Analysis
-
max time kernel
150s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/09/2024, 20:27
Behavioral task
behavioral1
Sample
37573c46949e97a60c9c9c8f3823f2490faf560bac434463aa779fac08dc404a.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
General
-
Target
37573c46949e97a60c9c9c8f3823f2490faf560bac434463aa779fac08dc404a.exe
-
Size
331KB
-
MD5
46b5a05a76785da0e1e43e0975d68807
-
SHA1
eeff7ed736a9c1830877425bc06236c075fb7b16
-
SHA256
37573c46949e97a60c9c9c8f3823f2490faf560bac434463aa779fac08dc404a
-
SHA512
5fa6682ca0dca8f46407ebdc982360c10c93d5b501fe56c5db1ce4de19edabe094bc077475e724b8eb0ac58e641ad3a9ecc1cb65e62e04b1216985303d38f5a1
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbed:R4wFHoSHYHUrAwfMp3CDd
Malware Config
Signatures
-
Detect Blackmoon payload 47 IoCs
resource yara_rule behavioral1/memory/2656-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2748-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2832-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2720-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2716-41-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2716-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2684-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2560-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1512-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1524-75-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1524-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/448-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/448-84-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2280-93-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/2280-95-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2524-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3060-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2064-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3012-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2316-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1996-144-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1996-146-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2008-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2008-169-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2968-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/320-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2032-195-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2436-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2220-213-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1988-271-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2576-325-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2620-331-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3000-337-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2224-343-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1164-375-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/1164-376-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2728-387-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1176-415-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2004-427-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2176-468-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2456-526-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2092-572-0x0000000000280000-0x00000000002A7000-memory.dmp family_blackmoon behavioral1/memory/2092-574-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2904-609-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1076-611-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2160-634-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2448-16408-0x00000000773E0000-0x00000000774FF000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2748 jdvvd.exe 2832 vvjpv.exe 2720 1lllxll.exe 2716 pjdjv.exe 2684 xrxlrrf.exe 2560 nntbbh.exe 1512 9rrrflx.exe 1524 nbhnbt.exe 448 rxflxlx.exe 2280 tttnnt.exe 2524 rrrffxl.exe 3060 vjpdv.exe 2064 7rlrflx.exe 3012 dvdjj.exe 2316 5fxlrrr.exe 1996 pjjpj.exe 2320 lfxxffr.exe 320 hnthtn.exe 2008 jdvdj.exe 1780 frxrrfx.exe 2968 bhnbtb.exe 2032 tnhbhh.exe 2380 jpjpd.exe 2220 llxfrxf.exe 2436 5dvjd.exe 1116 rrflxrf.exe 2984 nbtnnn.exe 1208 fxfxffl.exe 2244 1djdp.exe 2476 lxxllff.exe 1988 ffxrlll.exe 1056 bbhnbh.exe 2676 lfrxfrx.exe 1584 9nnntb.exe 2688 5dpvv.exe 2692 lffrlrl.exe 2108 bthhtt.exe 2744 pvdvv.exe 2440 9fllrff.exe 2432 nntbnt.exe 2576 1vvjv.exe 2620 rfxxxxf.exe 3000 bthbhn.exe 2224 tnttnt.exe 2868 1ppdd.exe 2388 rxffflf.exe 2848 5bhtnh.exe 1228 7vddd.exe 2940 lxrrflx.exe 1164 bththn.exe 3060 dvpjv.exe 2728 3fflrll.exe 2896 fxfrxrx.exe 2860 nnhtbn.exe 1900 vvjjd.exe 2184 rlxrrrr.exe 1176 3tnnbt.exe 792 pjdjp.exe 2004 xrrxxxl.exe 2376 9nnbnn.exe 1780 9pjpd.exe 3048 rfxrxxf.exe 1280 rlxrxfr.exe 1340 nnbntt.exe -
resource yara_rule behavioral1/memory/2656-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000c00000001226a-8.dat upx behavioral1/memory/2748-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2656-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2748-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000f0000000164c8-16.dat upx behavioral1/files/0x000800000001658c-25.dat upx behavioral1/memory/2832-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2720-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000800000001662e-34.dat upx behavioral1/files/0x0007000000016aa9-44.dat upx behavioral1/memory/2716-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016c62-51.dat upx behavioral1/memory/2684-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2560-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016c7b-59.dat upx behavioral1/memory/1512-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000a000000016c84-68.dat upx behavioral1/files/0x0009000000016cd1-76.dat upx behavioral1/memory/1524-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/448-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000173da-85.dat upx behavioral1/memory/2280-95-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000173f1-94.dat upx behavioral1/files/0x00060000000173f4-103.dat upx behavioral1/memory/2524-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3060-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2064-112-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000173fc-110.dat upx behavioral1/memory/2064-119-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017472-120.dat upx behavioral1/files/0x00330000000161f6-128.dat upx behavioral1/memory/3012-129-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2316-137-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017487-136.dat upx behavioral1/files/0x00060000000174a2-145.dat upx behavioral1/memory/1996-146-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017525-153.dat upx behavioral1/files/0x0014000000018663-163.dat upx behavioral1/files/0x000d00000001866e-172.dat upx behavioral1/files/0x0005000000018687-179.dat upx behavioral1/memory/2008-171-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2968-188-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018792-187.dat upx behavioral1/memory/320-162-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018c1a-196.dat upx behavioral1/files/0x0006000000018c26-203.dat upx behavioral1/memory/2220-205-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2380-204-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0006000000018f53-215.dat upx behavioral1/memory/2436-217-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001903b-222.dat upx behavioral1/files/0x00060000000190ce-230.dat upx behavioral1/files/0x00050000000191d4-236.dat upx behavioral1/files/0x00050000000191ff-247.dat upx behavioral1/memory/2244-246-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001922c-253.dat upx behavioral1/memory/1208-243-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0005000000019244-261.dat upx behavioral1/files/0x0005000000019256-268.dat upx behavioral1/memory/1988-271-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2108-301-0x00000000001B0000-0x00000000001D7000-memory.dmp upx behavioral1/memory/2576-325-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3000-337-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lflxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdpv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2656 wrote to memory of 2748 2656 37573c46949e97a60c9c9c8f3823f2490faf560bac434463aa779fac08dc404a.exe 30 PID 2656 wrote to memory of 2748 2656 37573c46949e97a60c9c9c8f3823f2490faf560bac434463aa779fac08dc404a.exe 30 PID 2656 wrote to memory of 2748 2656 37573c46949e97a60c9c9c8f3823f2490faf560bac434463aa779fac08dc404a.exe 30 PID 2656 wrote to memory of 2748 2656 37573c46949e97a60c9c9c8f3823f2490faf560bac434463aa779fac08dc404a.exe 30 PID 2748 wrote to memory of 2832 2748 jdvvd.exe 31 PID 2748 wrote to memory of 2832 2748 jdvvd.exe 31 PID 2748 wrote to memory of 2832 2748 jdvvd.exe 31 PID 2748 wrote to memory of 2832 2748 jdvvd.exe 31 PID 2832 wrote to memory of 2720 2832 vvjpv.exe 32 PID 2832 wrote to memory of 2720 2832 vvjpv.exe 32 PID 2832 wrote to memory of 2720 2832 vvjpv.exe 32 PID 2832 wrote to memory of 2720 2832 vvjpv.exe 32 PID 2720 wrote to memory of 2716 2720 1lllxll.exe 33 PID 2720 wrote to memory of 2716 2720 1lllxll.exe 33 PID 2720 wrote to memory of 2716 2720 1lllxll.exe 33 PID 2720 wrote to memory of 2716 2720 1lllxll.exe 33 PID 2716 wrote to memory of 2684 2716 pjdjv.exe 34 PID 2716 wrote to memory of 2684 2716 pjdjv.exe 34 PID 2716 wrote to memory of 2684 2716 pjdjv.exe 34 PID 2716 wrote to memory of 2684 2716 pjdjv.exe 34 PID 2684 wrote to memory of 2560 2684 xrxlrrf.exe 35 PID 2684 wrote to memory of 2560 2684 xrxlrrf.exe 35 PID 2684 wrote to memory of 2560 2684 xrxlrrf.exe 35 PID 2684 wrote to memory of 2560 2684 xrxlrrf.exe 35 PID 2560 wrote to memory of 1512 2560 nntbbh.exe 36 PID 2560 wrote to memory of 1512 2560 nntbbh.exe 36 PID 2560 wrote to memory of 1512 2560 nntbbh.exe 36 PID 2560 wrote to memory of 1512 2560 nntbbh.exe 36 PID 1512 wrote to memory of 1524 1512 9rrrflx.exe 37 PID 1512 wrote to memory of 1524 1512 9rrrflx.exe 37 PID 1512 wrote to memory of 1524 1512 9rrrflx.exe 37 PID 1512 wrote to memory of 1524 1512 9rrrflx.exe 37 PID 1524 wrote to memory of 448 1524 nbhnbt.exe 38 PID 1524 wrote to memory of 448 1524 nbhnbt.exe 38 PID 1524 wrote to memory of 448 1524 nbhnbt.exe 38 PID 1524 wrote to memory of 448 1524 nbhnbt.exe 38 PID 448 wrote to memory of 2280 448 rxflxlx.exe 39 PID 448 wrote to memory of 2280 448 rxflxlx.exe 39 PID 448 wrote to memory of 2280 448 rxflxlx.exe 39 PID 448 wrote to memory of 2280 448 rxflxlx.exe 39 PID 2280 wrote to memory of 2524 2280 tttnnt.exe 40 PID 2280 wrote to memory of 2524 2280 tttnnt.exe 40 PID 2280 wrote to memory of 2524 2280 tttnnt.exe 40 PID 2280 wrote to memory of 2524 2280 tttnnt.exe 40 PID 2524 wrote to memory of 3060 2524 rrrffxl.exe 41 PID 2524 wrote to memory of 3060 2524 rrrffxl.exe 41 PID 2524 wrote to memory of 3060 2524 rrrffxl.exe 41 PID 2524 wrote to memory of 3060 2524 rrrffxl.exe 41 PID 3060 wrote to memory of 2064 3060 vjpdv.exe 42 PID 3060 wrote to memory of 2064 3060 vjpdv.exe 42 PID 3060 wrote to memory of 2064 3060 vjpdv.exe 42 PID 3060 wrote to memory of 2064 3060 vjpdv.exe 42 PID 2064 wrote to memory of 3012 2064 7rlrflx.exe 43 PID 2064 wrote to memory of 3012 2064 7rlrflx.exe 43 PID 2064 wrote to memory of 3012 2064 7rlrflx.exe 43 PID 2064 wrote to memory of 3012 2064 7rlrflx.exe 43 PID 3012 wrote to memory of 2316 3012 dvdjj.exe 44 PID 3012 wrote to memory of 2316 3012 dvdjj.exe 44 PID 3012 wrote to memory of 2316 3012 dvdjj.exe 44 PID 3012 wrote to memory of 2316 3012 dvdjj.exe 44 PID 2316 wrote to memory of 1996 2316 5fxlrrr.exe 45 PID 2316 wrote to memory of 1996 2316 5fxlrrr.exe 45 PID 2316 wrote to memory of 1996 2316 5fxlrrr.exe 45 PID 2316 wrote to memory of 1996 2316 5fxlrrr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\37573c46949e97a60c9c9c8f3823f2490faf560bac434463aa779fac08dc404a.exe"C:\Users\Admin\AppData\Local\Temp\37573c46949e97a60c9c9c8f3823f2490faf560bac434463aa779fac08dc404a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\jdvvd.exec:\jdvvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\vvjpv.exec:\vvjpv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\1lllxll.exec:\1lllxll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\pjdjv.exec:\pjdjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\xrxlrrf.exec:\xrxlrrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\nntbbh.exec:\nntbbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\9rrrflx.exec:\9rrrflx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\nbhnbt.exec:\nbhnbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\rxflxlx.exec:\rxflxlx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\tttnnt.exec:\tttnnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\rrrffxl.exec:\rrrffxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\vjpdv.exec:\vjpdv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\7rlrflx.exec:\7rlrflx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\dvdjj.exec:\dvdjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\5fxlrrr.exec:\5fxlrrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\pjjpj.exec:\pjjpj.exe17⤵
- Executes dropped EXE
PID:1996 -
\??\c:\lfxxffr.exec:\lfxxffr.exe18⤵
- Executes dropped EXE
PID:2320 -
\??\c:\hnthtn.exec:\hnthtn.exe19⤵
- Executes dropped EXE
PID:320 -
\??\c:\jdvdj.exec:\jdvdj.exe20⤵
- Executes dropped EXE
PID:2008 -
\??\c:\frxrrfx.exec:\frxrrfx.exe21⤵
- Executes dropped EXE
PID:1780 -
\??\c:\bhnbtb.exec:\bhnbtb.exe22⤵
- Executes dropped EXE
PID:2968 -
\??\c:\tnhbhh.exec:\tnhbhh.exe23⤵
- Executes dropped EXE
PID:2032 -
\??\c:\jpjpd.exec:\jpjpd.exe24⤵
- Executes dropped EXE
PID:2380 -
\??\c:\llxfrxf.exec:\llxfrxf.exe25⤵
- Executes dropped EXE
PID:2220 -
\??\c:\5dvjd.exec:\5dvjd.exe26⤵
- Executes dropped EXE
PID:2436 -
\??\c:\rrflxrf.exec:\rrflxrf.exe27⤵
- Executes dropped EXE
PID:1116 -
\??\c:\nbtnnn.exec:\nbtnnn.exe28⤵
- Executes dropped EXE
PID:2984 -
\??\c:\fxfxffl.exec:\fxfxffl.exe29⤵
- Executes dropped EXE
PID:1208 -
\??\c:\1djdp.exec:\1djdp.exe30⤵
- Executes dropped EXE
PID:2244 -
\??\c:\lxxllff.exec:\lxxllff.exe31⤵
- Executes dropped EXE
PID:2476 -
\??\c:\ffxrlll.exec:\ffxrlll.exe32⤵
- Executes dropped EXE
PID:1988 -
\??\c:\bbhnbh.exec:\bbhnbh.exe33⤵
- Executes dropped EXE
PID:1056 -
\??\c:\lfrxfrx.exec:\lfrxfrx.exe34⤵
- Executes dropped EXE
PID:2676 -
\??\c:\9nnntb.exec:\9nnntb.exe35⤵
- Executes dropped EXE
PID:1584 -
\??\c:\5dpvv.exec:\5dpvv.exe36⤵
- Executes dropped EXE
PID:2688 -
\??\c:\lffrlrl.exec:\lffrlrl.exe37⤵
- Executes dropped EXE
PID:2692 -
\??\c:\bthhtt.exec:\bthhtt.exe38⤵
- Executes dropped EXE
PID:2108 -
\??\c:\pvdvv.exec:\pvdvv.exe39⤵
- Executes dropped EXE
PID:2744 -
\??\c:\9fllrff.exec:\9fllrff.exe40⤵
- Executes dropped EXE
PID:2440 -
\??\c:\nntbnt.exec:\nntbnt.exe41⤵
- Executes dropped EXE
PID:2432 -
\??\c:\1vvjv.exec:\1vvjv.exe42⤵
- Executes dropped EXE
PID:2576 -
\??\c:\rfxxxxf.exec:\rfxxxxf.exe43⤵
- Executes dropped EXE
PID:2620 -
\??\c:\bthbhn.exec:\bthbhn.exe44⤵
- Executes dropped EXE
PID:3000 -
\??\c:\tnttnt.exec:\tnttnt.exe45⤵
- Executes dropped EXE
PID:2224 -
\??\c:\1ppdd.exec:\1ppdd.exe46⤵
- Executes dropped EXE
PID:2868 -
\??\c:\rxffflf.exec:\rxffflf.exe47⤵
- Executes dropped EXE
PID:2388 -
\??\c:\5bhtnh.exec:\5bhtnh.exe48⤵
- Executes dropped EXE
PID:2848 -
\??\c:\7vddd.exec:\7vddd.exe49⤵
- Executes dropped EXE
PID:1228 -
\??\c:\lxrrflx.exec:\lxrrflx.exe50⤵
- Executes dropped EXE
PID:2940 -
\??\c:\bththn.exec:\bththn.exe51⤵
- Executes dropped EXE
PID:1164 -
\??\c:\dvpjv.exec:\dvpjv.exe52⤵
- Executes dropped EXE
PID:3060 -
\??\c:\3fflrll.exec:\3fflrll.exe53⤵
- Executes dropped EXE
PID:2728 -
\??\c:\fxfrxrx.exec:\fxfrxrx.exe54⤵
- Executes dropped EXE
PID:2896 -
\??\c:\nnhtbn.exec:\nnhtbn.exe55⤵
- Executes dropped EXE
PID:2860 -
\??\c:\vvjjd.exec:\vvjjd.exe56⤵
- Executes dropped EXE
PID:1900 -
\??\c:\rlxrrrr.exec:\rlxrrrr.exe57⤵
- Executes dropped EXE
PID:2184 -
\??\c:\3tnnbt.exec:\3tnnbt.exe58⤵
- Executes dropped EXE
PID:1176 -
\??\c:\pjdjp.exec:\pjdjp.exe59⤵
- Executes dropped EXE
PID:792 -
\??\c:\xrrxxxl.exec:\xrrxxxl.exe60⤵
- Executes dropped EXE
PID:2004 -
\??\c:\9nnbnn.exec:\9nnbnn.exe61⤵
- Executes dropped EXE
PID:2376 -
\??\c:\9pjpd.exec:\9pjpd.exe62⤵
- Executes dropped EXE
PID:1780 -
\??\c:\rfxrxxf.exec:\rfxrxxf.exe63⤵
- Executes dropped EXE
PID:3048 -
\??\c:\rlxrxfr.exec:\rlxrxfr.exe64⤵
- Executes dropped EXE
PID:1280 -
\??\c:\nnbntt.exec:\nnbntt.exe65⤵
- Executes dropped EXE
PID:1340 -
\??\c:\pppvj.exec:\pppvj.exe66⤵PID:1348
-
\??\c:\ddjvj.exec:\ddjvj.exe67⤵PID:2176
-
\??\c:\3fxxfrr.exec:\3fxxfrr.exe68⤵PID:840
-
\??\c:\thtbbb.exec:\thtbbb.exe69⤵PID:1828
-
\??\c:\pjvpp.exec:\pjvpp.exe70⤵PID:1756
-
\??\c:\xlrxffl.exec:\xlrxffl.exe71⤵PID:3028
-
\??\c:\lfrxlxf.exec:\lfrxlxf.exe72⤵PID:2292
-
\??\c:\bnhbbb.exec:\bnhbbb.exe73⤵PID:768
-
\??\c:\9pdjp.exec:\9pdjp.exe74⤵PID:1800
-
\??\c:\xxffrfl.exec:\xxffrfl.exe75⤵PID:344
-
\??\c:\lrlxfrx.exec:\lrlxfrx.exe76⤵PID:1744
-
\??\c:\7btntn.exec:\7btntn.exe77⤵PID:2456
-
\??\c:\ddvdp.exec:\ddvdp.exe78⤵PID:2468
-
\??\c:\rfrrlll.exec:\rfrrlll.exe79⤵PID:2656
-
\??\c:\hbthtn.exec:\hbthtn.exe80⤵PID:1708
-
\??\c:\hthntt.exec:\hthntt.exe81⤵PID:1584
-
\??\c:\ppdpv.exec:\ppdpv.exe82⤵PID:2760
-
\??\c:\rlfrflr.exec:\rlfrflr.exe83⤵PID:2708
-
\??\c:\9tnthn.exec:\9tnthn.exe84⤵PID:2580
-
\??\c:\5thbtn.exec:\5thbtn.exe85⤵PID:2092
-
\??\c:\1vvdj.exec:\1vvdj.exe86⤵PID:2712
-
\??\c:\fxlxfrf.exec:\fxlxfrf.exe87⤵PID:2588
-
\??\c:\5tbbhn.exec:\5tbbhn.exe88⤵PID:1516
-
\??\c:\vdjvv.exec:\vdjvv.exe89⤵PID:3000
-
\??\c:\7dppv.exec:\7dppv.exe90⤵PID:3008
-
\??\c:\5rllxxx.exec:\5rllxxx.exe91⤵PID:2904
-
\??\c:\bbthnn.exec:\bbthnn.exe92⤵PID:1076
-
\??\c:\bnhhtt.exec:\bnhhtt.exe93⤵PID:2952
-
\??\c:\7vdvv.exec:\7vdvv.exe94⤵PID:1228
-
\??\c:\7xxxffr.exec:\7xxxffr.exe95⤵PID:2160
-
\??\c:\ttnbtn.exec:\ttnbtn.exe96⤵PID:2824
-
\??\c:\bnbnbb.exec:\bnbnbb.exe97⤵PID:1852
-
\??\c:\djdjp.exec:\djdjp.exe98⤵PID:2648
-
\??\c:\ffflxxr.exec:\ffflxxr.exe99⤵PID:2844
-
\??\c:\7nbtth.exec:\7nbtth.exe100⤵PID:2616
-
\??\c:\1nbbnn.exec:\1nbbnn.exe101⤵PID:1372
-
\??\c:\ppddp.exec:\ppddp.exe102⤵PID:2320
-
\??\c:\fflxfxf.exec:\fflxfxf.exe103⤵PID:1672
-
\??\c:\rxxrrll.exec:\rxxrrll.exe104⤵PID:2004
-
\??\c:\5nhntb.exec:\5nhntb.exe105⤵PID:552
-
\??\c:\vppvd.exec:\vppvd.exe106⤵PID:1780
-
\??\c:\xlrrlxx.exec:\xlrrlxx.exe107⤵PID:3052
-
\??\c:\3hhtbh.exec:\3hhtbh.exe108⤵PID:2040
-
\??\c:\7pvvj.exec:\7pvvj.exe109⤵PID:988
-
\??\c:\7lxxlrl.exec:\7lxxlrl.exe110⤵PID:664
-
\??\c:\bnhnnh.exec:\bnhnnh.exe111⤵PID:2176
-
\??\c:\jjdpd.exec:\jjdpd.exe112⤵PID:1100
-
\??\c:\xrxlrxl.exec:\xrxlrxl.exe113⤵PID:996
-
\??\c:\bthtbh.exec:\bthtbh.exe114⤵PID:2408
-
\??\c:\vdppv.exec:\vdppv.exe115⤵PID:2984
-
\??\c:\dvddp.exec:\dvddp.exe116⤵PID:856
-
\??\c:\fxlrxxr.exec:\fxlrxxr.exe117⤵PID:1564
-
\??\c:\1hbbnt.exec:\1hbbnt.exe118⤵PID:2428
-
\??\c:\vpvjp.exec:\vpvjp.exe119⤵PID:1856
-
\??\c:\llflrrx.exec:\llflrrx.exe120⤵PID:2736
-
\??\c:\3xrxrxr.exec:\3xrxrxr.exe121⤵PID:1596
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-