Analysis
-
max time kernel
120s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
01/09/2024, 14:18
Behavioral task
behavioral1
Sample
bfb5179faa4e3fbf060b12204f9d08a0N.exe
Resource
win7-20240708-en
6 signatures
120 seconds
General
-
Target
bfb5179faa4e3fbf060b12204f9d08a0N.exe
-
Size
365KB
-
MD5
bfb5179faa4e3fbf060b12204f9d08a0
-
SHA1
21d32f5a3d102dcc450c98cac071fe502d41a23a
-
SHA256
97a476e1f8ec077d1b8359f25bc9fe94d99bc92fa78c3928ac299338dfb231ce
-
SHA512
fae393f0000c37aa65e48afe11a80d61314a05160becc5a8c53f4435e69fb97b6e19fac71fe7ce70f78c9451646fc90de5e2b6eb0b2a1eab8f436714a5dea85c
-
SSDEEP
6144:9cm4FmowdHoSdSyEAxyx/ZrTTr4qIMgE82:/4wFHoSQuxy3rTXIM182
Malware Config
Signatures
-
Detect Blackmoon payload 58 IoCs
resource yara_rule behavioral1/memory/1864-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2536-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2148-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2700-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2848-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2904-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2664-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2684-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2668-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1704-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2448-201-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2224-256-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/840-248-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2104-279-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1572-297-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2760-334-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2104-284-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2044-267-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2044-264-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1080-227-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/340-219-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3008-211-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2964-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2876-353-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2964-189-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/1584-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2712-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2820-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2664-372-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2636-379-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/644-405-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1788-429-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/1188-442-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1296-456-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1384-469-0x00000000001E0000-0x0000000000207000-memory.dmp family_blackmoon behavioral1/memory/1384-471-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1248-474-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/1248-479-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/908-485-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3048-500-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2120-534-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2236-540-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2236-542-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2104-555-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2016-574-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2912-603-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1900-658-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1440-680-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/808-799-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2856-856-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1880-869-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2636-917-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2516-945-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1624-1012-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/852-1056-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/3068-1060-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/880-1088-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/1228-1222-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1864 lffrxfr.exe 1052 jddjd.exe 2148 bbhbnt.exe 2700 7thbnt.exe 2820 fflfxxl.exe 2712 tnhhtb.exe 2848 vpjvj.exe 2904 lllxrxf.exe 2664 9dppd.exe 2684 ffffrfr.exe 2072 7bbhtn.exe 1468 vpvdp.exe 2668 xxrlxlx.exe 316 tthbbt.exe 1704 dvpvd.exe 1584 lxllxrl.exe 2596 nnhbnb.exe 1940 ddpdp.exe 1784 rrxxllx.exe 2964 nththn.exe 2448 ppjpv.exe 3008 xrfxxxl.exe 340 3pdpv.exe 1080 vjvpj.exe 2112 xxllfrf.exe 840 jjdjv.exe 2224 1llxrll.exe 2044 hbtbnn.exe 2192 3lrrxxf.exe 2104 xrfxffr.exe 2372 bhtnnh.exe 1572 vpjvj.exe 2404 ttbbbb.exe 2796 ddvvj.exe 2116 llxflrf.exe 2916 bbnthn.exe 2760 thtthn.exe 2880 ddvjp.exe 2732 5lflxfl.exe 2876 rllrxlx.exe 2884 tnhbhb.exe 2604 dvjpd.exe 2664 7dvdp.exe 2636 9xrxffl.exe 2492 bnbtbb.exe 1556 9hnhnn.exe 1664 dvvpd.exe 644 hbbnbh.exe 2516 hhhhth.exe 980 xxrrllr.exe 1704 hbbhtt.exe 1788 fxrrxxl.exe 1316 1hhnnn.exe 1188 jjjpd.exe 1940 rrfrlrf.exe 1296 bbhbnb.exe 2284 vpdpd.exe 1384 lrxllrx.exe 1248 hthhnh.exe 908 hnnnnh.exe 1132 llrxfxf.exe 3048 bbbhbh.exe 1352 5pdvp.exe 1636 rllrfxf.exe -
resource yara_rule behavioral1/memory/2536-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000012118-8.dat upx behavioral1/memory/1864-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d77-16.dat upx behavioral1/memory/2536-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d9f-26.dat upx behavioral1/memory/2148-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016db1-34.dat upx behavioral1/memory/2820-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000017093-48.dat upx behavioral1/memory/2700-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000171b9-57.dat upx behavioral1/memory/2848-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00090000000173eb-77.dat upx behavioral1/memory/2904-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000175cc-87.dat upx behavioral1/files/0x000500000001927e-95.dat upx behavioral1/memory/2664-94-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2684-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019354-106.dat upx behavioral1/files/0x0005000000019372-113.dat upx behavioral1/files/0x000500000001938f-122.dat upx behavioral1/files/0x0005000000019412-131.dat upx behavioral1/memory/2668-129-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001941e-138.dat upx behavioral1/memory/1704-148-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019431-146.dat upx behavioral1/files/0x000500000001948a-174.dat upx behavioral1/files/0x00050000000194ab-182.dat upx behavioral1/files/0x0008000000016d56-194.dat upx behavioral1/files/0x00050000000194b9-202.dat upx behavioral1/files/0x00050000000194e7-212.dat upx behavioral1/files/0x0005000000019568-220.dat upx behavioral1/files/0x000500000001958d-229.dat upx behavioral1/files/0x00050000000195c7-238.dat upx behavioral1/files/0x000500000001960b-247.dat upx behavioral1/files/0x000500000001960d-257.dat upx behavioral1/memory/2224-256-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/840-248-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001960f-265.dat upx behavioral1/files/0x0005000000019611-275.dat upx behavioral1/files/0x0005000000019613-286.dat upx behavioral1/files/0x00070000000173b8-293.dat upx behavioral1/memory/2760-334-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2104-284-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2044-267-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/340-219-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3008-211-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2448-193-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2964-192-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2876-353-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019456-167.dat upx behavioral1/files/0x000500000001944b-159.dat upx behavioral1/memory/1584-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000173b8-67.dat upx behavioral1/memory/2712-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2820-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2664-372-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2636-379-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1664-392-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/644-405-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2284-459-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/1384-471-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1248-474-0x00000000002B0000-0x00000000002D7000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfxrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlrxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xrrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ttthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlrxxl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2536 wrote to memory of 1864 2536 bfb5179faa4e3fbf060b12204f9d08a0N.exe 30 PID 2536 wrote to memory of 1864 2536 bfb5179faa4e3fbf060b12204f9d08a0N.exe 30 PID 2536 wrote to memory of 1864 2536 bfb5179faa4e3fbf060b12204f9d08a0N.exe 30 PID 2536 wrote to memory of 1864 2536 bfb5179faa4e3fbf060b12204f9d08a0N.exe 30 PID 1864 wrote to memory of 1052 1864 lffrxfr.exe 31 PID 1864 wrote to memory of 1052 1864 lffrxfr.exe 31 PID 1864 wrote to memory of 1052 1864 lffrxfr.exe 31 PID 1864 wrote to memory of 1052 1864 lffrxfr.exe 31 PID 1052 wrote to memory of 2148 1052 jddjd.exe 32 PID 1052 wrote to memory of 2148 1052 jddjd.exe 32 PID 1052 wrote to memory of 2148 1052 jddjd.exe 32 PID 1052 wrote to memory of 2148 1052 jddjd.exe 32 PID 2148 wrote to memory of 2700 2148 bbhbnt.exe 33 PID 2148 wrote to memory of 2700 2148 bbhbnt.exe 33 PID 2148 wrote to memory of 2700 2148 bbhbnt.exe 33 PID 2148 wrote to memory of 2700 2148 bbhbnt.exe 33 PID 2700 wrote to memory of 2820 2700 7thbnt.exe 34 PID 2700 wrote to memory of 2820 2700 7thbnt.exe 34 PID 2700 wrote to memory of 2820 2700 7thbnt.exe 34 PID 2700 wrote to memory of 2820 2700 7thbnt.exe 34 PID 2820 wrote to memory of 2712 2820 fflfxxl.exe 35 PID 2820 wrote to memory of 2712 2820 fflfxxl.exe 35 PID 2820 wrote to memory of 2712 2820 fflfxxl.exe 35 PID 2820 wrote to memory of 2712 2820 fflfxxl.exe 35 PID 2712 wrote to memory of 2848 2712 tnhhtb.exe 36 PID 2712 wrote to memory of 2848 2712 tnhhtb.exe 36 PID 2712 wrote to memory of 2848 2712 tnhhtb.exe 36 PID 2712 wrote to memory of 2848 2712 tnhhtb.exe 36 PID 2848 wrote to memory of 2904 2848 vpjvj.exe 37 PID 2848 wrote to memory of 2904 2848 vpjvj.exe 37 PID 2848 wrote to memory of 2904 2848 vpjvj.exe 37 PID 2848 wrote to memory of 2904 2848 vpjvj.exe 37 PID 2904 wrote to memory of 2664 2904 lllxrxf.exe 72 PID 2904 wrote to memory of 2664 2904 lllxrxf.exe 72 PID 2904 wrote to memory of 2664 2904 lllxrxf.exe 72 PID 2904 wrote to memory of 2664 2904 lllxrxf.exe 72 PID 2664 wrote to memory of 2684 2664 9dppd.exe 39 PID 2664 wrote to memory of 2684 2664 9dppd.exe 39 PID 2664 wrote to memory of 2684 2664 9dppd.exe 39 PID 2664 wrote to memory of 2684 2664 9dppd.exe 39 PID 2684 wrote to memory of 2072 2684 ffffrfr.exe 40 PID 2684 wrote to memory of 2072 2684 ffffrfr.exe 40 PID 2684 wrote to memory of 2072 2684 ffffrfr.exe 40 PID 2684 wrote to memory of 2072 2684 ffffrfr.exe 40 PID 2072 wrote to memory of 1468 2072 7bbhtn.exe 41 PID 2072 wrote to memory of 1468 2072 7bbhtn.exe 41 PID 2072 wrote to memory of 1468 2072 7bbhtn.exe 41 PID 2072 wrote to memory of 1468 2072 7bbhtn.exe 41 PID 1468 wrote to memory of 2668 1468 vpvdp.exe 42 PID 1468 wrote to memory of 2668 1468 vpvdp.exe 42 PID 1468 wrote to memory of 2668 1468 vpvdp.exe 42 PID 1468 wrote to memory of 2668 1468 vpvdp.exe 42 PID 2668 wrote to memory of 316 2668 xxrlxlx.exe 43 PID 2668 wrote to memory of 316 2668 xxrlxlx.exe 43 PID 2668 wrote to memory of 316 2668 xxrlxlx.exe 43 PID 2668 wrote to memory of 316 2668 xxrlxlx.exe 43 PID 316 wrote to memory of 1704 316 tthbbt.exe 44 PID 316 wrote to memory of 1704 316 tthbbt.exe 44 PID 316 wrote to memory of 1704 316 tthbbt.exe 44 PID 316 wrote to memory of 1704 316 tthbbt.exe 44 PID 1704 wrote to memory of 1584 1704 dvpvd.exe 45 PID 1704 wrote to memory of 1584 1704 dvpvd.exe 45 PID 1704 wrote to memory of 1584 1704 dvpvd.exe 45 PID 1704 wrote to memory of 1584 1704 dvpvd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\bfb5179faa4e3fbf060b12204f9d08a0N.exe"C:\Users\Admin\AppData\Local\Temp\bfb5179faa4e3fbf060b12204f9d08a0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\lffrxfr.exec:\lffrxfr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\jddjd.exec:\jddjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
\??\c:\bbhbnt.exec:\bbhbnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\7thbnt.exec:\7thbnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\fflfxxl.exec:\fflfxxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\tnhhtb.exec:\tnhhtb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\vpjvj.exec:\vpjvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\lllxrxf.exec:\lllxrxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\9dppd.exec:\9dppd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\ffffrfr.exec:\ffffrfr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\7bbhtn.exec:\7bbhtn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\vpvdp.exec:\vpvdp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
\??\c:\xxrlxlx.exec:\xxrlxlx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\tthbbt.exec:\tthbbt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316 -
\??\c:\dvpvd.exec:\dvpvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\lxllxrl.exec:\lxllxrl.exe17⤵
- Executes dropped EXE
PID:1584 -
\??\c:\nnhbnb.exec:\nnhbnb.exe18⤵
- Executes dropped EXE
PID:2596 -
\??\c:\ddpdp.exec:\ddpdp.exe19⤵
- Executes dropped EXE
PID:1940 -
\??\c:\rrxxllx.exec:\rrxxllx.exe20⤵
- Executes dropped EXE
PID:1784 -
\??\c:\nththn.exec:\nththn.exe21⤵
- Executes dropped EXE
PID:2964 -
\??\c:\ppjpv.exec:\ppjpv.exe22⤵
- Executes dropped EXE
PID:2448 -
\??\c:\xrfxxxl.exec:\xrfxxxl.exe23⤵
- Executes dropped EXE
PID:3008 -
\??\c:\3pdpv.exec:\3pdpv.exe24⤵
- Executes dropped EXE
PID:340 -
\??\c:\vjvpj.exec:\vjvpj.exe25⤵
- Executes dropped EXE
PID:1080 -
\??\c:\xxllfrf.exec:\xxllfrf.exe26⤵
- Executes dropped EXE
PID:2112 -
\??\c:\jjdjv.exec:\jjdjv.exe27⤵
- Executes dropped EXE
PID:840 -
\??\c:\1llxrll.exec:\1llxrll.exe28⤵
- Executes dropped EXE
PID:2224 -
\??\c:\hbtbnn.exec:\hbtbnn.exe29⤵
- Executes dropped EXE
PID:2044 -
\??\c:\3lrrxxf.exec:\3lrrxxf.exe30⤵
- Executes dropped EXE
PID:2192 -
\??\c:\xrfxffr.exec:\xrfxffr.exe31⤵
- Executes dropped EXE
PID:2104 -
\??\c:\bhtnnh.exec:\bhtnnh.exe32⤵
- Executes dropped EXE
PID:2372 -
\??\c:\vpjvj.exec:\vpjvj.exe33⤵
- Executes dropped EXE
PID:1572 -
\??\c:\ttbbbb.exec:\ttbbbb.exe34⤵
- Executes dropped EXE
PID:2404 -
\??\c:\ddvvj.exec:\ddvvj.exe35⤵
- Executes dropped EXE
PID:2796 -
\??\c:\llxflrf.exec:\llxflrf.exe36⤵
- Executes dropped EXE
PID:2116 -
\??\c:\bbnthn.exec:\bbnthn.exe37⤵
- Executes dropped EXE
PID:2916 -
\??\c:\thtthn.exec:\thtthn.exe38⤵
- Executes dropped EXE
PID:2760 -
\??\c:\ddvjp.exec:\ddvjp.exe39⤵
- Executes dropped EXE
PID:2880 -
\??\c:\5lflxfl.exec:\5lflxfl.exe40⤵
- Executes dropped EXE
PID:2732 -
\??\c:\rllrxlx.exec:\rllrxlx.exe41⤵
- Executes dropped EXE
PID:2876 -
\??\c:\tnhbhb.exec:\tnhbhb.exe42⤵
- Executes dropped EXE
PID:2884 -
\??\c:\dvjpd.exec:\dvjpd.exe43⤵
- Executes dropped EXE
PID:2604 -
\??\c:\7dvdp.exec:\7dvdp.exe44⤵
- Executes dropped EXE
PID:2664 -
\??\c:\9xrxffl.exec:\9xrxffl.exe45⤵
- Executes dropped EXE
PID:2636 -
\??\c:\bnbtbb.exec:\bnbtbb.exe46⤵
- Executes dropped EXE
PID:2492 -
\??\c:\9hnhnn.exec:\9hnhnn.exe47⤵
- Executes dropped EXE
PID:1556 -
\??\c:\dvvpd.exec:\dvvpd.exe48⤵
- Executes dropped EXE
PID:1664 -
\??\c:\hbbnbh.exec:\hbbnbh.exe49⤵
- Executes dropped EXE
PID:644 -
\??\c:\hhhhth.exec:\hhhhth.exe50⤵
- Executes dropped EXE
PID:2516 -
\??\c:\xxrrllr.exec:\xxrrllr.exe51⤵
- Executes dropped EXE
PID:980 -
\??\c:\hbbhtt.exec:\hbbhtt.exe52⤵
- Executes dropped EXE
PID:1704 -
\??\c:\fxrrxxl.exec:\fxrrxxl.exe53⤵
- Executes dropped EXE
PID:1788 -
\??\c:\1hhnnn.exec:\1hhnnn.exe54⤵
- Executes dropped EXE
PID:1316 -
\??\c:\jjjpd.exec:\jjjpd.exe55⤵
- Executes dropped EXE
PID:1188 -
\??\c:\rrfrlrf.exec:\rrfrlrf.exe56⤵
- Executes dropped EXE
PID:1940 -
\??\c:\bbhbnb.exec:\bbhbnb.exe57⤵
- Executes dropped EXE
PID:1296 -
\??\c:\vpdpd.exec:\vpdpd.exe58⤵
- Executes dropped EXE
PID:2284 -
\??\c:\lrxllrx.exec:\lrxllrx.exe59⤵
- Executes dropped EXE
PID:1384 -
\??\c:\hthhnh.exec:\hthhnh.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1248 -
\??\c:\hnnnnh.exec:\hnnnnh.exe61⤵
- Executes dropped EXE
PID:908 -
\??\c:\llrxfxf.exec:\llrxfxf.exe62⤵
- Executes dropped EXE
PID:1132 -
\??\c:\bbbhbh.exec:\bbbhbh.exe63⤵
- Executes dropped EXE
PID:3048 -
\??\c:\5pdvp.exec:\5pdvp.exe64⤵
- Executes dropped EXE
PID:1352 -
\??\c:\rllrfxf.exec:\rllrfxf.exe65⤵
- Executes dropped EXE
PID:1636 -
\??\c:\rrlrffx.exec:\rrlrffx.exe66⤵PID:3068
-
\??\c:\btnbnn.exec:\btnbnn.exe67⤵PID:772
-
\??\c:\hhhnnt.exec:\hhhnnt.exe68⤵PID:2120
-
\??\c:\vdvpj.exec:\vdvpj.exe69⤵PID:2236
-
\??\c:\ffxxlxl.exec:\ffxxlxl.exe70⤵PID:2380
-
\??\c:\bbthth.exec:\bbthth.exe71⤵PID:2104
-
\??\c:\dvdjd.exec:\dvdjd.exe72⤵PID:2372
-
\??\c:\pjvjv.exec:\pjvjv.exe73⤵PID:1824
-
\??\c:\fllflxl.exec:\fllflxl.exe74⤵PID:2016
-
\??\c:\btnhnt.exec:\btnhnt.exe75⤵PID:2520
-
\??\c:\pdjvd.exec:\pdjvd.exe76⤵PID:2912
-
\??\c:\rrllfrl.exec:\rrllfrl.exe77⤵PID:2756
-
\??\c:\lllxffr.exec:\lllxffr.exe78⤵PID:2868
-
\??\c:\nnhhnb.exec:\nnhhnb.exe79⤵PID:2748
-
\??\c:\ppppd.exec:\ppppd.exe80⤵PID:2724
-
\??\c:\lflrxfl.exec:\lflrxfl.exe81⤵PID:2712
-
\??\c:\rlrxrrf.exec:\rlrxrrf.exe82⤵PID:2872
-
\??\c:\bthhnn.exec:\bthhnn.exe83⤵PID:2628
-
\??\c:\vvdjj.exec:\vvdjj.exe84⤵PID:2608
-
\??\c:\vvjvd.exec:\vvjvd.exe85⤵PID:2320
-
\??\c:\rxxxrxl.exec:\rxxxrxl.exe86⤵PID:2684
-
\??\c:\3nnnht.exec:\3nnnht.exe87⤵PID:2660
-
\??\c:\jdvjv.exec:\jdvjv.exe88⤵PID:1900
-
\??\c:\ppdpd.exec:\ppdpd.exe89⤵PID:1468
-
\??\c:\xrrlxfl.exec:\xrrlxfl.exe90⤵PID:2668
-
\??\c:\1thnnn.exec:\1thnnn.exe91⤵PID:1440
-
\??\c:\vpjjv.exec:\vpjjv.exe92⤵PID:640
-
\??\c:\1lfflrr.exec:\1lfflrr.exe93⤵PID:952
-
\??\c:\xxrrxfl.exec:\xxrrxfl.exe94⤵PID:2496
-
\??\c:\hhhtnb.exec:\hhhtnb.exe95⤵PID:1728
-
\??\c:\7pvpd.exec:\7pvpd.exe96⤵PID:2836
-
\??\c:\rfrxfff.exec:\rfrxfff.exe97⤵PID:2952
-
\??\c:\7lrrfxf.exec:\7lrrfxf.exe98⤵PID:2704
-
\??\c:\hnhnnb.exec:\hnhnnb.exe99⤵PID:1296
-
\??\c:\jjvdj.exec:\jjvdj.exe100⤵PID:1252
-
\??\c:\rfxfxlf.exec:\rfxfxlf.exe101⤵PID:1384
-
\??\c:\bbhtnt.exec:\bbhtnt.exe102⤵PID:2968
-
\??\c:\ttnbth.exec:\ttnbth.exe103⤵PID:1396
-
\??\c:\1vvdd.exec:\1vvdd.exe104⤵PID:2060
-
\??\c:\3lfrflr.exec:\3lfrflr.exe105⤵PID:408
-
\??\c:\llfrlrl.exec:\llfrlrl.exe106⤵PID:1352
-
\??\c:\hhntbt.exec:\hhntbt.exe107⤵PID:560
-
\??\c:\djvjd.exec:\djvjd.exe108⤵PID:2592
-
\??\c:\9llrlxl.exec:\9llrlxl.exe109⤵PID:3068
-
\??\c:\ntntnh.exec:\ntntnh.exe110⤵PID:808
-
\??\c:\nntbth.exec:\nntbth.exe111⤵
- System Location Discovery: System Language Discovery
PID:2120 -
\??\c:\lfxfllx.exec:\lfxfllx.exe112⤵PID:892
-
\??\c:\xxrxflr.exec:\xxrxflr.exe113⤵PID:880
-
\??\c:\hbnthn.exec:\hbnthn.exe114⤵PID:2692
-
\??\c:\vvjvd.exec:\vvjvd.exe115⤵PID:3064
-
\??\c:\lfxfrrf.exec:\lfxfrrf.exe116⤵PID:744
-
\??\c:\9nbnbh.exec:\9nbnbh.exe117⤵PID:2404
-
\??\c:\vvvdp.exec:\vvvdp.exe118⤵PID:2196
-
\??\c:\rrlxrff.exec:\rrlxrff.exe119⤵PID:2108
-
\??\c:\3thntt.exec:\3thntt.exe120⤵PID:2856
-
\??\c:\ppjpj.exec:\ppjpj.exe121⤵PID:2916
-
\??\c:\jpvpv.exec:\jpvpv.exe122⤵
- System Location Discovery: System Language Discovery
PID:1880
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-