Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
29/08/2024, 08:28
Behavioral task
behavioral1
Sample
b7935a81585032f539f068a656561100N.exe
Resource
win7-20240729-en
6 signatures
120 seconds
General
-
Target
b7935a81585032f539f068a656561100N.exe
-
Size
213KB
-
MD5
b7935a81585032f539f068a656561100
-
SHA1
54a985e8992395591aea6031ee0f4810dc69b641
-
SHA256
d68b8974f327245f35e9c2f7f43174e1b603fccbc52af841b99f7979a0af49ff
-
SHA512
ecdcf47a1e4e9db9bfe9918b56610fe876b1106aaaa724409fe73569c7b78f70469ef26a148e18ab7a890beae6f3b10c9475c31ebd5434c8a2dcb9a53ccc4253
-
SSDEEP
6144:Hcm4FmowdHoSrXZf8l/ubPzYNLPf4t+lt1:V4wFHoSBK/ubLcfX1
Malware Config
Signatures
-
Detect Blackmoon payload 57 IoCs
resource yara_rule behavioral1/memory/2096-21-0x00000000002C0000-0x00000000002F4000-memory.dmp family_blackmoon behavioral1/memory/2096-22-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2552-11-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2516-7-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2152-36-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2476-47-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2476-45-0x0000000000440000-0x0000000000474000-memory.dmp family_blackmoon behavioral1/memory/2980-55-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2852-64-0x00000000001B0000-0x00000000001E4000-memory.dmp family_blackmoon behavioral1/memory/2868-68-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2956-82-0x0000000000230000-0x0000000000264000-memory.dmp family_blackmoon behavioral1/memory/2956-84-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2772-92-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2624-102-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2172-111-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1936-120-0x0000000000220000-0x0000000000254000-memory.dmp family_blackmoon behavioral1/memory/1936-122-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1956-138-0x0000000000440000-0x0000000000474000-memory.dmp family_blackmoon behavioral1/memory/1696-156-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1268-165-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/844-173-0x00000000002C0000-0x00000000002F4000-memory.dmp family_blackmoon behavioral1/memory/1748-182-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2588-218-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/944-229-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2584-226-0x00000000002A0000-0x00000000002D4000-memory.dmp family_blackmoon behavioral1/memory/904-245-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2348-262-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1740-280-0x00000000002C0000-0x00000000002F4000-memory.dmp family_blackmoon behavioral1/memory/2552-296-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1740-304-0x00000000002C0000-0x00000000002F4000-memory.dmp family_blackmoon behavioral1/memory/1568-303-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2152-312-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2132-324-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2844-349-0x0000000000220000-0x0000000000254000-memory.dmp family_blackmoon behavioral1/memory/2844-350-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2680-379-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/672-392-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1788-406-0x0000000000440000-0x0000000000474000-memory.dmp family_blackmoon behavioral1/memory/2036-407-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1728-420-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2200-473-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1648-535-0x0000000000220000-0x0000000000254000-memory.dmp family_blackmoon behavioral1/memory/2524-554-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2068-677-0x0000000000220000-0x0000000000254000-memory.dmp family_blackmoon behavioral1/memory/1956-686-0x00000000003A0000-0x00000000003D4000-memory.dmp family_blackmoon behavioral1/memory/2872-723-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1044-739-0x00000000001B0000-0x00000000001E4000-memory.dmp family_blackmoon behavioral1/memory/892-750-0x0000000000220000-0x0000000000254000-memory.dmp family_blackmoon behavioral1/memory/768-764-0x0000000000220000-0x0000000000254000-memory.dmp family_blackmoon behavioral1/memory/2416-818-0x0000000000310000-0x0000000000344000-memory.dmp family_blackmoon behavioral1/memory/2416-823-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2768-870-0x0000000000220000-0x0000000000254000-memory.dmp family_blackmoon behavioral1/memory/2616-897-0x0000000000220000-0x0000000000254000-memory.dmp family_blackmoon behavioral1/memory/2532-920-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2040-933-0x0000000000220000-0x0000000000254000-memory.dmp family_blackmoon behavioral1/memory/332-1071-0x00000000003A0000-0x00000000003D4000-memory.dmp family_blackmoon behavioral1/memory/2120-1082-0x0000000000220000-0x0000000000254000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2552 9pjvp.exe 2096 5xxlflf.exe 2152 rllxflf.exe 2476 rrllfrl.exe 2980 ntbttn.exe 2852 djdvv.exe 2868 bbtnbh.exe 2956 ttnbbn.exe 2772 rlrxffr.exe 2624 1nbtnb.exe 2172 ddpjv.exe 1936 lfxfxlx.exe 344 bbbnht.exe 1956 jjjjj.exe 2028 rlfrfrx.exe 1696 hthnht.exe 1268 vdjdv.exe 844 7rlrflr.exe 1748 bthnbb.exe 1812 dvjvj.exe 2252 frlrfxl.exe 2920 httnbb.exe 2588 llxxxll.exe 2584 3fxrlfr.exe 944 nhhhtb.exe 904 7jdpv.exe 952 lllrxfx.exe 2348 fxxrlrf.exe 3016 xlfrfrx.exe 1740 lrxrlrl.exe 2544 tnhnhn.exe 2552 ppjdd.exe 1568 frlflfr.exe 2408 hnnbnb.exe 2152 jjdjv.exe 2132 fxfffrf.exe 2700 hnnhbh.exe 2716 vdjjd.exe 2828 fxlrflf.exe 2844 rrfxrxl.exe 2944 hnnnbn.exe 2744 ppjpj.exe 2864 jjjvj.exe 2680 lrrrllf.exe 2624 5tnbnt.exe 672 nhntbn.exe 1084 5vvpj.exe 1788 pvjdj.exe 2036 3xfrrrl.exe 1916 rxrxrxl.exe 1728 vvppp.exe 1228 pdvjp.exe 316 fxrrlrl.exe 1040 lfxxflx.exe 1732 bnnbbt.exe 2924 3tnhnt.exe 1968 ddpdv.exe 2200 xffrllf.exe 1864 xxrrrlx.exe 2492 5tthbt.exe 1104 pjvjj.exe 2904 pppvv.exe 840 xrlxrxf.exe 896 tbthbn.exe -
resource yara_rule behavioral1/memory/2516-0-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x00070000000120fd-9.dat upx behavioral1/memory/2096-22-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0008000000016d6b-27.dat upx behavioral1/files/0x0008000000016d3f-18.dat upx behavioral1/memory/2152-28-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2552-11-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2516-7-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0007000000016d7c-37.dat upx behavioral1/memory/2152-36-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0008000000016dbd-48.dat upx behavioral1/memory/2476-47-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0007000000016dcb-56.dat upx behavioral1/memory/2980-55-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2852-64-0x00000000001B0000-0x00000000001E4000-memory.dmp upx behavioral1/memory/2868-68-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0007000000016dff-66.dat upx behavioral1/files/0x0007000000016e98-74.dat upx behavioral1/files/0x000800000001752b-83.dat upx behavioral1/memory/2956-84-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x00050000000195cc-93.dat upx behavioral1/memory/2772-92-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x00050000000195f7-101.dat upx behavioral1/memory/2172-103-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2624-102-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x00050000000195f9-112.dat upx behavioral1/memory/2172-111-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1936-122-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x00050000000195fb-121.dat upx behavioral1/files/0x00050000000195fd-130.dat upx behavioral1/files/0x00050000000195ff-139.dat upx behavioral1/files/0x0005000000019601-147.dat upx behavioral1/files/0x0005000000019603-155.dat upx behavioral1/memory/1696-156-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1268-165-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0005000000019615-164.dat upx behavioral1/files/0x0005000000019616-175.dat upx behavioral1/files/0x0005000000019693-183.dat upx behavioral1/memory/1748-182-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0008000000016d24-192.dat upx behavioral1/files/0x0005000000019695-200.dat upx behavioral1/files/0x0005000000019950-209.dat upx behavioral1/files/0x0005000000019c2e-219.dat upx behavioral1/memory/2588-218-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0005000000019c2f-228.dat upx behavioral1/memory/944-229-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0005000000019c30-237.dat upx behavioral1/files/0x0005000000019c4a-247.dat upx behavioral1/memory/904-245-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0005000000019cba-254.dat upx behavioral1/memory/904-240-0x0000000000220000-0x0000000000254000-memory.dmp upx behavioral1/memory/2348-262-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0005000000019ce4-264.dat upx behavioral1/files/0x0005000000019d9d-271.dat upx behavioral1/files/0x0005000000019db1-282.dat upx behavioral1/files/0x0005000000019f7e-289.dat upx behavioral1/memory/1740-279-0x00000000002C0000-0x00000000002F4000-memory.dmp upx behavioral1/memory/2552-296-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1568-303-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2152-312-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2132-324-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2844-350-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2828-363-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2744-364-0x00000000003C0000-0x00000000003F4000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxrrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrffrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlxrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxrxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rlffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9frxlxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2516 wrote to memory of 2552 2516 b7935a81585032f539f068a656561100N.exe 30 PID 2516 wrote to memory of 2552 2516 b7935a81585032f539f068a656561100N.exe 30 PID 2516 wrote to memory of 2552 2516 b7935a81585032f539f068a656561100N.exe 30 PID 2516 wrote to memory of 2552 2516 b7935a81585032f539f068a656561100N.exe 30 PID 2552 wrote to memory of 2096 2552 9pjvp.exe 31 PID 2552 wrote to memory of 2096 2552 9pjvp.exe 31 PID 2552 wrote to memory of 2096 2552 9pjvp.exe 31 PID 2552 wrote to memory of 2096 2552 9pjvp.exe 31 PID 2096 wrote to memory of 2152 2096 5xxlflf.exe 32 PID 2096 wrote to memory of 2152 2096 5xxlflf.exe 32 PID 2096 wrote to memory of 2152 2096 5xxlflf.exe 32 PID 2096 wrote to memory of 2152 2096 5xxlflf.exe 32 PID 2152 wrote to memory of 2476 2152 rllxflf.exe 33 PID 2152 wrote to memory of 2476 2152 rllxflf.exe 33 PID 2152 wrote to memory of 2476 2152 rllxflf.exe 33 PID 2152 wrote to memory of 2476 2152 rllxflf.exe 33 PID 2476 wrote to memory of 2980 2476 rrllfrl.exe 34 PID 2476 wrote to memory of 2980 2476 rrllfrl.exe 34 PID 2476 wrote to memory of 2980 2476 rrllfrl.exe 34 PID 2476 wrote to memory of 2980 2476 rrllfrl.exe 34 PID 2980 wrote to memory of 2852 2980 ntbttn.exe 35 PID 2980 wrote to memory of 2852 2980 ntbttn.exe 35 PID 2980 wrote to memory of 2852 2980 ntbttn.exe 35 PID 2980 wrote to memory of 2852 2980 ntbttn.exe 35 PID 2852 wrote to memory of 2868 2852 djdvv.exe 36 PID 2852 wrote to memory of 2868 2852 djdvv.exe 36 PID 2852 wrote to memory of 2868 2852 djdvv.exe 36 PID 2852 wrote to memory of 2868 2852 djdvv.exe 36 PID 2868 wrote to memory of 2956 2868 bbtnbh.exe 37 PID 2868 wrote to memory of 2956 2868 bbtnbh.exe 37 PID 2868 wrote to memory of 2956 2868 bbtnbh.exe 37 PID 2868 wrote to memory of 2956 2868 bbtnbh.exe 37 PID 2956 wrote to memory of 2772 2956 ttnbbn.exe 38 PID 2956 wrote to memory of 2772 2956 ttnbbn.exe 38 PID 2956 wrote to memory of 2772 2956 ttnbbn.exe 38 PID 2956 wrote to memory of 2772 2956 ttnbbn.exe 38 PID 2772 wrote to memory of 2624 2772 rlrxffr.exe 39 PID 2772 wrote to memory of 2624 2772 rlrxffr.exe 39 PID 2772 wrote to memory of 2624 2772 rlrxffr.exe 39 PID 2772 wrote to memory of 2624 2772 rlrxffr.exe 39 PID 2624 wrote to memory of 2172 2624 1nbtnb.exe 40 PID 2624 wrote to memory of 2172 2624 1nbtnb.exe 40 PID 2624 wrote to memory of 2172 2624 1nbtnb.exe 40 PID 2624 wrote to memory of 2172 2624 1nbtnb.exe 40 PID 2172 wrote to memory of 1936 2172 ddpjv.exe 41 PID 2172 wrote to memory of 1936 2172 ddpjv.exe 41 PID 2172 wrote to memory of 1936 2172 ddpjv.exe 41 PID 2172 wrote to memory of 1936 2172 ddpjv.exe 41 PID 1936 wrote to memory of 344 1936 lfxfxlx.exe 42 PID 1936 wrote to memory of 344 1936 lfxfxlx.exe 42 PID 1936 wrote to memory of 344 1936 lfxfxlx.exe 42 PID 1936 wrote to memory of 344 1936 lfxfxlx.exe 42 PID 344 wrote to memory of 1956 344 bbbnht.exe 43 PID 344 wrote to memory of 1956 344 bbbnht.exe 43 PID 344 wrote to memory of 1956 344 bbbnht.exe 43 PID 344 wrote to memory of 1956 344 bbbnht.exe 43 PID 1956 wrote to memory of 2028 1956 jjjjj.exe 44 PID 1956 wrote to memory of 2028 1956 jjjjj.exe 44 PID 1956 wrote to memory of 2028 1956 jjjjj.exe 44 PID 1956 wrote to memory of 2028 1956 jjjjj.exe 44 PID 2028 wrote to memory of 1696 2028 rlfrfrx.exe 45 PID 2028 wrote to memory of 1696 2028 rlfrfrx.exe 45 PID 2028 wrote to memory of 1696 2028 rlfrfrx.exe 45 PID 2028 wrote to memory of 1696 2028 rlfrfrx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\b7935a81585032f539f068a656561100N.exe"C:\Users\Admin\AppData\Local\Temp\b7935a81585032f539f068a656561100N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\9pjvp.exec:\9pjvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\5xxlflf.exec:\5xxlflf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\rllxflf.exec:\rllxflf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\rrllfrl.exec:\rrllfrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\ntbttn.exec:\ntbttn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\djdvv.exec:\djdvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\bbtnbh.exec:\bbtnbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\ttnbbn.exec:\ttnbbn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\rlrxffr.exec:\rlrxffr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\1nbtnb.exec:\1nbtnb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\ddpjv.exec:\ddpjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\lfxfxlx.exec:\lfxfxlx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\bbbnht.exec:\bbbnht.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:344 -
\??\c:\jjjjj.exec:\jjjjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\rlfrfrx.exec:\rlfrfrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\hthnht.exec:\hthnht.exe17⤵
- Executes dropped EXE
PID:1696 -
\??\c:\vdjdv.exec:\vdjdv.exe18⤵
- Executes dropped EXE
PID:1268 -
\??\c:\7rlrflr.exec:\7rlrflr.exe19⤵
- Executes dropped EXE
PID:844 -
\??\c:\bthnbb.exec:\bthnbb.exe20⤵
- Executes dropped EXE
PID:1748 -
\??\c:\dvjvj.exec:\dvjvj.exe21⤵
- Executes dropped EXE
PID:1812 -
\??\c:\frlrfxl.exec:\frlrfxl.exe22⤵
- Executes dropped EXE
PID:2252 -
\??\c:\httnbb.exec:\httnbb.exe23⤵
- Executes dropped EXE
PID:2920 -
\??\c:\llxxxll.exec:\llxxxll.exe24⤵
- Executes dropped EXE
PID:2588 -
\??\c:\3fxrlfr.exec:\3fxrlfr.exe25⤵
- Executes dropped EXE
PID:2584 -
\??\c:\nhhhtb.exec:\nhhhtb.exe26⤵
- Executes dropped EXE
PID:944 -
\??\c:\7jdpv.exec:\7jdpv.exe27⤵
- Executes dropped EXE
PID:904 -
\??\c:\lllrxfx.exec:\lllrxfx.exe28⤵
- Executes dropped EXE
PID:952 -
\??\c:\fxxrlrf.exec:\fxxrlrf.exe29⤵
- Executes dropped EXE
PID:2348 -
\??\c:\xlfrfrx.exec:\xlfrfrx.exe30⤵
- Executes dropped EXE
PID:3016 -
\??\c:\lrxrlrl.exec:\lrxrlrl.exe31⤵
- Executes dropped EXE
PID:1740 -
\??\c:\tnhnhn.exec:\tnhnhn.exe32⤵
- Executes dropped EXE
PID:2544 -
\??\c:\ppjdd.exec:\ppjdd.exe33⤵
- Executes dropped EXE
PID:2552 -
\??\c:\frlflfr.exec:\frlflfr.exe34⤵
- Executes dropped EXE
PID:1568 -
\??\c:\hnnbnb.exec:\hnnbnb.exe35⤵
- Executes dropped EXE
PID:2408 -
\??\c:\jjdjv.exec:\jjdjv.exe36⤵
- Executes dropped EXE
PID:2152 -
\??\c:\fxfffrf.exec:\fxfffrf.exe37⤵
- Executes dropped EXE
PID:2132 -
\??\c:\hnnhbh.exec:\hnnhbh.exe38⤵
- Executes dropped EXE
PID:2700 -
\??\c:\vdjjd.exec:\vdjjd.exe39⤵
- Executes dropped EXE
PID:2716 -
\??\c:\fxlrflf.exec:\fxlrflf.exe40⤵
- Executes dropped EXE
PID:2828 -
\??\c:\rrfxrxl.exec:\rrfxrxl.exe41⤵
- Executes dropped EXE
PID:2844 -
\??\c:\hnnnbn.exec:\hnnnbn.exe42⤵
- Executes dropped EXE
PID:2944 -
\??\c:\ppjpj.exec:\ppjpj.exe43⤵
- Executes dropped EXE
PID:2744 -
\??\c:\jjjvj.exec:\jjjvj.exe44⤵
- Executes dropped EXE
PID:2864 -
\??\c:\lrrrllf.exec:\lrrrllf.exe45⤵
- Executes dropped EXE
PID:2680 -
\??\c:\5tnbnt.exec:\5tnbnt.exe46⤵
- Executes dropped EXE
PID:2624 -
\??\c:\nhntbn.exec:\nhntbn.exe47⤵
- Executes dropped EXE
PID:672 -
\??\c:\5vvpj.exec:\5vvpj.exe48⤵
- Executes dropped EXE
PID:1084 -
\??\c:\pvjdj.exec:\pvjdj.exe49⤵
- Executes dropped EXE
PID:1788 -
\??\c:\3xfrrrl.exec:\3xfrrrl.exe50⤵
- Executes dropped EXE
PID:2036 -
\??\c:\rxrxrxl.exec:\rxrxrxl.exe51⤵
- Executes dropped EXE
PID:1916 -
\??\c:\vvppp.exec:\vvppp.exe52⤵
- Executes dropped EXE
PID:1728 -
\??\c:\pdvjp.exec:\pdvjp.exe53⤵
- Executes dropped EXE
PID:1228 -
\??\c:\fxrrlrl.exec:\fxrrlrl.exe54⤵
- Executes dropped EXE
PID:316 -
\??\c:\lfxxflx.exec:\lfxxflx.exe55⤵
- Executes dropped EXE
PID:1040 -
\??\c:\bnnbbt.exec:\bnnbbt.exe56⤵
- Executes dropped EXE
PID:1732 -
\??\c:\3tnhnt.exec:\3tnhnt.exe57⤵
- Executes dropped EXE
PID:2924 -
\??\c:\ddpdv.exec:\ddpdv.exe58⤵
- Executes dropped EXE
PID:1968 -
\??\c:\xffrllf.exec:\xffrllf.exe59⤵
- Executes dropped EXE
PID:2200 -
\??\c:\xxrrrlx.exec:\xxrrrlx.exe60⤵
- Executes dropped EXE
PID:1864 -
\??\c:\5tthbt.exec:\5tthbt.exe61⤵
- Executes dropped EXE
PID:2492 -
\??\c:\pjvjj.exec:\pjvjj.exe62⤵
- Executes dropped EXE
PID:1104 -
\??\c:\pppvv.exec:\pppvv.exe63⤵
- Executes dropped EXE
PID:2904 -
\??\c:\xrlxrxf.exec:\xrlxrxf.exe64⤵
- Executes dropped EXE
PID:840 -
\??\c:\tbthbn.exec:\tbthbn.exe65⤵
- Executes dropped EXE
PID:896 -
\??\c:\btthbh.exec:\btthbh.exe66⤵PID:2912
-
\??\c:\1dvjd.exec:\1dvjd.exe67⤵PID:1860
-
\??\c:\dvpvp.exec:\dvpvp.exe68⤵PID:2984
-
\??\c:\fxffxfr.exec:\fxffxfr.exe69⤵PID:1648
-
\??\c:\fxxxrrx.exec:\fxxxrrx.exe70⤵PID:1940
-
\??\c:\btntnt.exec:\btntnt.exe71⤵PID:1736
-
\??\c:\bbnhnn.exec:\bbnhnn.exe72⤵PID:2524
-
\??\c:\vppjv.exec:\vppjv.exe73⤵PID:2548
-
\??\c:\dvpjp.exec:\dvpjp.exe74⤵PID:2096
-
\??\c:\fxxlllx.exec:\fxxlllx.exe75⤵PID:1568
-
\??\c:\7hthtb.exec:\7hthtb.exe76⤵PID:2308
-
\??\c:\nnhbnt.exec:\nnhbnt.exe77⤵PID:2084
-
\??\c:\pdppp.exec:\pdppp.exe78⤵PID:2712
-
\??\c:\jddjv.exec:\jddjv.exe79⤵PID:2736
-
\??\c:\ffflfrf.exec:\ffflfrf.exe80⤵PID:2732
-
\??\c:\9ffrrlf.exec:\9ffrrlf.exe81⤵PID:2612
-
\??\c:\ttthbh.exec:\ttthbh.exe82⤵PID:2884
-
\??\c:\bttbnt.exec:\bttbnt.exe83⤵PID:2844
-
\??\c:\vpdpd.exec:\vpdpd.exe84⤵PID:2660
-
\??\c:\jdvdd.exec:\jdvdd.exe85⤵PID:2856
-
\??\c:\rlxlxfr.exec:\rlxlxfr.exe86⤵PID:2864
-
\??\c:\btntnh.exec:\btntnh.exe87⤵PID:2604
-
\??\c:\bhhhtn.exec:\bhhhtn.exe88⤵PID:2624
-
\??\c:\vddvj.exec:\vddvj.exe89⤵PID:2672
-
\??\c:\jdppj.exec:\jdppj.exe90⤵PID:2368
-
\??\c:\xxlrrfx.exec:\xxlrrfx.exe91⤵PID:360
-
\??\c:\lxrrflx.exec:\lxrrflx.exe92⤵PID:2068
-
\??\c:\bbbnbn.exec:\bbbnbn.exe93⤵PID:1956
-
\??\c:\3jppd.exec:\3jppd.exe94⤵PID:1664
-
\??\c:\xxxfrxl.exec:\xxxfrxl.exe95⤵PID:1320
-
\??\c:\rlxxrxf.exec:\rlxxrxf.exe96⤵PID:1792
-
\??\c:\7bbtnb.exec:\7bbtnb.exe97⤵PID:1908
-
\??\c:\ttbtnt.exec:\ttbtnt.exe98⤵PID:2592
-
\??\c:\dvpvp.exec:\dvpvp.exe99⤵PID:2872
-
\??\c:\xflfrfl.exec:\xflfrfl.exe100⤵PID:2924
-
\??\c:\fffxlfr.exec:\fffxlfr.exe101⤵PID:2952
-
\??\c:\bthntt.exec:\bthntt.exe102⤵PID:1044
-
\??\c:\vdvpp.exec:\vdvpp.exe103⤵PID:892
-
\??\c:\pjjpd.exec:\pjjpd.exe104⤵PID:3000
-
\??\c:\9xflrxr.exec:\9xflrxr.exe105⤵PID:768
-
\??\c:\thhnhn.exec:\thhnhn.exe106⤵PID:1524
-
\??\c:\9hhnbn.exec:\9hhnbn.exe107⤵PID:924
-
\??\c:\pjvvp.exec:\pjvvp.exe108⤵PID:1552
-
\??\c:\jdvdv.exec:\jdvdv.exe109⤵PID:2568
-
\??\c:\lflfxxl.exec:\lflfxxl.exe110⤵PID:2800
-
\??\c:\hbnhnt.exec:\hbnhnt.exe111⤵PID:884
-
\??\c:\nhbtbb.exec:\nhbtbb.exe112⤵PID:988
-
\??\c:\5vvdp.exec:\5vvdp.exe113⤵PID:2516
-
\??\c:\ffrlrxr.exec:\ffrlrxr.exe114⤵PID:2416
-
\??\c:\rrffrxf.exec:\rrffrxf.exe115⤵PID:1572
-
\??\c:\5nhnbh.exec:\5nhnbh.exe116⤵PID:2264
-
\??\c:\pjdpj.exec:\pjdpj.exe117⤵PID:2272
-
\??\c:\dpddj.exec:\dpddj.exe118⤵PID:2412
-
\??\c:\fxlrrrx.exec:\fxlrrrx.exe119⤵PID:2464
-
\??\c:\btnthh.exec:\btnthh.exe120⤵PID:1360
-
\??\c:\nnhnhh.exec:\nnhnhh.exe121⤵PID:2748
-
\??\c:\vpvjd.exec:\vpvjd.exe122⤵PID:2768
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-