Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
06/08/2024, 08:03
Behavioral task
behavioral1
Sample
7e880f5a6281d2d8012129f67a1b5340N.exe
Resource
win7-20240705-en
windows7-x64
6 signatures
120 seconds
General
-
Target
7e880f5a6281d2d8012129f67a1b5340N.exe
-
Size
77KB
-
MD5
7e880f5a6281d2d8012129f67a1b5340
-
SHA1
137e73d386c6d9a8e148fa0fc4c473478bb20429
-
SHA256
6e891a0d357b113d2a5c3aae4220e27d37766d9653ffc3a3754b832166edefa9
-
SHA512
cef00dab8354bd371592af256f5917c74a8ed81b995f047b5ba7c47544d0968082ae20347ebceaf7470b794ebb76e35ce18a2d2ed7039296c2e4f1eee382e3cc
-
SSDEEP
1536:kvQBeOGtrYS3srx93UBWfwC6Ggnouy8p5yAXNYWkeu3zLoYNyAN4MFmJyaz:khOmTsF93UYfwC6GIoutpYKkeu3gYNyH
Malware Config
Signatures
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/2752-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3004-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2972-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2796-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2636-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2172-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2640-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1148-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/960-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2104-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2604-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2092-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2860-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2860-119-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2920-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2944-137-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2944-139-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2944-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/868-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1660-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2348-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/328-210-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/860-219-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2012-255-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/888-272-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2796-326-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1340-356-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3032-382-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1276-425-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2436-432-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1956-440-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2296-453-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2244-480-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2436-483-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1412-506-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2864-591-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/604-623-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/324-832-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2208-952-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2380-965-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2520-1005-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2856-1096-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2224-1298-0x00000000003B0000-0x00000000003D7000-memory.dmp family_blackmoon behavioral1/memory/2620-1393-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3004 ppvdp.exe 2972 fxlrffr.exe 2796 btbnht.exe 2636 thnnbb.exe 2172 dvvpp.exe 2640 7xffllr.exe 1148 tthhtn.exe 960 jvjpd.exe 2104 vpvpv.exe 2604 bbntth.exe 2092 htnhhb.exe 2860 djpjp.exe 2920 lfxflrl.exe 2944 hhhnhn.exe 1896 7ppvp.exe 868 fxlrxlf.exe 1660 rlrlxxl.exe 1064 tntnbt.exe 2500 nbntbh.exe 1684 1vjpj.exe 2348 dvvvd.exe 328 rlffxxr.exe 860 9ffxlff.exe 3052 btnthb.exe 2588 1nhnnt.exe 1016 dvddd.exe 2424 vpjpd.exe 2012 xfrxrrf.exe 1812 5htthn.exe 888 bbtntt.exe 1540 jdvdj.exe 2632 lfxlrfr.exe 2900 lrxrrxf.exe 2648 vjvdj.exe 2972 7vvvv.exe 1632 dpdpv.exe 2624 1xllrrx.exe 2796 lfxrxlx.exe 2792 bhhtbn.exe 2084 9bthnn.exe 828 dvjdj.exe 1340 dvvpj.exe 1188 lxlflrf.exe 1168 5lllllr.exe 468 3rfrflx.exe 3032 9btttt.exe 1864 hbnthh.exe 2116 pjvvv.exe 2904 rllrfxl.exe 2860 ffxfxlf.exe 2024 bthtbn.exe 2920 hhthbh.exe 1276 tnntbb.exe 2436 ddppv.exe 1956 vpjjp.exe 2044 5fxfrrx.exe 2296 9xrfrxr.exe 2524 1nttth.exe 1696 nhtbhh.exe 2508 dvpvj.exe 2244 pppdd.exe 2088 frxflff.exe 856 lfxlflx.exe 3000 tnhnbb.exe -
resource yara_rule behavioral1/memory/2752-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2752-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000a000000012029-5.dat upx behavioral1/memory/3004-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2972-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000163b9-17.dat upx behavioral1/memory/2972-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000164cf-27.dat upx behavioral1/files/0x00080000000166c7-33.dat upx behavioral1/memory/2796-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2636-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016c03-45.dat upx behavioral1/files/0x0007000000016c7d-52.dat upx behavioral1/memory/2172-54-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2640-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016d53-64.dat upx behavioral1/memory/2640-63-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000016d74-71.dat upx behavioral1/memory/960-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1148-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/960-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000172a7-84.dat upx behavioral1/memory/2104-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000192fe-92.dat upx behavioral1/memory/2104-94-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2604-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019309-103.dat upx behavioral1/memory/2092-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019346-110.dat upx behavioral1/files/0x0005000000019358-122.dat upx behavioral1/memory/2860-120-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2920-130-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019368-129.dat upx behavioral1/memory/2944-141-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019385-140.dat upx behavioral1/files/0x0005000000019394-148.dat upx behavioral1/memory/868-152-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193a2-158.dat upx behavioral1/files/0x00050000000193c3-166.dat upx behavioral1/memory/1660-168-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193cf-175.dat upx behavioral1/files/0x00050000000193e5-183.dat upx behavioral1/files/0x0005000000019412-191.dat upx behavioral1/files/0x00050000000194f4-199.dat upx behavioral1/memory/2348-201-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/328-210-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194fc-209.dat upx behavioral1/files/0x0005000000019515-218.dat upx behavioral1/memory/860-219-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001951b-226.dat upx behavioral1/files/0x000500000001963f-236.dat upx behavioral1/files/0x0005000000019947-243.dat upx behavioral1/memory/2424-244-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001994b-252.dat upx behavioral1/memory/2012-255-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001994f-261.dat upx behavioral1/files/0x0005000000019a71-269.dat upx behavioral1/memory/888-272-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019c59-278.dat upx behavioral1/files/0x0005000000019c5b-286.dat upx behavioral1/memory/2632-287-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2796-326-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1340-356-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3032-382-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffflxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fxfrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7e880f5a6281d2d8012129f67a1b5340N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflrfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfxxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfxrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xllxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlllrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bththn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2752 wrote to memory of 3004 2752 7e880f5a6281d2d8012129f67a1b5340N.exe 30 PID 2752 wrote to memory of 3004 2752 7e880f5a6281d2d8012129f67a1b5340N.exe 30 PID 2752 wrote to memory of 3004 2752 7e880f5a6281d2d8012129f67a1b5340N.exe 30 PID 2752 wrote to memory of 3004 2752 7e880f5a6281d2d8012129f67a1b5340N.exe 30 PID 3004 wrote to memory of 2972 3004 ppvdp.exe 31 PID 3004 wrote to memory of 2972 3004 ppvdp.exe 31 PID 3004 wrote to memory of 2972 3004 ppvdp.exe 31 PID 3004 wrote to memory of 2972 3004 ppvdp.exe 31 PID 2972 wrote to memory of 2796 2972 fxlrffr.exe 32 PID 2972 wrote to memory of 2796 2972 fxlrffr.exe 32 PID 2972 wrote to memory of 2796 2972 fxlrffr.exe 32 PID 2972 wrote to memory of 2796 2972 fxlrffr.exe 32 PID 2796 wrote to memory of 2636 2796 btbnht.exe 33 PID 2796 wrote to memory of 2636 2796 btbnht.exe 33 PID 2796 wrote to memory of 2636 2796 btbnht.exe 33 PID 2796 wrote to memory of 2636 2796 btbnht.exe 33 PID 2636 wrote to memory of 2172 2636 thnnbb.exe 34 PID 2636 wrote to memory of 2172 2636 thnnbb.exe 34 PID 2636 wrote to memory of 2172 2636 thnnbb.exe 34 PID 2636 wrote to memory of 2172 2636 thnnbb.exe 34 PID 2172 wrote to memory of 2640 2172 dvvpp.exe 35 PID 2172 wrote to memory of 2640 2172 dvvpp.exe 35 PID 2172 wrote to memory of 2640 2172 dvvpp.exe 35 PID 2172 wrote to memory of 2640 2172 dvvpp.exe 35 PID 2640 wrote to memory of 1148 2640 7xffllr.exe 36 PID 2640 wrote to memory of 1148 2640 7xffllr.exe 36 PID 2640 wrote to memory of 1148 2640 7xffllr.exe 36 PID 2640 wrote to memory of 1148 2640 7xffllr.exe 36 PID 1148 wrote to memory of 960 1148 tthhtn.exe 37 PID 1148 wrote to memory of 960 1148 tthhtn.exe 37 PID 1148 wrote to memory of 960 1148 tthhtn.exe 37 PID 1148 wrote to memory of 960 1148 tthhtn.exe 37 PID 960 wrote to memory of 2104 960 jvjpd.exe 38 PID 960 wrote to memory of 2104 960 jvjpd.exe 38 PID 960 wrote to memory of 2104 960 jvjpd.exe 38 PID 960 wrote to memory of 2104 960 jvjpd.exe 38 PID 2104 wrote to memory of 2604 2104 vpvpv.exe 39 PID 2104 wrote to memory of 2604 2104 vpvpv.exe 39 PID 2104 wrote to memory of 2604 2104 vpvpv.exe 39 PID 2104 wrote to memory of 2604 2104 vpvpv.exe 39 PID 2604 wrote to memory of 2092 2604 bbntth.exe 40 PID 2604 wrote to memory of 2092 2604 bbntth.exe 40 PID 2604 wrote to memory of 2092 2604 bbntth.exe 40 PID 2604 wrote to memory of 2092 2604 bbntth.exe 40 PID 2092 wrote to memory of 2860 2092 htnhhb.exe 41 PID 2092 wrote to memory of 2860 2092 htnhhb.exe 41 PID 2092 wrote to memory of 2860 2092 htnhhb.exe 41 PID 2092 wrote to memory of 2860 2092 htnhhb.exe 41 PID 2860 wrote to memory of 2920 2860 djpjp.exe 42 PID 2860 wrote to memory of 2920 2860 djpjp.exe 42 PID 2860 wrote to memory of 2920 2860 djpjp.exe 42 PID 2860 wrote to memory of 2920 2860 djpjp.exe 42 PID 2920 wrote to memory of 2944 2920 lfxflrl.exe 43 PID 2920 wrote to memory of 2944 2920 lfxflrl.exe 43 PID 2920 wrote to memory of 2944 2920 lfxflrl.exe 43 PID 2920 wrote to memory of 2944 2920 lfxflrl.exe 43 PID 2944 wrote to memory of 1896 2944 hhhnhn.exe 44 PID 2944 wrote to memory of 1896 2944 hhhnhn.exe 44 PID 2944 wrote to memory of 1896 2944 hhhnhn.exe 44 PID 2944 wrote to memory of 1896 2944 hhhnhn.exe 44 PID 1896 wrote to memory of 868 1896 7ppvp.exe 45 PID 1896 wrote to memory of 868 1896 7ppvp.exe 45 PID 1896 wrote to memory of 868 1896 7ppvp.exe 45 PID 1896 wrote to memory of 868 1896 7ppvp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e880f5a6281d2d8012129f67a1b5340N.exe"C:\Users\Admin\AppData\Local\Temp\7e880f5a6281d2d8012129f67a1b5340N.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\ppvdp.exec:\ppvdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\fxlrffr.exec:\fxlrffr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\btbnht.exec:\btbnht.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\thnnbb.exec:\thnnbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\dvvpp.exec:\dvvpp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\7xffllr.exec:\7xffllr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\tthhtn.exec:\tthhtn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
\??\c:\jvjpd.exec:\jvjpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:960 -
\??\c:\vpvpv.exec:\vpvpv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\bbntth.exec:\bbntth.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\htnhhb.exec:\htnhhb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\djpjp.exec:\djpjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\lfxflrl.exec:\lfxflrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\hhhnhn.exec:\hhhnhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\7ppvp.exec:\7ppvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
\??\c:\fxlrxlf.exec:\fxlrxlf.exe17⤵
- Executes dropped EXE
PID:868 -
\??\c:\rlrlxxl.exec:\rlrlxxl.exe18⤵
- Executes dropped EXE
PID:1660 -
\??\c:\tntnbt.exec:\tntnbt.exe19⤵
- Executes dropped EXE
PID:1064 -
\??\c:\nbntbh.exec:\nbntbh.exe20⤵
- Executes dropped EXE
PID:2500 -
\??\c:\1vjpj.exec:\1vjpj.exe21⤵
- Executes dropped EXE
PID:1684 -
\??\c:\dvvvd.exec:\dvvvd.exe22⤵
- Executes dropped EXE
PID:2348 -
\??\c:\rlffxxr.exec:\rlffxxr.exe23⤵
- Executes dropped EXE
PID:328 -
\??\c:\9ffxlff.exec:\9ffxlff.exe24⤵
- Executes dropped EXE
PID:860 -
\??\c:\btnthb.exec:\btnthb.exe25⤵
- Executes dropped EXE
PID:3052 -
\??\c:\1nhnnt.exec:\1nhnnt.exe26⤵
- Executes dropped EXE
PID:2588 -
\??\c:\dvddd.exec:\dvddd.exe27⤵
- Executes dropped EXE
PID:1016 -
\??\c:\vpjpd.exec:\vpjpd.exe28⤵
- Executes dropped EXE
PID:2424 -
\??\c:\xfrxrrf.exec:\xfrxrrf.exe29⤵
- Executes dropped EXE
PID:2012 -
\??\c:\5htthn.exec:\5htthn.exe30⤵
- Executes dropped EXE
PID:1812 -
\??\c:\bbtntt.exec:\bbtntt.exe31⤵
- Executes dropped EXE
PID:888 -
\??\c:\jdvdj.exec:\jdvdj.exe32⤵
- Executes dropped EXE
PID:1540 -
\??\c:\lfxlrfr.exec:\lfxlrfr.exe33⤵
- Executes dropped EXE
PID:2632 -
\??\c:\lrxrrxf.exec:\lrxrrxf.exe34⤵
- Executes dropped EXE
PID:2900 -
\??\c:\vjvdj.exec:\vjvdj.exe35⤵
- Executes dropped EXE
PID:2648 -
\??\c:\7vvvv.exec:\7vvvv.exe36⤵
- Executes dropped EXE
PID:2972 -
\??\c:\dpdpv.exec:\dpdpv.exe37⤵
- Executes dropped EXE
PID:1632 -
\??\c:\1xllrrx.exec:\1xllrrx.exe38⤵
- Executes dropped EXE
PID:2624 -
\??\c:\lfxrxlx.exec:\lfxrxlx.exe39⤵
- Executes dropped EXE
PID:2796 -
\??\c:\bhhtbn.exec:\bhhtbn.exe40⤵
- Executes dropped EXE
PID:2792 -
\??\c:\9bthnn.exec:\9bthnn.exe41⤵
- Executes dropped EXE
PID:2084 -
\??\c:\dvjdj.exec:\dvjdj.exe42⤵
- Executes dropped EXE
PID:828 -
\??\c:\dvvpj.exec:\dvvpj.exe43⤵
- Executes dropped EXE
PID:1340 -
\??\c:\lxlflrf.exec:\lxlflrf.exe44⤵
- Executes dropped EXE
PID:1188 -
\??\c:\5lllllr.exec:\5lllllr.exe45⤵
- Executes dropped EXE
PID:1168 -
\??\c:\3rfrflx.exec:\3rfrflx.exe46⤵
- Executes dropped EXE
PID:468 -
\??\c:\9btttt.exec:\9btttt.exe47⤵
- Executes dropped EXE
PID:3032 -
\??\c:\hbnthh.exec:\hbnthh.exe48⤵
- Executes dropped EXE
PID:1864 -
\??\c:\pjvvv.exec:\pjvvv.exe49⤵
- Executes dropped EXE
PID:2116 -
\??\c:\rllrfxl.exec:\rllrfxl.exe50⤵
- Executes dropped EXE
PID:2904 -
\??\c:\ffxfxlf.exec:\ffxfxlf.exe51⤵
- Executes dropped EXE
PID:2860 -
\??\c:\bthtbn.exec:\bthtbn.exe52⤵
- Executes dropped EXE
PID:2024 -
\??\c:\hhthbh.exec:\hhthbh.exe53⤵
- Executes dropped EXE
PID:2920 -
\??\c:\tnntbb.exec:\tnntbb.exe54⤵
- Executes dropped EXE
PID:1276 -
\??\c:\ddppv.exec:\ddppv.exe55⤵
- Executes dropped EXE
PID:2436 -
\??\c:\vpjjp.exec:\vpjjp.exe56⤵
- Executes dropped EXE
PID:1956 -
\??\c:\5fxfrrx.exec:\5fxfrrx.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2044 -
\??\c:\9xrfrxr.exec:\9xrfrxr.exe58⤵
- Executes dropped EXE
PID:2296 -
\??\c:\1nttth.exec:\1nttth.exe59⤵
- Executes dropped EXE
PID:2524 -
\??\c:\nhtbhh.exec:\nhtbhh.exe60⤵
- Executes dropped EXE
PID:1696 -
\??\c:\dvpvj.exec:\dvpvj.exe61⤵
- Executes dropped EXE
PID:2508 -
\??\c:\pppdd.exec:\pppdd.exe62⤵
- Executes dropped EXE
PID:2244 -
\??\c:\frxflff.exec:\frxflff.exe63⤵
- Executes dropped EXE
PID:2088 -
\??\c:\lfxlflx.exec:\lfxlflx.exe64⤵
- Executes dropped EXE
PID:856 -
\??\c:\tnhnbb.exec:\tnhnbb.exe65⤵
- Executes dropped EXE
PID:3000 -
\??\c:\thttbb.exec:\thttbb.exe66⤵PID:1412
-
\??\c:\jddvv.exec:\jddvv.exe67⤵
- System Location Discovery: System Language Discovery
PID:1248 -
\??\c:\dddjd.exec:\dddjd.exe68⤵PID:1040
-
\??\c:\flxrlrr.exec:\flxrlrr.exe69⤵PID:2708
-
\??\c:\7nbtbb.exec:\7nbtbb.exe70⤵PID:3060
-
\??\c:\nhthbh.exec:\nhthbh.exe71⤵PID:2368
-
\??\c:\vvdjv.exec:\vvdjv.exe72⤵PID:2332
-
\??\c:\dvjjp.exec:\dvjjp.exe73⤵PID:1228
-
\??\c:\xrxffrx.exec:\xrxffrx.exe74⤵PID:1544
-
\??\c:\xrrfrxl.exec:\xrrfrxl.exe75⤵PID:2872
-
\??\c:\nbnbht.exec:\nbnbht.exe76⤵PID:2980
-
\??\c:\hbhnbb.exec:\hbhnbb.exe77⤵PID:2928
-
\??\c:\5pdvd.exec:\5pdvd.exe78⤵PID:2900
-
\??\c:\jdjjj.exec:\jdjjj.exe79⤵PID:2736
-
\??\c:\lfrrxxl.exec:\lfrrxxl.exe80⤵PID:2884
-
\??\c:\lfrflrx.exec:\lfrflrx.exe81⤵PID:2864
-
\??\c:\tthbbt.exec:\tthbbt.exe82⤵PID:2636
-
\??\c:\nhbhnn.exec:\nhbhnn.exe83⤵PID:2060
-
\??\c:\dpdjj.exec:\dpdjj.exe84⤵PID:600
-
\??\c:\5pjvp.exec:\5pjvp.exe85⤵PID:604
-
\??\c:\9fxrlrx.exec:\9fxrlrx.exe86⤵PID:1676
-
\??\c:\rlxllrr.exec:\rlxllrr.exe87⤵PID:1520
-
\??\c:\bnttht.exec:\bnttht.exe88⤵PID:2572
-
\??\c:\djjjp.exec:\djjjp.exe89⤵PID:1464
-
\??\c:\3vpvd.exec:\3vpvd.exe90⤵PID:3028
-
\??\c:\ddvjv.exec:\ddvjv.exe91⤵PID:2604
-
\??\c:\5xxxllr.exec:\5xxxllr.exe92⤵PID:2912
-
\??\c:\9fllxxf.exec:\9fllxxf.exe93⤵PID:2960
-
\??\c:\bnhbnh.exec:\bnhbnh.exe94⤵PID:2376
-
\??\c:\3hbhnb.exec:\3hbhnb.exe95⤵PID:2148
-
\??\c:\ddvdv.exec:\ddvdv.exe96⤵PID:2388
-
\??\c:\rrlrfrf.exec:\rrlrfrf.exe97⤵PID:2468
-
\??\c:\frffrrx.exec:\frffrrx.exe98⤵PID:2008
-
\??\c:\1xlxlrx.exec:\1xlxlrx.exe99⤵PID:2220
-
\??\c:\nbtnhn.exec:\nbtnhn.exe100⤵PID:1212
-
\??\c:\nnhtbn.exec:\nnhtbn.exe101⤵PID:2384
-
\??\c:\pvdpj.exec:\pvdpj.exe102⤵PID:2320
-
\??\c:\xflxlfl.exec:\xflxlfl.exe103⤵PID:1688
-
\??\c:\fxllrrl.exec:\fxllrrl.exe104⤵PID:2496
-
\??\c:\hhnnhb.exec:\hhnnhb.exe105⤵PID:2508
-
\??\c:\nbhhtt.exec:\nbhhtt.exe106⤵PID:2596
-
\??\c:\jppvv.exec:\jppvv.exe107⤵PID:2088
-
\??\c:\ppdpd.exec:\ppdpd.exe108⤵PID:860
-
\??\c:\rxrflfl.exec:\rxrflfl.exe109⤵PID:280
-
\??\c:\xlfllrx.exec:\xlfllrx.exe110⤵PID:1008
-
\??\c:\nhhhnt.exec:\nhhhnt.exe111⤵PID:2444
-
\??\c:\1bbtbn.exec:\1bbtbn.exe112⤵PID:1344
-
\??\c:\1pjjv.exec:\1pjjv.exe113⤵PID:1808
-
\??\c:\5vjjj.exec:\5vjjj.exe114⤵PID:1560
-
\??\c:\5lxrflr.exec:\5lxrflr.exe115⤵PID:2040
-
\??\c:\fxrflfl.exec:\fxrflfl.exe116⤵PID:2828
-
\??\c:\9tnhnn.exec:\9tnhnn.exe117⤵PID:904
-
\??\c:\nnhnnt.exec:\nnhnnt.exe118⤵PID:324
-
\??\c:\3jvdj.exec:\3jvdj.exe119⤵PID:2336
-
\??\c:\dpdjv.exec:\dpdjv.exe120⤵PID:2980
-
\??\c:\xrxffrx.exec:\xrxffrx.exe121⤵PID:2660
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-