Analysis
-
max time kernel
120s -
max time network
21s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
05-08-2024 13:51
Behavioral task
behavioral1
Sample
990baa0992d59a4e80f072d9b0940b60N.exe
Resource
win7-20240708-en
windows7-x64
6 signatures
120 seconds
General
-
Target
990baa0992d59a4e80f072d9b0940b60N.exe
-
Size
120KB
-
MD5
990baa0992d59a4e80f072d9b0940b60
-
SHA1
4016971635c47a629d8adcfd9b5313b14552ea54
-
SHA256
d2736c3002498c2a19a49773829563ef210ba9acf61638001ea5bf4362c0d2d8
-
SHA512
5814874f6ff13638580e0120778e24531b5d56e696c3bc98fd946dc2818e0b42a3d10b4aa50b4435394c44e5e867ba2b7e0851d9b61453c6e5f1d1f6bc9691cf
-
SSDEEP
3072:9hOmTsF93UYfwC6GIoutz5yLpcgDE49IIoO:9cm4FmowdHoS0IIoO
Malware Config
Signatures
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/2364-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/476-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2396-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1924-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2700-43-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2700-45-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2700-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2856-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2580-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2600-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2604-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3032-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1960-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2032-122-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2032-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1356-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2372-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1488-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1668-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1872-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2928-193-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1132-226-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2184-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1416-297-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2148-305-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2936-318-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1096-332-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2428-333-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2700-346-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/752-419-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2512-445-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2652-588-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2612-632-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2352-645-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2648-658-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1920-710-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2516-722-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1084-737-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2932-763-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1600-862-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2864-891-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2824-1170-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2868-1236-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2232-1379-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2304-1411-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 476 bththn.exe 2396 7jjvj.exe 1924 tnbhht.exe 2700 hbhnhh.exe 2856 ppdjp.exe 2580 lfxlfrr.exe 2600 bbtnnt.exe 2492 vpjjv.exe 2604 xlflrrx.exe 3032 nhttbh.exe 548 nhtnbb.exe 1960 ddvdj.exe 2032 rlxrxrf.exe 1356 fxflxxf.exe 2372 5pvdj.exe 1868 pvddv.exe 1488 xxffxxf.exe 1668 1ttnht.exe 1872 jdjjp.exe 2928 jdvdd.exe 2272 lfllrlx.exe 2424 ttthht.exe 796 3nhtnn.exe 1132 jvppd.exe 2496 9xlffff.exe 764 rxfxrrl.exe 2184 nhbbtn.exe 2296 ddvjv.exe 808 5rlxllr.exe 1972 nbnthn.exe 1644 7nbbhb.exe 2164 jdjjv.exe 1416 rlfxlrl.exe 2148 3lxlxxl.exe 1976 3nnthn.exe 2936 1hhtbh.exe 2756 ddjjp.exe 1096 7xxxflx.exe 2428 lfffrrf.exe 2700 9thnnn.exe 2264 hbtntt.exe 2768 5jdjp.exe 2580 dvdpd.exe 2684 lfxlxfl.exe 2592 hbthnb.exe 3024 7nnntt.exe 2316 vvjvp.exe 1392 vpdjp.exe 276 rflllrf.exe 1104 xlfrfxl.exe 2120 nhhntb.exe 2500 vpjpd.exe 752 llffxlf.exe 1356 xfxxffx.exe 1928 5httbb.exe 2512 1pdjv.exe 2040 pjpvj.exe 2036 llrlxlf.exe 2044 hhnbnt.exe 2920 9bbhbb.exe 2668 jvvpd.exe 2932 lrrrffr.exe 2776 llxrllx.exe 2132 5nbbbb.exe -
resource yara_rule behavioral1/memory/2364-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2364-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/476-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000016dd3-9.dat upx behavioral1/memory/2396-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000175e4-17.dat upx behavioral1/files/0x0006000000018718-25.dat upx behavioral1/memory/2396-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018728-35.dat upx behavioral1/memory/1924-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000018b7d-47.dat upx behavioral1/memory/2700-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2856-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000018ba5-56.dat upx behavioral1/memory/2580-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000018bb8-64.dat upx behavioral1/memory/2580-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194e0-75.dat upx behavioral1/memory/2600-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194e9-81.dat upx behavioral1/memory/2604-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194f3-93.dat upx behavioral1/memory/2604-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3032-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019503-99.dat upx behavioral1/memory/548-103-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019526-111.dat upx behavioral1/files/0x0005000000019553-118.dat upx behavioral1/memory/1960-120-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2032-122-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019557-130.dat upx behavioral1/memory/2032-129-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019571-137.dat upx behavioral1/memory/1356-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195c9-149.dat upx behavioral1/memory/2372-148-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001960a-156.dat upx behavioral1/memory/1488-165-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001960c-166.dat upx behavioral1/files/0x000500000001960e-172.dat upx behavioral1/memory/1668-175-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1872-183-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019610-184.dat upx behavioral1/files/0x0005000000019612-191.dat upx behavioral1/memory/2928-193-0x00000000001B0000-0x00000000001D7000-memory.dmp upx behavioral1/files/0x0005000000019614-201.dat upx behavioral1/memory/2424-202-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019615-209.dat upx behavioral1/files/0x0005000000019616-218.dat upx behavioral1/memory/1132-226-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019618-225.dat upx behavioral1/files/0x000500000001961a-233.dat upx behavioral1/files/0x000500000001961c-242.dat upx behavioral1/files/0x000500000001961e-251.dat upx behavioral1/memory/2184-250-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000a000000017131-259.dat upx behavioral1/files/0x0005000000019620-267.dat upx behavioral1/files/0x0005000000019622-275.dat upx behavioral1/files/0x0005000000019624-283.dat upx behavioral1/memory/1416-297-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2148-298-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2148-305-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2936-318-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1096-332-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbttbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9djdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfxlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htntbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2364 wrote to memory of 476 2364 990baa0992d59a4e80f072d9b0940b60N.exe 31 PID 2364 wrote to memory of 476 2364 990baa0992d59a4e80f072d9b0940b60N.exe 31 PID 2364 wrote to memory of 476 2364 990baa0992d59a4e80f072d9b0940b60N.exe 31 PID 2364 wrote to memory of 476 2364 990baa0992d59a4e80f072d9b0940b60N.exe 31 PID 476 wrote to memory of 2396 476 bththn.exe 32 PID 476 wrote to memory of 2396 476 bththn.exe 32 PID 476 wrote to memory of 2396 476 bththn.exe 32 PID 476 wrote to memory of 2396 476 bththn.exe 32 PID 2396 wrote to memory of 1924 2396 7jjvj.exe 33 PID 2396 wrote to memory of 1924 2396 7jjvj.exe 33 PID 2396 wrote to memory of 1924 2396 7jjvj.exe 33 PID 2396 wrote to memory of 1924 2396 7jjvj.exe 33 PID 1924 wrote to memory of 2700 1924 tnbhht.exe 34 PID 1924 wrote to memory of 2700 1924 tnbhht.exe 34 PID 1924 wrote to memory of 2700 1924 tnbhht.exe 34 PID 1924 wrote to memory of 2700 1924 tnbhht.exe 34 PID 2700 wrote to memory of 2856 2700 hbhnhh.exe 35 PID 2700 wrote to memory of 2856 2700 hbhnhh.exe 35 PID 2700 wrote to memory of 2856 2700 hbhnhh.exe 35 PID 2700 wrote to memory of 2856 2700 hbhnhh.exe 35 PID 2856 wrote to memory of 2580 2856 ppdjp.exe 36 PID 2856 wrote to memory of 2580 2856 ppdjp.exe 36 PID 2856 wrote to memory of 2580 2856 ppdjp.exe 36 PID 2856 wrote to memory of 2580 2856 ppdjp.exe 36 PID 2580 wrote to memory of 2600 2580 lfxlfrr.exe 37 PID 2580 wrote to memory of 2600 2580 lfxlfrr.exe 37 PID 2580 wrote to memory of 2600 2580 lfxlfrr.exe 37 PID 2580 wrote to memory of 2600 2580 lfxlfrr.exe 37 PID 2600 wrote to memory of 2492 2600 bbtnnt.exe 38 PID 2600 wrote to memory of 2492 2600 bbtnnt.exe 38 PID 2600 wrote to memory of 2492 2600 bbtnnt.exe 38 PID 2600 wrote to memory of 2492 2600 bbtnnt.exe 38 PID 2492 wrote to memory of 2604 2492 vpjjv.exe 39 PID 2492 wrote to memory of 2604 2492 vpjjv.exe 39 PID 2492 wrote to memory of 2604 2492 vpjjv.exe 39 PID 2492 wrote to memory of 2604 2492 vpjjv.exe 39 PID 2604 wrote to memory of 3032 2604 xlflrrx.exe 40 PID 2604 wrote to memory of 3032 2604 xlflrrx.exe 40 PID 2604 wrote to memory of 3032 2604 xlflrrx.exe 40 PID 2604 wrote to memory of 3032 2604 xlflrrx.exe 40 PID 3032 wrote to memory of 548 3032 nhttbh.exe 41 PID 3032 wrote to memory of 548 3032 nhttbh.exe 41 PID 3032 wrote to memory of 548 3032 nhttbh.exe 41 PID 3032 wrote to memory of 548 3032 nhttbh.exe 41 PID 548 wrote to memory of 1960 548 nhtnbb.exe 42 PID 548 wrote to memory of 1960 548 nhtnbb.exe 42 PID 548 wrote to memory of 1960 548 nhtnbb.exe 42 PID 548 wrote to memory of 1960 548 nhtnbb.exe 42 PID 1960 wrote to memory of 2032 1960 ddvdj.exe 43 PID 1960 wrote to memory of 2032 1960 ddvdj.exe 43 PID 1960 wrote to memory of 2032 1960 ddvdj.exe 43 PID 1960 wrote to memory of 2032 1960 ddvdj.exe 43 PID 2032 wrote to memory of 1356 2032 rlxrxrf.exe 44 PID 2032 wrote to memory of 1356 2032 rlxrxrf.exe 44 PID 2032 wrote to memory of 1356 2032 rlxrxrf.exe 44 PID 2032 wrote to memory of 1356 2032 rlxrxrf.exe 44 PID 1356 wrote to memory of 2372 1356 fxflxxf.exe 45 PID 1356 wrote to memory of 2372 1356 fxflxxf.exe 45 PID 1356 wrote to memory of 2372 1356 fxflxxf.exe 45 PID 1356 wrote to memory of 2372 1356 fxflxxf.exe 45 PID 2372 wrote to memory of 1868 2372 5pvdj.exe 46 PID 2372 wrote to memory of 1868 2372 5pvdj.exe 46 PID 2372 wrote to memory of 1868 2372 5pvdj.exe 46 PID 2372 wrote to memory of 1868 2372 5pvdj.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\990baa0992d59a4e80f072d9b0940b60N.exe"C:\Users\Admin\AppData\Local\Temp\990baa0992d59a4e80f072d9b0940b60N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\bththn.exec:\bththn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:476 -
\??\c:\7jjvj.exec:\7jjvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\tnbhht.exec:\tnbhht.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\hbhnhh.exec:\hbhnhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\ppdjp.exec:\ppdjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\lfxlfrr.exec:\lfxlfrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\bbtnnt.exec:\bbtnnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\vpjjv.exec:\vpjjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\xlflrrx.exec:\xlflrrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\nhttbh.exec:\nhttbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\nhtnbb.exec:\nhtnbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
\??\c:\ddvdj.exec:\ddvdj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\rlxrxrf.exec:\rlxrxrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\fxflxxf.exec:\fxflxxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
\??\c:\5pvdj.exec:\5pvdj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\pvddv.exec:\pvddv.exe17⤵
- Executes dropped EXE
PID:1868 -
\??\c:\xxffxxf.exec:\xxffxxf.exe18⤵
- Executes dropped EXE
PID:1488 -
\??\c:\1ttnht.exec:\1ttnht.exe19⤵
- Executes dropped EXE
PID:1668 -
\??\c:\jdjjp.exec:\jdjjp.exe20⤵
- Executes dropped EXE
PID:1872 -
\??\c:\jdvdd.exec:\jdvdd.exe21⤵
- Executes dropped EXE
PID:2928 -
\??\c:\lfllrlx.exec:\lfllrlx.exe22⤵
- Executes dropped EXE
PID:2272 -
\??\c:\ttthht.exec:\ttthht.exe23⤵
- Executes dropped EXE
PID:2424 -
\??\c:\3nhtnn.exec:\3nhtnn.exe24⤵
- Executes dropped EXE
PID:796 -
\??\c:\jvppd.exec:\jvppd.exe25⤵
- Executes dropped EXE
PID:1132 -
\??\c:\9xlffff.exec:\9xlffff.exe26⤵
- Executes dropped EXE
PID:2496 -
\??\c:\rxfxrrl.exec:\rxfxrrl.exe27⤵
- Executes dropped EXE
PID:764 -
\??\c:\nhbbtn.exec:\nhbbtn.exe28⤵
- Executes dropped EXE
PID:2184 -
\??\c:\ddvjv.exec:\ddvjv.exe29⤵
- Executes dropped EXE
PID:2296 -
\??\c:\5rlxllr.exec:\5rlxllr.exe30⤵
- Executes dropped EXE
PID:808 -
\??\c:\nbnthn.exec:\nbnthn.exe31⤵
- Executes dropped EXE
PID:1972 -
\??\c:\7nbbhb.exec:\7nbbhb.exe32⤵
- Executes dropped EXE
PID:1644 -
\??\c:\jdjjv.exec:\jdjjv.exe33⤵
- Executes dropped EXE
PID:2164 -
\??\c:\rlfxlrl.exec:\rlfxlrl.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1416 -
\??\c:\3lxlxxl.exec:\3lxlxxl.exe35⤵
- Executes dropped EXE
PID:2148 -
\??\c:\3nnthn.exec:\3nnthn.exe36⤵
- Executes dropped EXE
PID:1976 -
\??\c:\1hhtbh.exec:\1hhtbh.exe37⤵
- Executes dropped EXE
PID:2936 -
\??\c:\ddjjp.exec:\ddjjp.exe38⤵
- Executes dropped EXE
PID:2756 -
\??\c:\7xxxflx.exec:\7xxxflx.exe39⤵
- Executes dropped EXE
PID:1096 -
\??\c:\lfffrrf.exec:\lfffrrf.exe40⤵
- Executes dropped EXE
PID:2428 -
\??\c:\9thnnn.exec:\9thnnn.exe41⤵
- Executes dropped EXE
PID:2700 -
\??\c:\hbtntt.exec:\hbtntt.exe42⤵
- Executes dropped EXE
PID:2264 -
\??\c:\5jdjp.exec:\5jdjp.exe43⤵
- Executes dropped EXE
PID:2768 -
\??\c:\dvdpd.exec:\dvdpd.exe44⤵
- Executes dropped EXE
PID:2580 -
\??\c:\lfxlxfl.exec:\lfxlxfl.exe45⤵
- Executes dropped EXE
PID:2684 -
\??\c:\hbthnb.exec:\hbthnb.exe46⤵
- Executes dropped EXE
PID:2592 -
\??\c:\7nnntt.exec:\7nnntt.exe47⤵
- Executes dropped EXE
PID:3024 -
\??\c:\vvjvp.exec:\vvjvp.exe48⤵
- Executes dropped EXE
PID:2316 -
\??\c:\vpdjp.exec:\vpdjp.exe49⤵
- Executes dropped EXE
PID:1392 -
\??\c:\rflllrf.exec:\rflllrf.exe50⤵
- Executes dropped EXE
PID:276 -
\??\c:\xlfrfxl.exec:\xlfrfxl.exe51⤵
- Executes dropped EXE
PID:1104 -
\??\c:\nhhntb.exec:\nhhntb.exe52⤵
- Executes dropped EXE
PID:2120 -
\??\c:\vpjpd.exec:\vpjpd.exe53⤵
- Executes dropped EXE
PID:2500 -
\??\c:\llffxlf.exec:\llffxlf.exe54⤵
- Executes dropped EXE
PID:752 -
\??\c:\xfxxffx.exec:\xfxxffx.exe55⤵
- Executes dropped EXE
PID:1356 -
\??\c:\5httbb.exec:\5httbb.exe56⤵
- Executes dropped EXE
PID:1928 -
\??\c:\1pdjv.exec:\1pdjv.exe57⤵
- Executes dropped EXE
PID:2512 -
\??\c:\pjpvj.exec:\pjpvj.exe58⤵
- Executes dropped EXE
PID:2040 -
\??\c:\llrlxlf.exec:\llrlxlf.exe59⤵
- Executes dropped EXE
PID:2036 -
\??\c:\hhnbnt.exec:\hhnbnt.exe60⤵
- Executes dropped EXE
PID:2044 -
\??\c:\9bbhbb.exec:\9bbhbb.exe61⤵
- Executes dropped EXE
PID:2920 -
\??\c:\jvvpd.exec:\jvvpd.exe62⤵
- Executes dropped EXE
PID:2668 -
\??\c:\lrrrffr.exec:\lrrrffr.exe63⤵
- Executes dropped EXE
PID:2932 -
\??\c:\llxrllx.exec:\llxrllx.exe64⤵
- Executes dropped EXE
PID:2776 -
\??\c:\5nbbbb.exec:\5nbbbb.exe65⤵
- Executes dropped EXE
PID:2132 -
\??\c:\bbttht.exec:\bbttht.exe66⤵PID:1956
-
\??\c:\9pdjj.exec:\9pdjj.exe67⤵PID:1608
-
\??\c:\vpdpd.exec:\vpdpd.exe68⤵PID:304
-
\??\c:\5xxlxrf.exec:\5xxlxrf.exe69⤵PID:2528
-
\??\c:\ttttnh.exec:\ttttnh.exe70⤵PID:2080
-
\??\c:\5hbbtt.exec:\5hbbtt.exe71⤵PID:1796
-
\??\c:\5pddj.exec:\5pddj.exe72⤵PID:2180
-
\??\c:\xrllllr.exec:\xrllllr.exe73⤵PID:2296
-
\??\c:\ffxxlrf.exec:\ffxxlrf.exe74⤵PID:996
-
\??\c:\5tnnhn.exec:\5tnnhn.exe75⤵PID:2160
-
\??\c:\ttnthh.exec:\ttnthh.exe76⤵PID:680
-
\??\c:\9pdjj.exec:\9pdjj.exe77⤵PID:1864
-
\??\c:\lfxfxfl.exec:\lfxfxfl.exe78⤵PID:2164
-
\??\c:\lfrxflr.exec:\lfrxflr.exe79⤵PID:536
-
\??\c:\tnntht.exec:\tnntht.exe80⤵PID:2652
-
\??\c:\nnntnt.exec:\nnntnt.exe81⤵PID:1568
-
\??\c:\jdjvj.exec:\jdjvj.exe82⤵PID:2936
-
\??\c:\vpdjd.exec:\vpdjd.exe83⤵PID:2168
-
\??\c:\rlxfrxf.exec:\rlxfrxf.exe84⤵PID:2712
-
\??\c:\ffxfxxf.exec:\ffxfxxf.exe85⤵PID:2428
-
\??\c:\thttbb.exec:\thttbb.exe86⤵PID:2724
-
\??\c:\ppdpj.exec:\ppdpj.exe87⤵PID:2892
-
\??\c:\ppdvd.exec:\ppdvd.exe88⤵
- System Location Discovery: System Language Discovery
PID:2612 -
\??\c:\9xlxffl.exec:\9xlxffl.exe89⤵PID:2628
-
\??\c:\llfxlxf.exec:\llfxlxf.exe90⤵PID:2352
-
\??\c:\tnhnbh.exec:\tnhnbh.exe91⤵PID:2648
-
\??\c:\pdpjp.exec:\pdpjp.exe92⤵PID:3036
-
\??\c:\xxlfxxl.exec:\xxlfxxl.exe93⤵PID:3032
-
\??\c:\lfxxlrf.exec:\lfxxlrf.exe94⤵PID:548
-
\??\c:\nbnnbh.exec:\nbnnbh.exe95⤵PID:1312
-
\??\c:\3btbnh.exec:\3btbnh.exe96⤵PID:1960
-
\??\c:\vjvvd.exec:\vjvvd.exe97⤵PID:1136
-
\??\c:\ddvjd.exec:\ddvjd.exe98⤵PID:2100
-
\??\c:\fxfrflr.exec:\fxfrflr.exe99⤵PID:388
-
\??\c:\nbnthn.exec:\nbnthn.exe100⤵PID:1920
-
\??\c:\hbbhnn.exec:\hbbhnn.exe101⤵PID:2516
-
\??\c:\9vjjp.exec:\9vjjp.exe102⤵PID:1224
-
\??\c:\jdppv.exec:\jdppv.exe103⤵PID:1668
-
\??\c:\xlxffll.exec:\xlxffll.exe104⤵PID:1084
-
\??\c:\nbnbhh.exec:\nbnbhh.exe105⤵PID:1368
-
\??\c:\bnbhtt.exec:\bnbhtt.exe106⤵PID:2920
-
\??\c:\7jvvd.exec:\7jvvd.exe107⤵PID:2272
-
\??\c:\frflxxl.exec:\frflxxl.exe108⤵PID:2932
-
\??\c:\fxxflrx.exec:\fxxflrx.exe109⤵PID:2424
-
\??\c:\bthntb.exec:\bthntb.exe110⤵PID:2916
-
\??\c:\3bttbb.exec:\3bttbb.exe111⤵PID:1808
-
\??\c:\vjdjp.exec:\vjdjp.exe112⤵PID:2544
-
\??\c:\jdpjv.exec:\jdpjv.exe113⤵PID:1540
-
\??\c:\5lflrfr.exec:\5lflrfr.exe114⤵PID:2416
-
\??\c:\3thtbb.exec:\3thtbb.exe115⤵PID:2184
-
\??\c:\hbbntt.exec:\hbbntt.exe116⤵PID:2344
-
\??\c:\7vpjp.exec:\7vpjp.exe117⤵PID:2440
-
\??\c:\ddvjv.exec:\ddvjv.exe118⤵PID:2472
-
\??\c:\1lflrfl.exec:\1lflrfl.exe119⤵PID:1888
-
\??\c:\nhtnnn.exec:\nhtnnn.exe120⤵PID:876
-
\??\c:\3tthnh.exec:\3tthnh.exe121⤵PID:972
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-