Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11-09-2024 03:57
Behavioral task
behavioral1
Sample
580c880a21fb211dddcd67f398ba2b60N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
580c880a21fb211dddcd67f398ba2b60N.exe
-
Size
76KB
-
MD5
580c880a21fb211dddcd67f398ba2b60
-
SHA1
6feb94444fa88adf51f319fcb933015d1b59a9f9
-
SHA256
3903e4a2e8a02350381667a11863f2c554f261f0a1ed72aa25fac58630f939ee
-
SHA512
ff889ef344535a5395d5018ca561942bd7458803285253eb7220fecff877f644b5a414793fff79fc7785d3674de463b91d28698c0ac8b83e4d91078d6acde6a6
-
SSDEEP
1536:NvQBeOGtrYS3srx93UBWfwC6Ggnouy8KlAXmAXIBG/+WIFuTKLXvCB5yAXNlIQk0:NhOmTsF93UYfwC6GIoutOP/WWGKL/SYu
Malware Config
Signatures
-
Detect Blackmoon payload 61 IoCs
resource yara_rule behavioral1/memory/2820-7-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/2680-18-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/2836-22-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/1260-37-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/2996-66-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/796-57-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/796-55-0x00000000002B0000-0x00000000002E3000-memory.dmp family_blackmoon behavioral1/memory/2440-77-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/1772-85-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/2492-96-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/2172-100-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/2492-95-0x0000000000220000-0x0000000000253000-memory.dmp family_blackmoon behavioral1/memory/1828-108-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/2492-94-0x0000000000220000-0x0000000000253000-memory.dmp family_blackmoon behavioral1/memory/2784-136-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/1256-132-0x00000000003C0000-0x00000000003F3000-memory.dmp family_blackmoon behavioral1/memory/1256-131-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/1900-152-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/2132-168-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/2136-176-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/1352-187-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/1616-195-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/856-205-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/1616-223-0x0000000000220000-0x0000000000253000-memory.dmp family_blackmoon behavioral1/memory/2248-231-0x00000000001B0000-0x00000000001E3000-memory.dmp family_blackmoon behavioral1/memory/1964-240-0x0000000000440000-0x0000000000473000-memory.dmp family_blackmoon behavioral1/memory/3024-261-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/2324-276-0x0000000000220000-0x0000000000253000-memory.dmp family_blackmoon behavioral1/memory/2140-293-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/1632-301-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/2324-302-0x0000000000220000-0x0000000000253000-memory.dmp family_blackmoon behavioral1/memory/1396-315-0x00000000003A0000-0x00000000003D3000-memory.dmp family_blackmoon behavioral1/memory/2504-330-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/3048-337-0x0000000000220000-0x0000000000253000-memory.dmp family_blackmoon behavioral1/memory/772-350-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/2008-377-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/1196-397-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/2420-404-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/1596-436-0x00000000002A0000-0x00000000002D3000-memory.dmp family_blackmoon behavioral1/memory/2216-444-0x0000000000220000-0x0000000000253000-memory.dmp family_blackmoon behavioral1/memory/1512-476-0x0000000000220000-0x0000000000253000-memory.dmp family_blackmoon behavioral1/memory/444-490-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/1512-498-0x0000000000220000-0x0000000000253000-memory.dmp family_blackmoon behavioral1/memory/2960-534-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/1528-567-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/2884-622-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/1852-629-0x0000000000220000-0x0000000000253000-memory.dmp family_blackmoon behavioral1/memory/2220-660-0x0000000000220000-0x0000000000253000-memory.dmp family_blackmoon behavioral1/memory/2128-722-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/856-760-0x0000000000220000-0x0000000000253000-memory.dmp family_blackmoon behavioral1/memory/1944-773-0x0000000000220000-0x0000000000253000-memory.dmp family_blackmoon behavioral1/memory/892-780-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral1/memory/2644-837-0x0000000000220000-0x0000000000253000-memory.dmp family_blackmoon behavioral1/memory/576-880-0x00000000002A0000-0x00000000002D3000-memory.dmp family_blackmoon behavioral1/memory/2884-893-0x0000000000220000-0x0000000000253000-memory.dmp family_blackmoon behavioral1/memory/2792-913-0x00000000003A0000-0x00000000003D3000-memory.dmp family_blackmoon behavioral1/memory/1400-993-0x00000000005D0000-0x0000000000603000-memory.dmp family_blackmoon behavioral1/memory/540-1013-0x0000000000220000-0x0000000000253000-memory.dmp family_blackmoon behavioral1/memory/736-1039-0x0000000000220000-0x0000000000253000-memory.dmp family_blackmoon behavioral1/memory/2124-1113-0x0000000000220000-0x0000000000253000-memory.dmp family_blackmoon behavioral1/memory/2524-1112-0x0000000000220000-0x0000000000253000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2680 rrrxfxx.exe 2836 ppppp.exe 1260 rfrrxfl.exe 2532 hbbntn.exe 796 hhnttt.exe 2996 1ffxxxf.exe 2440 lfllxlx.exe 1772 jvjpp.exe 2492 jjjvd.exe 2172 9rlfrrf.exe 1828 hhhtbb.exe 1496 5nbbnt.exe 1256 dpddd.exe 2784 xrlrfxf.exe 2756 5lfrxxf.exe 1900 vpvvd.exe 2132 xffrlxl.exe 2136 bbhhnh.exe 1352 hbtnnb.exe 1616 ddjjp.exe 856 xrlrfrf.exe 764 nnbnbh.exe 656 nnhnth.exe 2248 jjjjv.exe 1964 vdpjj.exe 912 rlllrxf.exe 2476 rrlrflr.exe 3024 hbthht.exe 2324 vjjvd.exe 2308 xrffrlr.exe 2140 htbtbb.exe 1632 jpddj.exe 2844 xlflrrr.exe 1396 7ffrlrf.exe 2584 ttbbbb.exe 2504 vvpvd.exe 3048 pjjpv.exe 532 1rflffl.exe 772 3xrfllf.exe 2440 tnbbhn.exe 1716 tthttt.exe 2980 vjdjv.exe 1840 rxfrrll.exe 2008 nhhntb.exe 1876 1hbhnb.exe 1196 fxrxxxl.exe 2420 xxrxlfl.exe 1364 hbnttb.exe 2760 hhbnnb.exe 2416 3thbht.exe 1832 vpdpj.exe 1596 lxfxxlx.exe 2216 3rrxrfx.exe 2136 nhhhtn.exe 2060 1tbthn.exe 2936 vvpvv.exe 836 9xlfllf.exe 1512 fffrflx.exe 1720 9tbbtn.exe 444 3htbnh.exe 2100 vvdvv.exe 952 llxfrfx.exe 1964 3lfrlrx.exe 1988 bttbtt.exe -
resource yara_rule behavioral1/memory/2820-0-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/files/0x0007000000012117-5.dat upx behavioral1/memory/2680-10-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/memory/2820-7-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/memory/2680-18-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/memory/2836-22-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/files/0x0008000000015baa-20.dat upx behavioral1/memory/1260-29-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/files/0x0008000000015c67-28.dat upx behavioral1/files/0x0008000000015c6d-39.dat upx behavioral1/memory/1260-37-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/files/0x0008000000015c80-46.dat upx behavioral1/files/0x0007000000015cb1-67.dat upx behavioral1/memory/2996-66-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/memory/2996-64-0x00000000001B0000-0x00000000001E3000-memory.dmp upx behavioral1/files/0x0007000000015c9f-58.dat upx behavioral1/memory/796-57-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/files/0x0007000000015cb9-78.dat upx behavioral1/memory/2440-77-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/files/0x0008000000015cd0-86.dat upx behavioral1/memory/1772-85-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/memory/2492-96-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/files/0x00070000000165c2-97.dat upx behavioral1/memory/2172-100-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/memory/1828-108-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/files/0x0006000000016814-107.dat upx behavioral1/files/0x0006000000016a66-116.dat upx behavioral1/files/0x0006000000016c3a-123.dat upx behavioral1/memory/2784-136-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/files/0x0006000000016c4a-134.dat upx behavioral1/memory/1256-131-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/files/0x0006000000016c51-142.dat upx behavioral1/memory/1900-152-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/files/0x0006000000016c9d-151.dat upx behavioral1/files/0x0006000000016cc8-159.dat upx behavioral1/files/0x0006000000016cec-167.dat upx behavioral1/memory/2132-168-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/memory/2136-176-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/files/0x0006000000016d06-177.dat upx behavioral1/files/0x0006000000016d0e-188.dat upx behavioral1/memory/1352-187-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/files/0x0006000000016d18-196.dat upx behavioral1/memory/1616-195-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/files/0x0006000000016d21-203.dat upx behavioral1/memory/856-206-0x00000000002C0000-0x00000000002F3000-memory.dmp upx behavioral1/memory/856-205-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/files/0x0006000000016d29-214.dat upx behavioral1/files/0x0006000000016d31-224.dat upx behavioral1/memory/1616-223-0x0000000000220000-0x0000000000253000-memory.dmp upx behavioral1/files/0x0006000000016d3a-232.dat upx behavioral1/files/0x0006000000016d42-242.dat upx behavioral1/files/0x0006000000016d4a-251.dat upx behavioral1/files/0x0006000000016d5e-259.dat upx behavioral1/memory/3024-261-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/files/0x0006000000016d64-267.dat upx behavioral1/files/0x003500000001543d-277.dat upx behavioral1/memory/2324-276-0x0000000000220000-0x0000000000253000-memory.dmp upx behavioral1/files/0x0006000000016d68-285.dat upx behavioral1/files/0x0006000000016d6d-292.dat upx behavioral1/memory/2140-293-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/memory/1632-301-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/memory/1396-315-0x00000000003A0000-0x00000000003D3000-memory.dmp upx behavioral1/memory/2504-323-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/memory/2504-330-0x0000000000400000-0x0000000000433000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfxrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxlrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbthbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fflxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rlfrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrxxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxlrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2820 wrote to memory of 2680 2820 580c880a21fb211dddcd67f398ba2b60N.exe 30 PID 2820 wrote to memory of 2680 2820 580c880a21fb211dddcd67f398ba2b60N.exe 30 PID 2820 wrote to memory of 2680 2820 580c880a21fb211dddcd67f398ba2b60N.exe 30 PID 2820 wrote to memory of 2680 2820 580c880a21fb211dddcd67f398ba2b60N.exe 30 PID 2680 wrote to memory of 2836 2680 rrrxfxx.exe 31 PID 2680 wrote to memory of 2836 2680 rrrxfxx.exe 31 PID 2680 wrote to memory of 2836 2680 rrrxfxx.exe 31 PID 2680 wrote to memory of 2836 2680 rrrxfxx.exe 31 PID 2836 wrote to memory of 1260 2836 ppppp.exe 32 PID 2836 wrote to memory of 1260 2836 ppppp.exe 32 PID 2836 wrote to memory of 1260 2836 ppppp.exe 32 PID 2836 wrote to memory of 1260 2836 ppppp.exe 32 PID 1260 wrote to memory of 2532 1260 rfrrxfl.exe 33 PID 1260 wrote to memory of 2532 1260 rfrrxfl.exe 33 PID 1260 wrote to memory of 2532 1260 rfrrxfl.exe 33 PID 1260 wrote to memory of 2532 1260 rfrrxfl.exe 33 PID 2532 wrote to memory of 796 2532 hbbntn.exe 34 PID 2532 wrote to memory of 796 2532 hbbntn.exe 34 PID 2532 wrote to memory of 796 2532 hbbntn.exe 34 PID 2532 wrote to memory of 796 2532 hbbntn.exe 34 PID 796 wrote to memory of 2996 796 hhnttt.exe 35 PID 796 wrote to memory of 2996 796 hhnttt.exe 35 PID 796 wrote to memory of 2996 796 hhnttt.exe 35 PID 796 wrote to memory of 2996 796 hhnttt.exe 35 PID 2996 wrote to memory of 2440 2996 1ffxxxf.exe 36 PID 2996 wrote to memory of 2440 2996 1ffxxxf.exe 36 PID 2996 wrote to memory of 2440 2996 1ffxxxf.exe 36 PID 2996 wrote to memory of 2440 2996 1ffxxxf.exe 36 PID 2440 wrote to memory of 1772 2440 lfllxlx.exe 37 PID 2440 wrote to memory of 1772 2440 lfllxlx.exe 37 PID 2440 wrote to memory of 1772 2440 lfllxlx.exe 37 PID 2440 wrote to memory of 1772 2440 lfllxlx.exe 37 PID 1772 wrote to memory of 2492 1772 jvjpp.exe 38 PID 1772 wrote to memory of 2492 1772 jvjpp.exe 38 PID 1772 wrote to memory of 2492 1772 jvjpp.exe 38 PID 1772 wrote to memory of 2492 1772 jvjpp.exe 38 PID 2492 wrote to memory of 2172 2492 jjjvd.exe 39 PID 2492 wrote to memory of 2172 2492 jjjvd.exe 39 PID 2492 wrote to memory of 2172 2492 jjjvd.exe 39 PID 2492 wrote to memory of 2172 2492 jjjvd.exe 39 PID 2172 wrote to memory of 1828 2172 9rlfrrf.exe 40 PID 2172 wrote to memory of 1828 2172 9rlfrrf.exe 40 PID 2172 wrote to memory of 1828 2172 9rlfrrf.exe 40 PID 2172 wrote to memory of 1828 2172 9rlfrrf.exe 40 PID 1828 wrote to memory of 1496 1828 hhhtbb.exe 41 PID 1828 wrote to memory of 1496 1828 hhhtbb.exe 41 PID 1828 wrote to memory of 1496 1828 hhhtbb.exe 41 PID 1828 wrote to memory of 1496 1828 hhhtbb.exe 41 PID 1496 wrote to memory of 1256 1496 5nbbnt.exe 42 PID 1496 wrote to memory of 1256 1496 5nbbnt.exe 42 PID 1496 wrote to memory of 1256 1496 5nbbnt.exe 42 PID 1496 wrote to memory of 1256 1496 5nbbnt.exe 42 PID 1256 wrote to memory of 2784 1256 dpddd.exe 43 PID 1256 wrote to memory of 2784 1256 dpddd.exe 43 PID 1256 wrote to memory of 2784 1256 dpddd.exe 43 PID 1256 wrote to memory of 2784 1256 dpddd.exe 43 PID 2784 wrote to memory of 2756 2784 xrlrfxf.exe 44 PID 2784 wrote to memory of 2756 2784 xrlrfxf.exe 44 PID 2784 wrote to memory of 2756 2784 xrlrfxf.exe 44 PID 2784 wrote to memory of 2756 2784 xrlrfxf.exe 44 PID 2756 wrote to memory of 1900 2756 5lfrxxf.exe 45 PID 2756 wrote to memory of 1900 2756 5lfrxxf.exe 45 PID 2756 wrote to memory of 1900 2756 5lfrxxf.exe 45 PID 2756 wrote to memory of 1900 2756 5lfrxxf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\580c880a21fb211dddcd67f398ba2b60N.exe"C:\Users\Admin\AppData\Local\Temp\580c880a21fb211dddcd67f398ba2b60N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\rrrxfxx.exec:\rrrxfxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\ppppp.exec:\ppppp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\rfrrxfl.exec:\rfrrxfl.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\hbbntn.exec:\hbbntn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\hhnttt.exec:\hhnttt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:796 -
\??\c:\1ffxxxf.exec:\1ffxxxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\lfllxlx.exec:\lfllxlx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\jvjpp.exec:\jvjpp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
\??\c:\jjjvd.exec:\jjjvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\9rlfrrf.exec:\9rlfrrf.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\hhhtbb.exec:\hhhtbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
\??\c:\5nbbnt.exec:\5nbbnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\dpddd.exec:\dpddd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
\??\c:\xrlrfxf.exec:\xrlrfxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\5lfrxxf.exec:\5lfrxxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\vpvvd.exec:\vpvvd.exe17⤵
- Executes dropped EXE
PID:1900 -
\??\c:\xffrlxl.exec:\xffrlxl.exe18⤵
- Executes dropped EXE
PID:2132 -
\??\c:\bbhhnh.exec:\bbhhnh.exe19⤵
- Executes dropped EXE
PID:2136 -
\??\c:\hbtnnb.exec:\hbtnnb.exe20⤵
- Executes dropped EXE
PID:1352 -
\??\c:\ddjjp.exec:\ddjjp.exe21⤵
- Executes dropped EXE
PID:1616 -
\??\c:\xrlrfrf.exec:\xrlrfrf.exe22⤵
- Executes dropped EXE
PID:856 -
\??\c:\nnbnbh.exec:\nnbnbh.exe23⤵
- Executes dropped EXE
PID:764 -
\??\c:\nnhnth.exec:\nnhnth.exe24⤵
- Executes dropped EXE
PID:656 -
\??\c:\jjjjv.exec:\jjjjv.exe25⤵
- Executes dropped EXE
PID:2248 -
\??\c:\vdpjj.exec:\vdpjj.exe26⤵
- Executes dropped EXE
PID:1964 -
\??\c:\rlllrxf.exec:\rlllrxf.exe27⤵
- Executes dropped EXE
PID:912 -
\??\c:\rrlrflr.exec:\rrlrflr.exe28⤵
- Executes dropped EXE
PID:2476 -
\??\c:\hbthht.exec:\hbthht.exe29⤵
- Executes dropped EXE
PID:3024 -
\??\c:\vjjvd.exec:\vjjvd.exe30⤵
- Executes dropped EXE
PID:2324 -
\??\c:\xrffrlr.exec:\xrffrlr.exe31⤵
- Executes dropped EXE
PID:2308 -
\??\c:\htbtbb.exec:\htbtbb.exe32⤵
- Executes dropped EXE
PID:2140 -
\??\c:\jpddj.exec:\jpddj.exe33⤵
- Executes dropped EXE
PID:1632 -
\??\c:\xlflrrr.exec:\xlflrrr.exe34⤵
- Executes dropped EXE
PID:2844 -
\??\c:\7ffrlrf.exec:\7ffrlrf.exe35⤵
- Executes dropped EXE
PID:1396 -
\??\c:\ttbbbb.exec:\ttbbbb.exe36⤵
- Executes dropped EXE
PID:2584 -
\??\c:\vvpvd.exec:\vvpvd.exe37⤵
- Executes dropped EXE
PID:2504 -
\??\c:\pjjpv.exec:\pjjpv.exe38⤵
- Executes dropped EXE
PID:3048 -
\??\c:\1rflffl.exec:\1rflffl.exe39⤵
- Executes dropped EXE
PID:532 -
\??\c:\3xrfllf.exec:\3xrfllf.exe40⤵
- Executes dropped EXE
PID:772 -
\??\c:\tnbbhn.exec:\tnbbhn.exe41⤵
- Executes dropped EXE
PID:2440 -
\??\c:\tthttt.exec:\tthttt.exe42⤵
- Executes dropped EXE
PID:1716 -
\??\c:\vjdjv.exec:\vjdjv.exe43⤵
- Executes dropped EXE
PID:2980 -
\??\c:\rxfrrll.exec:\rxfrrll.exe44⤵
- Executes dropped EXE
PID:1840 -
\??\c:\nhhntb.exec:\nhhntb.exe45⤵
- Executes dropped EXE
PID:2008 -
\??\c:\1hbhnb.exec:\1hbhnb.exe46⤵
- Executes dropped EXE
PID:1876 -
\??\c:\fxrxxxl.exec:\fxrxxxl.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1196 -
\??\c:\xxrxlfl.exec:\xxrxlfl.exe48⤵
- Executes dropped EXE
PID:2420 -
\??\c:\hbnttb.exec:\hbnttb.exe49⤵
- Executes dropped EXE
PID:1364 -
\??\c:\hhbnnb.exec:\hhbnnb.exe50⤵
- Executes dropped EXE
PID:2760 -
\??\c:\3thbht.exec:\3thbht.exe51⤵
- Executes dropped EXE
PID:2416 -
\??\c:\vpdpj.exec:\vpdpj.exe52⤵
- Executes dropped EXE
PID:1832 -
\??\c:\lxfxxlx.exec:\lxfxxlx.exe53⤵
- Executes dropped EXE
PID:1596 -
\??\c:\3rrxrfx.exec:\3rrxrfx.exe54⤵
- Executes dropped EXE
PID:2216 -
\??\c:\nhhhtn.exec:\nhhhtn.exe55⤵
- Executes dropped EXE
PID:2136 -
\??\c:\1tbthn.exec:\1tbthn.exe56⤵
- Executes dropped EXE
PID:2060 -
\??\c:\vvpvv.exec:\vvpvv.exe57⤵
- Executes dropped EXE
PID:2936 -
\??\c:\9xlfllf.exec:\9xlfllf.exe58⤵
- Executes dropped EXE
PID:836 -
\??\c:\fffrflx.exec:\fffrflx.exe59⤵
- Executes dropped EXE
PID:1512 -
\??\c:\9tbbtn.exec:\9tbbtn.exe60⤵
- Executes dropped EXE
PID:1720 -
\??\c:\3htbnh.exec:\3htbnh.exe61⤵
- Executes dropped EXE
PID:444 -
\??\c:\vvdvv.exec:\vvdvv.exe62⤵
- Executes dropped EXE
PID:2100 -
\??\c:\llxfrfx.exec:\llxfrfx.exe63⤵
- Executes dropped EXE
PID:952 -
\??\c:\3lfrlrx.exec:\3lfrlrx.exe64⤵
- Executes dropped EXE
PID:1964 -
\??\c:\bttbtt.exec:\bttbtt.exe65⤵
- Executes dropped EXE
PID:1988 -
\??\c:\5ththn.exec:\5ththn.exe66⤵PID:1912
-
\??\c:\7ppdp.exec:\7ppdp.exe67⤵PID:2344
-
\??\c:\jjvvj.exec:\jjvvj.exe68⤵PID:2960
-
\??\c:\ppdjp.exec:\ppdjp.exe69⤵PID:2716
-
\??\c:\7rlrxfr.exec:\7rlrxfr.exe70⤵PID:2324
-
\??\c:\xxrfxlx.exec:\xxrfxlx.exe71⤵PID:2660
-
\??\c:\5tttbb.exec:\5tttbb.exe72⤵PID:2688
-
\??\c:\5vpvj.exec:\5vpvj.exe73⤵PID:1528
-
\??\c:\9pppj.exec:\9pppj.exe74⤵PID:2692
-
\??\c:\xrxlrfr.exec:\xrxlrfr.exe75⤵PID:2640
-
\??\c:\hnthhb.exec:\hnthhb.exe76⤵PID:1396
-
\??\c:\nhtbtt.exec:\nhtbtt.exe77⤵PID:2584
-
\??\c:\vdpvd.exec:\vdpvd.exe78⤵PID:2984
-
\??\c:\rlrlxlf.exec:\rlrlxlf.exe79⤵PID:2544
-
\??\c:\lfxfffx.exec:\lfxfffx.exe80⤵PID:1984
-
\??\c:\nnnntb.exec:\nnnntb.exe81⤵PID:2804
-
\??\c:\5nnbtb.exec:\5nnbtb.exe82⤵PID:2884
-
\??\c:\1jjjv.exec:\1jjjv.exe83⤵PID:1852
-
\??\c:\llxlrll.exec:\llxlrll.exe84⤵PID:3004
-
\??\c:\xxrflrx.exec:\xxrflrx.exe85⤵PID:2220
-
\??\c:\bbhthb.exec:\bbhthb.exe86⤵PID:2424
-
\??\c:\hbbtbh.exec:\hbbtbh.exe87⤵PID:1104
-
\??\c:\pppjp.exec:\pppjp.exe88⤵PID:1876
-
\??\c:\9vvjp.exec:\9vvjp.exe89⤵PID:1108
-
\??\c:\xxlrxxl.exec:\xxlrxxl.exe90⤵PID:1364
-
\??\c:\lllxxfr.exec:\lllxxfr.exe91⤵PID:1612
-
\??\c:\nbttbt.exec:\nbttbt.exe92⤵PID:2760
-
\??\c:\dvjpd.exec:\dvjpd.exe93⤵PID:2756
-
\??\c:\7vdpv.exec:\7vdpv.exe94⤵PID:2208
-
\??\c:\7flllxl.exec:\7flllxl.exe95⤵PID:1680
-
\??\c:\lxrxllx.exec:\lxrxllx.exe96⤵PID:2184
-
\??\c:\9hbtbh.exec:\9hbtbh.exe97⤵PID:2288
-
\??\c:\ttnbbn.exec:\ttnbbn.exe98⤵PID:2128
-
\??\c:\vpddd.exec:\vpddd.exe99⤵PID:2740
-
\??\c:\9xlxflx.exec:\9xlxflx.exe100⤵PID:664
-
\??\c:\xllfrlx.exec:\xllfrlx.exe101⤵PID:856
-
\??\c:\bbntth.exec:\bbntth.exe102⤵PID:1848
-
\??\c:\tnbbhh.exec:\tnbbhh.exe103⤵PID:656
-
\??\c:\ppddp.exec:\ppddp.exe104⤵PID:344
-
\??\c:\djvjv.exec:\djvjv.exe105⤵PID:952
-
\??\c:\xxrxxfl.exec:\xxrxxfl.exe106⤵PID:1944
-
\??\c:\xfxllrf.exec:\xfxllrf.exe107⤵PID:892
-
\??\c:\hbbtnt.exec:\hbbtnt.exe108⤵PID:2476
-
\??\c:\vvdjp.exec:\vvdjp.exe109⤵PID:988
-
\??\c:\jjjpp.exec:\jjjpp.exe110⤵PID:896
-
\??\c:\1xxlxff.exec:\1xxlxff.exe111⤵PID:2636
-
\??\c:\tthbtb.exec:\tthbtb.exe112⤵PID:2308
-
\??\c:\nnbbnb.exec:\nnbbnb.exe113⤵PID:2644
-
\??\c:\jddjv.exec:\jddjv.exe114⤵PID:2564
-
\??\c:\lxxlrlx.exec:\lxxlrlx.exe115⤵PID:1520
-
\??\c:\xxrflxf.exec:\xxrflxf.exe116⤵PID:2552
-
\??\c:\hhbhhn.exec:\hhbhhn.exe117⤵PID:2548
-
\??\c:\nnhtbn.exec:\nnhtbn.exe118⤵PID:2532
-
\??\c:\5pjjv.exec:\5pjjv.exe119⤵PID:2604
-
\??\c:\7dpvd.exec:\7dpvd.exe120⤵PID:796
-
\??\c:\ffrfllx.exec:\ffrfllx.exe121⤵PID:2996
-
\??\c:\xlxfrxf.exec:\xlxfrxf.exe122⤵PID:1308
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-