Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
26/08/2024, 04:15
Behavioral task
behavioral1
Sample
94e04c8fcd1408de38c83ca37d717d20N.exe
Resource
win7-20240708-en
6 signatures
120 seconds
General
-
Target
94e04c8fcd1408de38c83ca37d717d20N.exe
-
Size
89KB
-
MD5
94e04c8fcd1408de38c83ca37d717d20
-
SHA1
ce05c79578cbc50fa4029d8e6a8765184769e107
-
SHA256
93eeba47e00f025cdb737a0818fdcd3adaa4da192b22a538a395d44ab20e2e82
-
SHA512
481d3fd7b436cad43a74c00604462cfcf19f5902920d62dc3fb16ffb4548d7ef3c49021a2401b8129c814ace0cbe28ea82a8eb044f933413c7737a46a9744f71
-
SSDEEP
1536:xvQBeOGtrYS3srx93UBWfwC6Ggnouy8q5kNJ8mGltIIgKsQRVUVMkOkp:xhOmTsF93UYfwC6GIoutqiJ8mqtbfUVj
Malware Config
Signatures
-
Detect Blackmoon payload 50 IoCs
resource yara_rule behavioral1/memory/2468-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1056-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2180-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2768-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2700-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2740-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2008-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2008-74-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2600-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2236-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1384-111-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2616-137-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1368-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2164-180-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2376-183-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2164-182-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1304-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2216-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1928-245-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2512-259-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2512-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1956-291-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1988-299-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2652-307-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2704-315-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1576-322-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2720-341-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2920-354-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2560-361-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2848-368-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2600-375-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2288-383-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1468-391-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/868-410-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2968-417-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2952-432-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2648-483-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1304-508-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/316-695-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2256-756-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2896-882-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2224-908-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2160-1001-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1248-1069-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2300-1076-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2300-1077-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1056-1155-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/1508-1210-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/1036-1341-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1020-1374-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2180 dpddj.exe 1056 pdvvv.exe 2768 5frfrxl.exe 2700 jvpdv.exe 2740 pvvjp.exe 2584 rxrffrl.exe 2008 1tntth.exe 2600 tnhhtb.exe 2236 vjvdd.exe 1224 rxrxxrx.exe 1384 llfxflx.exe 1860 hthnnn.exe 1820 jjdjv.exe 2616 lflllrf.exe 2540 fxrxrfr.exe 2376 btbnbb.exe 1368 vpdpv.exe 2160 rlrlrrx.exe 2164 fflxxlr.exe 1672 tbttnh.exe 1088 nhbthb.exe 2736 dvpvp.exe 692 llxlrxx.exe 1304 hbtbhn.exe 2216 hbbtbb.exe 1928 jjppv.exe 1248 pdppv.exe 2512 rffxfxf.exe 996 9btnbb.exe 864 jddpd.exe 1956 llrrrxr.exe 1988 9ntthh.exe 2652 hhnbnb.exe 2704 dpvjj.exe 1576 vpdjp.exe 2712 lfxxffl.exe 2564 nhhtbh.exe 2720 bthnbh.exe 2972 ddpvp.exe 2920 dpdpd.exe 2560 rrlxffl.exe 2848 hbthtb.exe 2600 hbntnt.exe 2288 vpvdj.exe 1468 dpjvv.exe 628 rfrrrlr.exe 1472 tnbnhn.exe 868 5ththb.exe 2968 dvdpv.exe 2812 jpjpv.exe 2952 xxllrrf.exe 344 nthtnn.exe 1920 tnhbbh.exe 2208 vdpvd.exe 2160 pjddp.exe 2500 xrfrxxf.exe 1672 1lflrrx.exe 2916 bnbtbb.exe 2648 ttbbtt.exe 820 pjdvv.exe 1872 xfxflrx.exe 680 1rflxxf.exe 1304 xxrfflx.exe 1300 tnhtbn.exe -
resource yara_rule behavioral1/memory/2468-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2468-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000010300-5.dat upx behavioral1/files/0x000b000000018617-15.dat upx behavioral1/memory/1056-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2180-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000018636-29.dat upx behavioral1/memory/2768-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2700-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000001907c-39.dat upx behavioral1/files/0x0007000000019080-46.dat upx behavioral1/memory/2740-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001919c-58.dat upx behavioral1/memory/2740-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00090000000191ad-66.dat upx behavioral1/files/0x00080000000193a8-75.dat upx behavioral1/memory/2008-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2600-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000019c0b-83.dat upx behavioral1/files/0x0005000000019cfc-92.dat upx behavioral1/memory/2236-94-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019d5c-103.dat upx behavioral1/files/0x0005000000019d69-113.dat upx behavioral1/files/0x0005000000019f57-120.dat upx behavioral1/files/0x0005000000019f71-127.dat upx behavioral1/memory/2616-129-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a020-138.dat upx behavioral1/files/0x000500000001a033-146.dat upx behavioral1/memory/2376-147-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a05a-155.dat upx behavioral1/files/0x000500000001a2b9-165.dat upx behavioral1/memory/1368-164-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a2fc-172.dat upx behavioral1/files/0x000500000001a3e4-185.dat upx behavioral1/memory/1672-184-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2164-182-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a3e6-193.dat upx behavioral1/files/0x000500000001a3e8-203.dat upx behavioral1/files/0x000500000001a3ea-210.dat upx behavioral1/files/0x000500000001a3ed-219.dat upx behavioral1/files/0x000500000001a423-228.dat upx behavioral1/memory/1304-227-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a445-238.dat upx behavioral1/memory/2216-237-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a447-247.dat upx behavioral1/memory/1928-245-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2512-259-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a452-258.dat upx behavioral1/files/0x000500000001a454-267.dat upx behavioral1/memory/2512-266-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a463-275.dat upx behavioral1/files/0x000500000001a46d-283.dat upx behavioral1/memory/1956-291-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000a000000017447-290.dat upx behavioral1/memory/1988-299-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2652-300-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2652-307-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2704-308-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2704-315-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1576-322-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2720-341-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2920-354-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2560-361-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2600-375-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllrllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxxfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllfrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxxlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xlrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2468 wrote to memory of 2180 2468 94e04c8fcd1408de38c83ca37d717d20N.exe 30 PID 2468 wrote to memory of 2180 2468 94e04c8fcd1408de38c83ca37d717d20N.exe 30 PID 2468 wrote to memory of 2180 2468 94e04c8fcd1408de38c83ca37d717d20N.exe 30 PID 2468 wrote to memory of 2180 2468 94e04c8fcd1408de38c83ca37d717d20N.exe 30 PID 2180 wrote to memory of 1056 2180 dpddj.exe 31 PID 2180 wrote to memory of 1056 2180 dpddj.exe 31 PID 2180 wrote to memory of 1056 2180 dpddj.exe 31 PID 2180 wrote to memory of 1056 2180 dpddj.exe 31 PID 1056 wrote to memory of 2768 1056 pdvvv.exe 32 PID 1056 wrote to memory of 2768 1056 pdvvv.exe 32 PID 1056 wrote to memory of 2768 1056 pdvvv.exe 32 PID 1056 wrote to memory of 2768 1056 pdvvv.exe 32 PID 2768 wrote to memory of 2700 2768 5frfrxl.exe 33 PID 2768 wrote to memory of 2700 2768 5frfrxl.exe 33 PID 2768 wrote to memory of 2700 2768 5frfrxl.exe 33 PID 2768 wrote to memory of 2700 2768 5frfrxl.exe 33 PID 2700 wrote to memory of 2740 2700 jvpdv.exe 34 PID 2700 wrote to memory of 2740 2700 jvpdv.exe 34 PID 2700 wrote to memory of 2740 2700 jvpdv.exe 34 PID 2700 wrote to memory of 2740 2700 jvpdv.exe 34 PID 2740 wrote to memory of 2584 2740 pvvjp.exe 35 PID 2740 wrote to memory of 2584 2740 pvvjp.exe 35 PID 2740 wrote to memory of 2584 2740 pvvjp.exe 35 PID 2740 wrote to memory of 2584 2740 pvvjp.exe 35 PID 2584 wrote to memory of 2008 2584 rxrffrl.exe 36 PID 2584 wrote to memory of 2008 2584 rxrffrl.exe 36 PID 2584 wrote to memory of 2008 2584 rxrffrl.exe 36 PID 2584 wrote to memory of 2008 2584 rxrffrl.exe 36 PID 2008 wrote to memory of 2600 2008 1tntth.exe 37 PID 2008 wrote to memory of 2600 2008 1tntth.exe 37 PID 2008 wrote to memory of 2600 2008 1tntth.exe 37 PID 2008 wrote to memory of 2600 2008 1tntth.exe 37 PID 2600 wrote to memory of 2236 2600 tnhhtb.exe 38 PID 2600 wrote to memory of 2236 2600 tnhhtb.exe 38 PID 2600 wrote to memory of 2236 2600 tnhhtb.exe 38 PID 2600 wrote to memory of 2236 2600 tnhhtb.exe 38 PID 2236 wrote to memory of 1224 2236 vjvdd.exe 39 PID 2236 wrote to memory of 1224 2236 vjvdd.exe 39 PID 2236 wrote to memory of 1224 2236 vjvdd.exe 39 PID 2236 wrote to memory of 1224 2236 vjvdd.exe 39 PID 1224 wrote to memory of 1384 1224 rxrxxrx.exe 40 PID 1224 wrote to memory of 1384 1224 rxrxxrx.exe 40 PID 1224 wrote to memory of 1384 1224 rxrxxrx.exe 40 PID 1224 wrote to memory of 1384 1224 rxrxxrx.exe 40 PID 1384 wrote to memory of 1860 1384 llfxflx.exe 41 PID 1384 wrote to memory of 1860 1384 llfxflx.exe 41 PID 1384 wrote to memory of 1860 1384 llfxflx.exe 41 PID 1384 wrote to memory of 1860 1384 llfxflx.exe 41 PID 1860 wrote to memory of 1820 1860 hthnnn.exe 42 PID 1860 wrote to memory of 1820 1860 hthnnn.exe 42 PID 1860 wrote to memory of 1820 1860 hthnnn.exe 42 PID 1860 wrote to memory of 1820 1860 hthnnn.exe 42 PID 1820 wrote to memory of 2616 1820 jjdjv.exe 43 PID 1820 wrote to memory of 2616 1820 jjdjv.exe 43 PID 1820 wrote to memory of 2616 1820 jjdjv.exe 43 PID 1820 wrote to memory of 2616 1820 jjdjv.exe 43 PID 2616 wrote to memory of 2540 2616 lflllrf.exe 44 PID 2616 wrote to memory of 2540 2616 lflllrf.exe 44 PID 2616 wrote to memory of 2540 2616 lflllrf.exe 44 PID 2616 wrote to memory of 2540 2616 lflllrf.exe 44 PID 2540 wrote to memory of 2376 2540 fxrxrfr.exe 45 PID 2540 wrote to memory of 2376 2540 fxrxrfr.exe 45 PID 2540 wrote to memory of 2376 2540 fxrxrfr.exe 45 PID 2540 wrote to memory of 2376 2540 fxrxrfr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\94e04c8fcd1408de38c83ca37d717d20N.exe"C:\Users\Admin\AppData\Local\Temp\94e04c8fcd1408de38c83ca37d717d20N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\dpddj.exec:\dpddj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\pdvvv.exec:\pdvvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\5frfrxl.exec:\5frfrxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\jvpdv.exec:\jvpdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\pvvjp.exec:\pvvjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\rxrffrl.exec:\rxrffrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\1tntth.exec:\1tntth.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\tnhhtb.exec:\tnhhtb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\vjvdd.exec:\vjvdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\rxrxxrx.exec:\rxrxxrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
\??\c:\llfxflx.exec:\llfxflx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
\??\c:\hthnnn.exec:\hthnnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\jjdjv.exec:\jjdjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\lflllrf.exec:\lflllrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\fxrxrfr.exec:\fxrxrfr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\btbnbb.exec:\btbnbb.exe17⤵
- Executes dropped EXE
PID:2376 -
\??\c:\vpdpv.exec:\vpdpv.exe18⤵
- Executes dropped EXE
PID:1368 -
\??\c:\rlrlrrx.exec:\rlrlrrx.exe19⤵
- Executes dropped EXE
PID:2160 -
\??\c:\fflxxlr.exec:\fflxxlr.exe20⤵
- Executes dropped EXE
PID:2164 -
\??\c:\tbttnh.exec:\tbttnh.exe21⤵
- Executes dropped EXE
PID:1672 -
\??\c:\nhbthb.exec:\nhbthb.exe22⤵
- Executes dropped EXE
PID:1088 -
\??\c:\dvpvp.exec:\dvpvp.exe23⤵
- Executes dropped EXE
PID:2736 -
\??\c:\llxlrxx.exec:\llxlrxx.exe24⤵
- Executes dropped EXE
PID:692 -
\??\c:\hbtbhn.exec:\hbtbhn.exe25⤵
- Executes dropped EXE
PID:1304 -
\??\c:\hbbtbb.exec:\hbbtbb.exe26⤵
- Executes dropped EXE
PID:2216 -
\??\c:\jjppv.exec:\jjppv.exe27⤵
- Executes dropped EXE
PID:1928 -
\??\c:\pdppv.exec:\pdppv.exe28⤵
- Executes dropped EXE
PID:1248 -
\??\c:\rffxfxf.exec:\rffxfxf.exe29⤵
- Executes dropped EXE
PID:2512 -
\??\c:\9btnbb.exec:\9btnbb.exe30⤵
- Executes dropped EXE
PID:996 -
\??\c:\jddpd.exec:\jddpd.exe31⤵
- Executes dropped EXE
PID:864 -
\??\c:\llrrrxr.exec:\llrrrxr.exe32⤵
- Executes dropped EXE
PID:1956 -
\??\c:\9ntthh.exec:\9ntthh.exe33⤵
- Executes dropped EXE
PID:1988 -
\??\c:\hhnbnb.exec:\hhnbnb.exe34⤵
- Executes dropped EXE
PID:2652 -
\??\c:\dpvjj.exec:\dpvjj.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2704 -
\??\c:\vpdjp.exec:\vpdjp.exe36⤵
- Executes dropped EXE
PID:1576 -
\??\c:\lfxxffl.exec:\lfxxffl.exe37⤵
- Executes dropped EXE
PID:2712 -
\??\c:\nhhtbh.exec:\nhhtbh.exe38⤵
- Executes dropped EXE
PID:2564 -
\??\c:\bthnbh.exec:\bthnbh.exe39⤵
- Executes dropped EXE
PID:2720 -
\??\c:\ddpvp.exec:\ddpvp.exe40⤵
- Executes dropped EXE
PID:2972 -
\??\c:\dpdpd.exec:\dpdpd.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2920 -
\??\c:\rrlxffl.exec:\rrlxffl.exe42⤵
- Executes dropped EXE
PID:2560 -
\??\c:\hbthtb.exec:\hbthtb.exe43⤵
- Executes dropped EXE
PID:2848 -
\??\c:\hbntnt.exec:\hbntnt.exe44⤵
- Executes dropped EXE
PID:2600 -
\??\c:\vpvdj.exec:\vpvdj.exe45⤵
- Executes dropped EXE
PID:2288 -
\??\c:\dpjvv.exec:\dpjvv.exe46⤵
- Executes dropped EXE
PID:1468 -
\??\c:\rfrrrlr.exec:\rfrrrlr.exe47⤵
- Executes dropped EXE
PID:628 -
\??\c:\tnbnhn.exec:\tnbnhn.exe48⤵
- Executes dropped EXE
PID:1472 -
\??\c:\5ththb.exec:\5ththb.exe49⤵
- Executes dropped EXE
PID:868 -
\??\c:\dvdpv.exec:\dvdpv.exe50⤵
- Executes dropped EXE
PID:2968 -
\??\c:\jpjpv.exec:\jpjpv.exe51⤵
- Executes dropped EXE
PID:2812 -
\??\c:\xxllrrf.exec:\xxllrrf.exe52⤵
- Executes dropped EXE
PID:2952 -
\??\c:\nthtnn.exec:\nthtnn.exe53⤵
- Executes dropped EXE
PID:344 -
\??\c:\tnhbbh.exec:\tnhbbh.exe54⤵
- Executes dropped EXE
PID:1920 -
\??\c:\vdpvd.exec:\vdpvd.exe55⤵
- Executes dropped EXE
PID:2208 -
\??\c:\pjddp.exec:\pjddp.exe56⤵
- Executes dropped EXE
PID:2160 -
\??\c:\xrfrxxf.exec:\xrfrxxf.exe57⤵
- Executes dropped EXE
PID:2500 -
\??\c:\1lflrrx.exec:\1lflrrx.exe58⤵
- Executes dropped EXE
PID:1672 -
\??\c:\bnbtbb.exec:\bnbtbb.exe59⤵
- Executes dropped EXE
PID:2916 -
\??\c:\ttbbtt.exec:\ttbbtt.exe60⤵
- Executes dropped EXE
PID:2648 -
\??\c:\pjdvv.exec:\pjdvv.exe61⤵
- Executes dropped EXE
PID:820 -
\??\c:\xfxflrx.exec:\xfxflrx.exe62⤵
- Executes dropped EXE
PID:1872 -
\??\c:\1rflxxf.exec:\1rflxxf.exe63⤵
- Executes dropped EXE
PID:680 -
\??\c:\xxrfflx.exec:\xxrfflx.exe64⤵
- Executes dropped EXE
PID:1304 -
\??\c:\tnhtbn.exec:\tnhtbn.exe65⤵
- Executes dropped EXE
PID:1300 -
\??\c:\1pdvp.exec:\1pdvp.exe66⤵PID:1952
-
\??\c:\dpvpv.exec:\dpvpv.exe67⤵PID:2300
-
\??\c:\rlflrrl.exec:\rlflrrl.exe68⤵PID:2476
-
\??\c:\xrxffff.exec:\xrxffff.exe69⤵PID:2336
-
\??\c:\1rflxxf.exec:\1rflxxf.exe70⤵PID:788
-
\??\c:\hhhnnt.exec:\hhhnnt.exe71⤵PID:848
-
\??\c:\1tnbnb.exec:\1tnbnb.exe72⤵PID:324
-
\??\c:\3dvdj.exec:\3dvdj.exe73⤵PID:2524
-
\??\c:\dvjjp.exec:\dvjjp.exe74⤵PID:2348
-
\??\c:\fxrxxxr.exec:\fxrxxxr.exe75⤵PID:2176
-
\??\c:\fxfrxrf.exec:\fxfrxrf.exe76⤵PID:2748
-
\??\c:\thnnnn.exec:\thnnnn.exe77⤵PID:2772
-
\??\c:\tnhhnn.exec:\tnhhnn.exe78⤵PID:1696
-
\??\c:\7djpp.exec:\7djpp.exe79⤵PID:2844
-
\??\c:\jdjpp.exec:\jdjpp.exe80⤵PID:2700
-
\??\c:\5lffrlx.exec:\5lffrlx.exe81⤵PID:2564
-
\??\c:\5flxflr.exec:\5flxflr.exe82⤵PID:2852
-
\??\c:\3hbhhb.exec:\3hbhhb.exe83⤵PID:2580
-
\??\c:\9thnhn.exec:\9thnhn.exe84⤵PID:2568
-
\??\c:\pppdv.exec:\pppdv.exe85⤵PID:2552
-
\??\c:\ddppv.exec:\ddppv.exe86⤵PID:2848
-
\??\c:\lfxfrrx.exec:\lfxfrrx.exe87⤵PID:1732
-
\??\c:\llrrffl.exec:\llrrffl.exe88⤵PID:1112
-
\??\c:\hbtttn.exec:\hbtttn.exe89⤵PID:2380
-
\??\c:\tnbhnh.exec:\tnbhnh.exe90⤵PID:2808
-
\??\c:\jdvpp.exec:\jdvpp.exe91⤵PID:1600
-
\??\c:\jdvjd.exec:\jdvjd.exe92⤵PID:2544
-
\??\c:\vvjdd.exec:\vvjdd.exe93⤵PID:1396
-
\??\c:\lflrxxf.exec:\lflrxxf.exe94⤵PID:2968
-
\??\c:\3lrfrrf.exec:\3lrfrrf.exe95⤵PID:316
-
\??\c:\1nhbbt.exec:\1nhbbt.exe96⤵PID:1608
-
\??\c:\dpvjp.exec:\dpvjp.exe97⤵PID:1668
-
\??\c:\vjpvv.exec:\vjpvv.exe98⤵PID:3008
-
\??\c:\xrflxxl.exec:\xrflxxl.exe99⤵PID:2056
-
\??\c:\lfxfflr.exec:\lfxfflr.exe100⤵PID:2408
-
\??\c:\bthhbt.exec:\bthhbt.exe101⤵PID:2256
-
\??\c:\thhhtt.exec:\thhhtt.exe102⤵PID:752
-
\??\c:\htbbhh.exec:\htbbhh.exe103⤵PID:2868
-
\??\c:\9pdpp.exec:\9pdpp.exe104⤵PID:1688
-
\??\c:\5pdvp.exec:\5pdvp.exe105⤵PID:1592
-
\??\c:\9fxfrrl.exec:\9fxfrrl.exe106⤵PID:2168
-
\??\c:\fxlrxxl.exec:\fxlrxxl.exe107⤵PID:904
-
\??\c:\tnnntt.exec:\tnnntt.exe108⤵PID:1336
-
\??\c:\pdvdd.exec:\pdvdd.exe109⤵PID:2108
-
\??\c:\dpvpj.exec:\dpvpj.exe110⤵PID:2112
-
\??\c:\dvjvd.exec:\dvjvd.exe111⤵PID:2300
-
\??\c:\frxfffl.exec:\frxfffl.exe112⤵PID:1828
-
\??\c:\rfllrfl.exec:\rfllrfl.exe113⤵PID:3056
-
\??\c:\5nhnht.exec:\5nhnht.exe114⤵PID:2332
-
\??\c:\nhhhtt.exec:\nhhhtt.exe115⤵PID:848
-
\??\c:\bthhhh.exec:\bthhhh.exe116⤵PID:1020
-
\??\c:\5jdpp.exec:\5jdpp.exe117⤵PID:2980
-
\??\c:\7jppp.exec:\7jppp.exe118⤵PID:2348
-
\??\c:\xfrflrl.exec:\xfrflrl.exe119⤵PID:2176
-
\??\c:\9xrflrx.exec:\9xrflrx.exe120⤵PID:2832
-
\??\c:\lxllxxx.exec:\lxllxxx.exe121⤵PID:1584
-
\??\c:\nhhntb.exec:\nhhntb.exe122⤵PID:1696
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-