Analysis
-
max time kernel
114s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
27-07-2024 07:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a633495e6684992e6c4097c18edb3d60N.exe
Resource
win7-20240704-en
windows7-x64
6 signatures
120 seconds
General
-
Target
a633495e6684992e6c4097c18edb3d60N.exe
-
Size
410KB
-
MD5
a633495e6684992e6c4097c18edb3d60
-
SHA1
0627cc9702224ecc307b0f378f3107e701e479ee
-
SHA256
148241a5861a5b580f361d8adcd2bd5d364a386604fe018cd8e9aa54700693f9
-
SHA512
30fe8d8b839df8b696b7437688f6d9233b3f03497b4f8a9a1e1e1b9ae5cb487b1c40622f01b7fbe34953de8ff26b2ab0a92cd64cffbe14d9dc7804ec6db6494f
-
SSDEEP
3072:PhOm2sI93UufdC67cihfmCiiiXAsACF486jJSp1Bwcs:Pcm7ImGddXtWrXD486jJq1Bwcs
Malware Config
Signatures
-
Detect Blackmoon payload 41 IoCs
Processes:
resource yara_rule behavioral1/memory/2516-0-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2872-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2516-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2880-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2636-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1384-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1808-71-0x00000000003B0000-0x00000000003D9000-memory.dmp family_blackmoon behavioral1/memory/1808-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2472-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2500-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2916-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2996-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1292-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/760-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2208-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2180-195-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2280-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2560-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1732-241-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-261-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/928-271-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1400-298-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3068-333-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2604-353-0x0000000000320000-0x0000000000349000-memory.dmp family_blackmoon behavioral1/memory/2896-368-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2416-383-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2388-404-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2388-403-0x00000000005C0000-0x00000000005E9000-memory.dmp family_blackmoon behavioral1/memory/2968-429-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1288-449-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2216-491-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2296-500-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/276-509-0x0000000001C80000-0x0000000001CA9000-memory.dmp family_blackmoon behavioral1/memory/2888-610-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2888-611-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1844-669-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2972-721-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1988-748-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1764-806-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
60000.exerxllrfl.exeppvdj.exe0604088.exe0080208.exe2624200.exe008264.exerxlfflx.exebbhnbt.exeddvpj.exerffxfxr.exe80604.exehnttbt.exe8228286.exebhtbnn.exeppjvv.exe28424.exelrllxfr.exerfrxrxl.exexrlllff.exepjpjp.exe2200088.exe24000.exenbhhht.exehhthhb.exe00280.exe4664280.exexrrxxrx.exe048286.exehbntbb.exebnnttb.exem4026.exelrxxrrf.exerxllfxf.exedpdpd.exeq44240.exellfxflr.exevvvvd.exe0048460.exevjjjp.exe9frffrl.exeflrlxrr.exe3jjjd.exe2204088.exe848226.exe2880808.exetnhttb.exebnntth.exepppdj.exe0606846.exe8284840.exetbnnth.exerrrxlrx.exepvdpp.exerfllxxx.exebbntnt.exe00826.exe88280.exew60824.exew04000.exea4606.exe026424.exe268222.exexflxfrl.exepid process 2872 60000.exe 2880 rxllrfl.exe 2636 ppvdj.exe 2712 0604088.exe 2664 0080208.exe 1808 2624200.exe 1384 008264.exe 2472 rxlfflx.exe 2388 bbhnbt.exe 2404 ddvpj.exe 2500 rffxfxr.exe 2792 80604.exe 2916 hnttbt.exe 2996 8228286.exe 1292 bhtbnn.exe 584 ppjvv.exe 760 28424.exe 2208 lrllxfr.exe 536 rfrxrxl.exe 2180 xrlllff.exe 2364 pjpjp.exe 1064 2200088.exe 2280 24000.exe 2560 nbhhht.exe 1732 hhthhb.exe 2372 00280.exe 2684 4664280.exe 928 xrrxxrx.exe 3056 048286.exe 2680 hbntbb.exe 1400 bnnttb.exe 1724 m4026.exe 2148 lrxxrrf.exe 1572 rxllfxf.exe 2856 dpdpd.exe 3068 q44240.exe 2800 llfxflr.exe 2640 vvvvd.exe 2604 0048460.exe 2648 vjjjp.exe 2896 9frffrl.exe 1892 flrlxrr.exe 1484 3jjjd.exe 2416 2204088.exe 2400 848226.exe 2388 2880808.exe 2524 tnhttb.exe 2788 bnntth.exe 2688 pppdj.exe 2968 0606846.exe 2940 8284840.exe 1940 tbnnth.exe 1288 rrrxlrx.exe 2376 pvdpp.exe 1972 rfllxxx.exe 704 bbntnt.exe 2984 00826.exe 2092 88280.exe 2216 w60824.exe 2296 w04000.exe 1032 a4606.exe 276 026424.exe 2484 268222.exe 2556 xflxfrl.exe -
Processes:
resource yara_rule behavioral1/memory/2516-0-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2516-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2880-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-53-0x0000000000350000-0x0000000000379000-memory.dmp upx behavioral1/memory/2664-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1384-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1808-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2472-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2916-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1292-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/760-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2208-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1064-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2280-216-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1732-241-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-261-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/928-271-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1400-298-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3068-333-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-354-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2896-368-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2416-383-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2400-390-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2388-404-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2968-429-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1288-442-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1288-449-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/704-466-0x0000000000230000-0x0000000000259000-memory.dmp upx behavioral1/memory/2216-491-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2296-500-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1844-669-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2972-714-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1988-748-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1040-755-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2336-762-0x00000000001B0000-0x00000000001D9000-memory.dmp upx behavioral1/memory/1764-806-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1348-813-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
frffxxr.exe6608804.exe6648468.exe3xxxfxl.exehbntbb.exebnntth.exe40040.exe6004806.exeffrxflr.exe82864.exepppvv.exerfrlrll.exejjjvd.exedjvjp.exe266006.exe4880868.exe026408.exe04288.exelrxxlfl.exedpdpd.exevvdpd.exehbhbnt.exe2842288.exe0482648.exe08488.exelfxrfxr.exebhhttb.exe800262.exe40000.exehbhbbn.exew86866.exe5llrfrl.exe9lrllxr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frffxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6608804.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6648468.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xxxfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnntth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40040.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6004806.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82864.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrlrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 266006.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4880868.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 026408.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 04288.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxxlfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2842288.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0482648.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 08488.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxrfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 800262.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40000.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language w86866.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5llrfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lrllxr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a633495e6684992e6c4097c18edb3d60N.exe60000.exerxllrfl.exeppvdj.exe0604088.exe0080208.exe2624200.exe008264.exerxlfflx.exebbhnbt.exeddvpj.exerffxfxr.exe80604.exehnttbt.exe8228286.exebhtbnn.exedescription pid process target process PID 2516 wrote to memory of 2872 2516 a633495e6684992e6c4097c18edb3d60N.exe 60000.exe PID 2516 wrote to memory of 2872 2516 a633495e6684992e6c4097c18edb3d60N.exe 60000.exe PID 2516 wrote to memory of 2872 2516 a633495e6684992e6c4097c18edb3d60N.exe 60000.exe PID 2516 wrote to memory of 2872 2516 a633495e6684992e6c4097c18edb3d60N.exe 60000.exe PID 2872 wrote to memory of 2880 2872 60000.exe rxllrfl.exe PID 2872 wrote to memory of 2880 2872 60000.exe rxllrfl.exe PID 2872 wrote to memory of 2880 2872 60000.exe rxllrfl.exe PID 2872 wrote to memory of 2880 2872 60000.exe rxllrfl.exe PID 2880 wrote to memory of 2636 2880 rxllrfl.exe ppvdj.exe PID 2880 wrote to memory of 2636 2880 rxllrfl.exe ppvdj.exe PID 2880 wrote to memory of 2636 2880 rxllrfl.exe ppvdj.exe PID 2880 wrote to memory of 2636 2880 rxllrfl.exe ppvdj.exe PID 2636 wrote to memory of 2712 2636 ppvdj.exe 0604088.exe PID 2636 wrote to memory of 2712 2636 ppvdj.exe 0604088.exe PID 2636 wrote to memory of 2712 2636 ppvdj.exe 0604088.exe PID 2636 wrote to memory of 2712 2636 ppvdj.exe 0604088.exe PID 2712 wrote to memory of 2664 2712 0604088.exe 0080208.exe PID 2712 wrote to memory of 2664 2712 0604088.exe 0080208.exe PID 2712 wrote to memory of 2664 2712 0604088.exe 0080208.exe PID 2712 wrote to memory of 2664 2712 0604088.exe 0080208.exe PID 2664 wrote to memory of 1808 2664 0080208.exe 2624200.exe PID 2664 wrote to memory of 1808 2664 0080208.exe 2624200.exe PID 2664 wrote to memory of 1808 2664 0080208.exe 2624200.exe PID 2664 wrote to memory of 1808 2664 0080208.exe 2624200.exe PID 1808 wrote to memory of 1384 1808 2624200.exe 008264.exe PID 1808 wrote to memory of 1384 1808 2624200.exe 008264.exe PID 1808 wrote to memory of 1384 1808 2624200.exe 008264.exe PID 1808 wrote to memory of 1384 1808 2624200.exe 008264.exe PID 1384 wrote to memory of 2472 1384 008264.exe rxlfflx.exe PID 1384 wrote to memory of 2472 1384 008264.exe rxlfflx.exe PID 1384 wrote to memory of 2472 1384 008264.exe rxlfflx.exe PID 1384 wrote to memory of 2472 1384 008264.exe rxlfflx.exe PID 2472 wrote to memory of 2388 2472 rxlfflx.exe bbhnbt.exe PID 2472 wrote to memory of 2388 2472 rxlfflx.exe bbhnbt.exe PID 2472 wrote to memory of 2388 2472 rxlfflx.exe bbhnbt.exe PID 2472 wrote to memory of 2388 2472 rxlfflx.exe bbhnbt.exe PID 2388 wrote to memory of 2404 2388 bbhnbt.exe ddvpj.exe PID 2388 wrote to memory of 2404 2388 bbhnbt.exe ddvpj.exe PID 2388 wrote to memory of 2404 2388 bbhnbt.exe ddvpj.exe PID 2388 wrote to memory of 2404 2388 bbhnbt.exe ddvpj.exe PID 2404 wrote to memory of 2500 2404 ddvpj.exe rffxfxr.exe PID 2404 wrote to memory of 2500 2404 ddvpj.exe rffxfxr.exe PID 2404 wrote to memory of 2500 2404 ddvpj.exe rffxfxr.exe PID 2404 wrote to memory of 2500 2404 ddvpj.exe rffxfxr.exe PID 2500 wrote to memory of 2792 2500 rffxfxr.exe 80604.exe PID 2500 wrote to memory of 2792 2500 rffxfxr.exe 80604.exe PID 2500 wrote to memory of 2792 2500 rffxfxr.exe 80604.exe PID 2500 wrote to memory of 2792 2500 rffxfxr.exe 80604.exe PID 2792 wrote to memory of 2916 2792 80604.exe hnttbt.exe PID 2792 wrote to memory of 2916 2792 80604.exe hnttbt.exe PID 2792 wrote to memory of 2916 2792 80604.exe hnttbt.exe PID 2792 wrote to memory of 2916 2792 80604.exe hnttbt.exe PID 2916 wrote to memory of 2996 2916 hnttbt.exe 8228286.exe PID 2916 wrote to memory of 2996 2916 hnttbt.exe 8228286.exe PID 2916 wrote to memory of 2996 2916 hnttbt.exe 8228286.exe PID 2916 wrote to memory of 2996 2916 hnttbt.exe 8228286.exe PID 2996 wrote to memory of 1292 2996 8228286.exe bhtbnn.exe PID 2996 wrote to memory of 1292 2996 8228286.exe bhtbnn.exe PID 2996 wrote to memory of 1292 2996 8228286.exe bhtbnn.exe PID 2996 wrote to memory of 1292 2996 8228286.exe bhtbnn.exe PID 1292 wrote to memory of 584 1292 bhtbnn.exe ppjvv.exe PID 1292 wrote to memory of 584 1292 bhtbnn.exe ppjvv.exe PID 1292 wrote to memory of 584 1292 bhtbnn.exe ppjvv.exe PID 1292 wrote to memory of 584 1292 bhtbnn.exe ppjvv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a633495e6684992e6c4097c18edb3d60N.exe"C:\Users\Admin\AppData\Local\Temp\a633495e6684992e6c4097c18edb3d60N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\60000.exec:\60000.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\rxllrfl.exec:\rxllrfl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\ppvdj.exec:\ppvdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\0604088.exec:\0604088.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\0080208.exec:\0080208.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\2624200.exec:\2624200.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\008264.exec:\008264.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
\??\c:\rxlfflx.exec:\rxlfflx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\bbhnbt.exec:\bbhnbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\ddvpj.exec:\ddvpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\rffxfxr.exec:\rffxfxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\80604.exec:\80604.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\hnttbt.exec:\hnttbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\8228286.exec:\8228286.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\bhtbnn.exec:\bhtbnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
\??\c:\ppjvv.exec:\ppjvv.exe17⤵
- Executes dropped EXE
PID:584 -
\??\c:\28424.exec:\28424.exe18⤵
- Executes dropped EXE
PID:760 -
\??\c:\lrllxfr.exec:\lrllxfr.exe19⤵
- Executes dropped EXE
PID:2208 -
\??\c:\rfrxrxl.exec:\rfrxrxl.exe20⤵
- Executes dropped EXE
PID:536 -
\??\c:\xrlllff.exec:\xrlllff.exe21⤵
- Executes dropped EXE
PID:2180 -
\??\c:\pjpjp.exec:\pjpjp.exe22⤵
- Executes dropped EXE
PID:2364 -
\??\c:\2200088.exec:\2200088.exe23⤵
- Executes dropped EXE
PID:1064 -
\??\c:\24000.exec:\24000.exe24⤵
- Executes dropped EXE
PID:2280 -
\??\c:\nbhhht.exec:\nbhhht.exe25⤵
- Executes dropped EXE
PID:2560 -
\??\c:\hhthhb.exec:\hhthhb.exe26⤵
- Executes dropped EXE
PID:1732 -
\??\c:\00280.exec:\00280.exe27⤵
- Executes dropped EXE
PID:2372 -
\??\c:\4664280.exec:\4664280.exe28⤵
- Executes dropped EXE
PID:2684 -
\??\c:\xrrxxrx.exec:\xrrxxrx.exe29⤵
- Executes dropped EXE
PID:928 -
\??\c:\048286.exec:\048286.exe30⤵
- Executes dropped EXE
PID:3056 -
\??\c:\hbntbb.exec:\hbntbb.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2680 -
\??\c:\bnnttb.exec:\bnnttb.exe32⤵
- Executes dropped EXE
PID:1400 -
\??\c:\m4026.exec:\m4026.exe33⤵
- Executes dropped EXE
PID:1724 -
\??\c:\lrxxrrf.exec:\lrxxrrf.exe34⤵
- Executes dropped EXE
PID:2148 -
\??\c:\rxllfxf.exec:\rxllfxf.exe35⤵
- Executes dropped EXE
PID:1572 -
\??\c:\dpdpd.exec:\dpdpd.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2856 -
\??\c:\q44240.exec:\q44240.exe37⤵
- Executes dropped EXE
PID:3068 -
\??\c:\llfxflr.exec:\llfxflr.exe38⤵
- Executes dropped EXE
PID:2800 -
\??\c:\vvvvd.exec:\vvvvd.exe39⤵
- Executes dropped EXE
PID:2640 -
\??\c:\0048460.exec:\0048460.exe40⤵
- Executes dropped EXE
PID:2604 -
\??\c:\vjjjp.exec:\vjjjp.exe41⤵
- Executes dropped EXE
PID:2648 -
\??\c:\9frffrl.exec:\9frffrl.exe42⤵
- Executes dropped EXE
PID:2896 -
\??\c:\flrlxrr.exec:\flrlxrr.exe43⤵
- Executes dropped EXE
PID:1892 -
\??\c:\3jjjd.exec:\3jjjd.exe44⤵
- Executes dropped EXE
PID:1484 -
\??\c:\2204088.exec:\2204088.exe45⤵
- Executes dropped EXE
PID:2416 -
\??\c:\848226.exec:\848226.exe46⤵
- Executes dropped EXE
PID:2400 -
\??\c:\2880808.exec:\2880808.exe47⤵
- Executes dropped EXE
PID:2388 -
\??\c:\tnhttb.exec:\tnhttb.exe48⤵
- Executes dropped EXE
PID:2524 -
\??\c:\bnntth.exec:\bnntth.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2788 -
\??\c:\pppdj.exec:\pppdj.exe50⤵
- Executes dropped EXE
PID:2688 -
\??\c:\0606846.exec:\0606846.exe51⤵
- Executes dropped EXE
PID:2968 -
\??\c:\8284840.exec:\8284840.exe52⤵
- Executes dropped EXE
PID:2940 -
\??\c:\tbnnth.exec:\tbnnth.exe53⤵
- Executes dropped EXE
PID:1940 -
\??\c:\rrrxlrx.exec:\rrrxlrx.exe54⤵
- Executes dropped EXE
PID:1288 -
\??\c:\pvdpp.exec:\pvdpp.exe55⤵
- Executes dropped EXE
PID:2376 -
\??\c:\rfllxxx.exec:\rfllxxx.exe56⤵
- Executes dropped EXE
PID:1972 -
\??\c:\bbntnt.exec:\bbntnt.exe57⤵
- Executes dropped EXE
PID:704 -
\??\c:\00826.exec:\00826.exe58⤵
- Executes dropped EXE
PID:2984 -
\??\c:\88280.exec:\88280.exe59⤵
- Executes dropped EXE
PID:2092 -
\??\c:\w60824.exec:\w60824.exe60⤵
- Executes dropped EXE
PID:2216 -
\??\c:\w04000.exec:\w04000.exe61⤵
- Executes dropped EXE
PID:2296 -
\??\c:\a4606.exec:\a4606.exe62⤵
- Executes dropped EXE
PID:1032 -
\??\c:\026424.exec:\026424.exe63⤵
- Executes dropped EXE
PID:276 -
\??\c:\268222.exec:\268222.exe64⤵
- Executes dropped EXE
PID:2484 -
\??\c:\xflxfrl.exec:\xflxfrl.exe65⤵
- Executes dropped EXE
PID:2556 -
\??\c:\hntnbb.exec:\hntnbb.exe66⤵PID:684
-
\??\c:\8420684.exec:\8420684.exe67⤵PID:1732
-
\??\c:\rffffff.exec:\rffffff.exe68⤵PID:1568
-
\??\c:\622626.exec:\622626.exe69⤵PID:2072
-
\??\c:\m8042.exec:\m8042.exe70⤵PID:604
-
\??\c:\pvppp.exec:\pvppp.exe71⤵PID:688
-
\??\c:\8222240.exec:\8222240.exe72⤵PID:2360
-
\??\c:\djvpv.exec:\djvpv.exe73⤵PID:1536
-
\??\c:\66640.exec:\66640.exe74⤵PID:1852
-
\??\c:\vdddd.exec:\vdddd.exe75⤵PID:564
-
\??\c:\22066.exec:\22066.exe76⤵PID:1960
-
\??\c:\84426.exec:\84426.exe77⤵PID:2756
-
\??\c:\4448204.exec:\4448204.exe78⤵PID:2888
-
\??\c:\8480266.exec:\8480266.exe79⤵PID:1572
-
\??\c:\jvdjp.exec:\jvdjp.exe80⤵PID:2844
-
\??\c:\xrfrxxf.exec:\xrfrxxf.exe81⤵PID:2848
-
\??\c:\q60446.exec:\q60446.exe82⤵PID:2636
-
\??\c:\66806.exec:\66806.exe83⤵PID:2852
-
\??\c:\s0880.exec:\s0880.exe84⤵PID:2720
-
\??\c:\hhtnnn.exec:\hhtnnn.exe85⤵PID:2648
-
\??\c:\4424222.exec:\4424222.exe86⤵PID:2100
-
\??\c:\06462.exec:\06462.exe87⤵PID:1844
-
\??\c:\ppvjj.exec:\ppvjj.exe88⤵PID:2220
-
\??\c:\rxfrxfr.exec:\rxfrxfr.exe89⤵PID:2396
-
\??\c:\vjpvj.exec:\vjpvj.exe90⤵PID:2420
-
\??\c:\400288.exec:\400288.exe91⤵PID:3020
-
\??\c:\84680.exec:\84680.exe92⤵PID:1704
-
\??\c:\tbhbhn.exec:\tbhbhn.exe93⤵PID:2780
-
\??\c:\664462.exec:\664462.exe94⤵PID:2808
-
\??\c:\rxlxflx.exec:\rxlxflx.exe95⤵PID:2972
-
\??\c:\vvjdp.exec:\vvjdp.exe96⤵PID:2336
-
\??\c:\44060.exec:\44060.exe97⤵PID:2996
-
\??\c:\jvdpp.exec:\jvdpp.exe98⤵PID:1992
-
\??\c:\2468644.exec:\2468644.exe99⤵PID:1988
-
\??\c:\w242680.exec:\w242680.exe100⤵PID:1276
-
\??\c:\m4224.exec:\m4224.exe101⤵PID:1040
-
\??\c:\ntntbb.exec:\ntntbb.exe102⤵PID:2208
-
\??\c:\820442.exec:\820442.exe103⤵PID:2440
-
\??\c:\8862866.exec:\8862866.exe104⤵PID:1048
-
\??\c:\82260.exec:\82260.exe105⤵PID:2212
-
\??\c:\m4406.exec:\m4406.exe106⤵PID:2296
-
\??\c:\08488.exec:\08488.exe107⤵
- System Location Discovery: System Language Discovery
PID:1032 -
\??\c:\bnhttb.exec:\bnhttb.exe108⤵PID:1764
-
\??\c:\hhtntn.exec:\hhtntn.exe109⤵PID:1920
-
\??\c:\9jjdp.exec:\9jjdp.exe110⤵PID:1348
-
\??\c:\dvjpd.exec:\dvjpd.exe111⤵PID:1052
-
\??\c:\pjjpd.exec:\pjjpd.exe112⤵PID:1652
-
\??\c:\frxrxxf.exec:\frxrxxf.exe113⤵PID:908
-
\??\c:\6224480.exec:\6224480.exe114⤵PID:2684
-
\??\c:\pjdvj.exec:\pjdvj.exe115⤵PID:604
-
\??\c:\4806600.exec:\4806600.exe116⤵PID:2104
-
\??\c:\xfxfffx.exec:\xfxfffx.exe117⤵PID:1964
-
\??\c:\2680628.exec:\2680628.exe118⤵PID:1272
-
\??\c:\88440.exec:\88440.exe119⤵PID:1852
-
\??\c:\4400442.exec:\4400442.exe120⤵PID:2236
-
\??\c:\806488.exec:\806488.exe121⤵PID:1820
-
\??\c:\8062208.exec:\8062208.exe122⤵PID:2952
-
\??\c:\4444008.exec:\4444008.exe123⤵PID:2240
-
\??\c:\208080.exec:\208080.exe124⤵PID:2608
-
\??\c:\2220648.exec:\2220648.exe125⤵PID:1708
-
\??\c:\6040266.exec:\6040266.exe126⤵PID:2832
-
\??\c:\88642.exec:\88642.exe127⤵PID:2596
-
\??\c:\k66442.exec:\k66442.exe128⤵PID:2616
-
\??\c:\404286.exec:\404286.exe129⤵PID:2892
-
\??\c:\6464624.exec:\6464624.exe130⤵PID:2136
-
\??\c:\2206868.exec:\2206868.exe131⤵PID:1892
-
\??\c:\rffrrxl.exec:\rffrrxl.exe132⤵PID:2928
-
\??\c:\djdjj.exec:\djdjj.exe133⤵PID:2444
-
\??\c:\ttthbn.exec:\ttthbn.exe134⤵PID:2392
-
\??\c:\w86866.exec:\w86866.exe135⤵
- System Location Discovery: System Language Discovery
PID:3028 -
\??\c:\5dvjv.exec:\5dvjv.exe136⤵PID:2420
-
\??\c:\2228080.exec:\2228080.exe137⤵PID:2776
-
\??\c:\26468.exec:\26468.exe138⤵PID:2812
-
\??\c:\28422.exec:\28422.exe139⤵PID:2688
-
\??\c:\bhnbtn.exec:\bhnbtn.exe140⤵PID:2768
-
\??\c:\xrfxxxf.exec:\xrfxxxf.exe141⤵PID:668
-
\??\c:\vvddv.exec:\vvddv.exe142⤵PID:2336
-
\??\c:\w48440.exec:\w48440.exe143⤵PID:2512
-
\??\c:\nhnhnt.exec:\nhnhnt.exe144⤵PID:1992
-
\??\c:\48424.exec:\48424.exe145⤵PID:760
-
\??\c:\4420208.exec:\4420208.exe146⤵PID:704
-
\??\c:\nnnbnb.exec:\nnnbnb.exe147⤵PID:1040
-
\??\c:\m6644.exec:\m6644.exe148⤵PID:380
-
\??\c:\868844.exec:\868844.exe149⤵PID:1508
-
\??\c:\jpdjj.exec:\jpdjj.exe150⤵PID:444
-
\??\c:\840602.exec:\840602.exe151⤵PID:2260
-
\??\c:\hthhnb.exec:\hthhnb.exe152⤵PID:2228
-
\??\c:\24440.exec:\24440.exe153⤵PID:2280
-
\??\c:\662626.exec:\662626.exe154⤵PID:2484
-
\??\c:\0642200.exec:\0642200.exe155⤵PID:2560
-
\??\c:\3hthbt.exec:\3hthbt.exe156⤵PID:2036
-
\??\c:\666220.exec:\666220.exe157⤵PID:840
-
\??\c:\bbnntt.exec:\bbnntt.exe158⤵PID:1624
-
\??\c:\pjvjp.exec:\pjvjp.exe159⤵PID:1652
-
\??\c:\hbnnhh.exec:\hbnnhh.exe160⤵PID:1664
-
\??\c:\48406.exec:\48406.exe161⤵PID:1056
-
\??\c:\0262268.exec:\0262268.exe162⤵PID:1632
-
\??\c:\lrfxlff.exec:\lrfxlff.exe163⤵PID:1536
-
\??\c:\ffrxflr.exec:\ffrxflr.exe164⤵
- System Location Discovery: System Language Discovery
PID:2680 -
\??\c:\hnttnh.exec:\hnttnh.exe165⤵PID:880
-
\??\c:\2846620.exec:\2846620.exe166⤵PID:1684
-
\??\c:\lxffxll.exec:\lxffxll.exe167⤵PID:2516
-
\??\c:\lflrrxf.exec:\lflrrxf.exe168⤵PID:2548
-
\??\c:\tnbbhb.exec:\tnbbhb.exe169⤵PID:1552
-
\??\c:\lrxrfxf.exec:\lrxrfxf.exe170⤵PID:2144
-
\??\c:\88884.exec:\88884.exe171⤵PID:2872
-
\??\c:\vjjdd.exec:\vjjdd.exe172⤵PID:2764
-
\??\c:\2620860.exec:\2620860.exe173⤵PID:2596
-
\??\c:\28864.exec:\28864.exe174⤵PID:2616
-
\??\c:\vddjj.exec:\vddjj.exe175⤵PID:1808
-
\??\c:\22286.exec:\22286.exe176⤵PID:2100
-
\??\c:\pvjvj.exec:\pvjvj.exe177⤵PID:556
-
\??\c:\004206.exec:\004206.exe178⤵PID:2220
-
\??\c:\bnttnh.exec:\bnttnh.exe179⤵PID:2444
-
\??\c:\44446.exec:\44446.exe180⤵PID:2400
-
\??\c:\tntbhb.exec:\tntbhb.exe181⤵PID:2032
-
\??\c:\k40868.exec:\k40868.exe182⤵PID:1704
-
\??\c:\a4608.exec:\a4608.exe183⤵PID:2932
-
\??\c:\pdpdv.exec:\pdpdv.exe184⤵PID:3052
-
\??\c:\8220460.exec:\8220460.exe185⤵PID:2448
-
\??\c:\084046.exec:\084046.exe186⤵PID:2044
-
\??\c:\tbnnbt.exec:\tbnnbt.exe187⤵PID:2328
-
\??\c:\dpppp.exec:\dpppp.exe188⤵PID:2376
-
\??\c:\46086.exec:\46086.exe189⤵PID:2456
-
\??\c:\6260628.exec:\6260628.exe190⤵PID:1276
-
\??\c:\00028.exec:\00028.exe191⤵PID:2288
-
\??\c:\84882.exec:\84882.exe192⤵PID:2464
-
\??\c:\rfxrxlr.exec:\rfxrxlr.exe193⤵PID:2440
-
\??\c:\2422440.exec:\2422440.exe194⤵PID:820
-
\??\c:\2282866.exec:\2282866.exe195⤵PID:912
-
\??\c:\bbttth.exec:\bbttth.exe196⤵PID:448
-
\??\c:\g2400.exec:\g2400.exe197⤵PID:1636
-
\??\c:\6608262.exec:\6608262.exe198⤵PID:1560
-
\??\c:\rxrrfrx.exec:\rxrrfrx.exe199⤵PID:2280
-
\??\c:\4062860.exec:\4062860.exe200⤵PID:1136
-
\??\c:\rlxlfrx.exec:\rlxlfrx.exe201⤵PID:1348
-
\??\c:\lxrfflx.exec:\lxrfflx.exe202⤵PID:2372
-
\??\c:\bnnbth.exec:\bnnbth.exe203⤵PID:1988
-
\??\c:\hthbhh.exec:\hthbhh.exe204⤵PID:2380
-
\??\c:\flrrxxx.exec:\flrrxxx.exe205⤵PID:2684
-
\??\c:\lrrffxr.exec:\lrrffxr.exe206⤵PID:1644
-
\??\c:\4486486.exec:\4486486.exe207⤵PID:1716
-
\??\c:\206004.exec:\206004.exe208⤵PID:2064
-
\??\c:\6400268.exec:\6400268.exe209⤵PID:876
-
\??\c:\ttbtnb.exec:\ttbtnb.exe210⤵PID:304
-
\??\c:\446808.exec:\446808.exe211⤵PID:1576
-
\??\c:\pdjvj.exec:\pdjvj.exe212⤵PID:1580
-
\??\c:\288600.exec:\288600.exe213⤵PID:2424
-
\??\c:\djpdj.exec:\djpdj.exe214⤵PID:2748
-
\??\c:\888642.exec:\888642.exe215⤵PID:2840
-
\??\c:\860640.exec:\860640.exe216⤵PID:2800
-
\??\c:\thttnn.exec:\thttnn.exe217⤵PID:2716
-
\??\c:\vjpvv.exec:\vjpvv.exe218⤵PID:2604
-
\??\c:\7ddpd.exec:\7ddpd.exe219⤵PID:2644
-
\??\c:\dppdp.exec:\dppdp.exe220⤵PID:2596
-
\??\c:\vpvpd.exec:\vpvpd.exe221⤵PID:376
-
\??\c:\000448.exec:\000448.exe222⤵PID:872
-
\??\c:\668608.exec:\668608.exe223⤵PID:1384
-
\??\c:\jjddj.exec:\jjddj.exe224⤵PID:2928
-
\??\c:\886466.exec:\886466.exe225⤵PID:1236
-
\??\c:\9llrrxl.exec:\9llrrxl.exe226⤵PID:2528
-
\??\c:\60806.exec:\60806.exe227⤵PID:2500
-
\??\c:\rxrxxxr.exec:\rxrxxxr.exe228⤵PID:2796
-
\??\c:\rfrlrll.exec:\rfrlrll.exe229⤵
- System Location Discovery: System Language Discovery
PID:2776 -
\??\c:\lxfxllx.exec:\lxfxllx.exe230⤵PID:2808
-
\??\c:\46444.exec:\46444.exe231⤵PID:2688
-
\??\c:\xrfxxll.exec:\xrfxxll.exe232⤵PID:3012
-
\??\c:\8404482.exec:\8404482.exe233⤵PID:1108
-
\??\c:\tbnbtt.exec:\tbnbtt.exe234⤵PID:2040
-
\??\c:\1pvdd.exec:\1pvdd.exe235⤵PID:2512
-
\??\c:\224602.exec:\224602.exe236⤵PID:2912
-
\??\c:\fffxxxf.exec:\fffxxxf.exe237⤵PID:2456
-
\??\c:\xfflfrl.exec:\xfflfrl.exe238⤵PID:1276
-
\??\c:\jpvvd.exec:\jpvvd.exe239⤵PID:2584
-
\??\c:\66808.exec:\66808.exe240⤵PID:1140
-
\??\c:\622824.exec:\622824.exe241⤵PID:2440
-
\??\c:\6626266.exec:\6626266.exe242⤵PID:820