dropped EXE
PID:1756 -
\??\c:\9lffrrx.exec:\9lffrrx.exe63⤵
- Executes dropped EXE
PID:1736 -
\??\c:\hnhtnt.exec:\hnhtnt.exe64⤵
- Executes dropped EXE
PID:924 -
\??\c:\pjdvd.exec:\pjdvd.exe65⤵
- Executes dropped EXE
PID:1348 -
\??\c:\lfxxflx.exec:\lfxxflx.exe66⤵PID:532
-
\??\c:\1lrllll.exec:\1lrllll.exe67⤵PID:1944
-
\??\c:\hbttht.exec:\hbttht.exe68⤵PID:2364
-
\??\c:\vvvjv.exec:\vvvjv.exe69⤵PID:1752
-
\??\c:\ppvpv.exec:\ppvpv.exe70⤵PID:852
-
\??\c:\9ffxffr.exec:\9ffxffr.exe71⤵PID:1524
-
\??\c:\httthb.exec:\httthb.exe72⤵PID:2516
-
\??\c:\jdppv.exec:\jdppv.exe73⤵PID:2144
-
\??\c:\ppjvd.exec:\ppjvd.exe74⤵PID:1584
-
\??\c:\rrflrxl.exec:\rrflrxl.exe75⤵PID:2268
-
\??\c:\btnnhn.exec:\btnnhn.exe76⤵PID:1948
-
\??\c:\tnbttt.exec:\tnbttt.exe77⤵PID:2908
-
\??\c:\3vppv.exec:\3vppv.exe78⤵PID:2420
-
\??\c:\9rlxffl.exec:\9rlxffl.exe79⤵PID:2836
-
\??\c:\bbbnhh.exec:\bbbnhh.exe80⤵PID:3064
-
\??\c:\nhnbnb.exec:\nhnbnb.exe81⤵PID:2608
-
\??\c:\pdvvv.exec:\pdvvv.exe82⤵PID:2900
-
\??\c:\lfxflrf.exec:\lfxflrf.exe83⤵PID:2624
-
\??\c:\rlrflrx.exec:\rlrflrx.exe84⤵PID:2636
-
\??\c:\9hbbbb.exec:\9hbbbb.exe85⤵PID:2612
-
\??\c:\jdvjv.exec:\jdvjv.exe86⤵PID:264
-
\??\c:\frlrxxf.exec:\frlrxxf.exe87⤵PID:1832
-
\??\c:\xrxxffl.exec:\xrxxffl.exe88⤵PID:2648
-
\??\c:\nnnhbn.exec:\nnnhbn.exe89⤵PID:1652
-
\??\c:\vvvvj.exec:\vvvvj.exe90⤵PID:276
-
\??\c:\lxlrlfr.exec:\lxlrlfr.exe91⤵PID:1480
-
\??\c:\llffrrx.exec:\llffrrx.exe92⤵PID:2960
-
\??\c:\nnhtnh.exec:\nnhtnh.exe93⤵PID:2848
-
\??\c:\jdddd.exec:\jdddd.exe94⤵PID:1336
-
\??\c:\fxxrflx.exec:\fxxrflx.exe95⤵PID:2948
-
\??\c:\xrrxlrf.exec:\xrrxlrf.exe96⤵PID:3000
-
\??\c:\ntntbb.exec:\ntntbb.exe97⤵PID:856
-
\??\c:\jdpvv.exec:\jdpvv.exe98⤵PID:808
-
\??\c:\3jpjj.exec:\3jpjj.exe99⤵PID:2356
-
\??\c:\3fxxxfr.exec:\3fxxxfr.exe100⤵PID:644
-
\??\c:\9nbbbn.exec:\9nbbbn.exe101⤵PID:2704
-
\??\c:\vpjdp.exec:\vpjdp.exe102⤵PID:976
-
\??\c:\1jvpp.exec:\1jvpp.exe103⤵PID:1604
-
\??\c:\lfrrxfl.exec:\lfrrxfl.exe104⤵PID:1592
-
\??\c:\tnnnhh.exec:\tnnnhh.exe105⤵PID:2208
-
\??\c:\5tntnt.exec:\5tntnt.exe106⤵PID:916
-
\??\c:\dvpdj.exec:\dvpdj.exe107⤵PID:1860
-
\??\c:\llxfxfr.exec:\llxfxfr.exe108⤵PID:716
-
\??\c:\rlflllr.exec:\rlflllr.exe109⤵PID:2492
-
\??\c:\bbnntb.exec:\bbnntb.exe110⤵PID:1944
-
\??\c:\pdpjp.exec:\pdpjp.exe111⤵PID:3056
-
\??\c:\5dpjv.exec:\5dpjv.exe112⤵PID:2072
-
\??\c:\rxrxflx.exec:\rxrxflx.exe113⤵PID:1524
-
\??\c:\9lffxfr.exec:\9lffxfr.exe114⤵
- System Location Discovery: System Language Discovery
PID:2292 -
\??\c:\7tnthn.exec:\7tnthn.exe115⤵PID:2020
-
\??\c:\bbtnhn.exec:\bbtnhn.exe116⤵PID:1576
-
\??\c:\jpddj.exec:\jpddj.exe117⤵PID:1308
-
\??\c:\xxrrfxr.exec:\xxrrfxr.exe118⤵PID:2108
-
\??\c:\ttthtb.exec:\ttthtb.exe119⤵PID:1952
-
\??\c:\9pvpv.exec:\9pvpv.exe120⤵PID:1624
-
\??\c:\ffxlrrx.exec:\ffxlrrx.exe121⤵PID:2836
-
\??\c:\nhnntt.exec:\nhnntt.exe122⤵PID:588
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-