Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21/09/2024, 23:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dc25b80cff5f98322de6038c21dc755bbd7aa97af3ea1c032a96d8333bf02deaN.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
dc25b80cff5f98322de6038c21dc755bbd7aa97af3ea1c032a96d8333bf02deaN.exe
-
Size
452KB
-
MD5
2ca9d15afbd17e94ee8442cb02695110
-
SHA1
28e7c419f7d55555216f6584204e10107beb1314
-
SHA256
dc25b80cff5f98322de6038c21dc755bbd7aa97af3ea1c032a96d8333bf02dea
-
SHA512
2d7950646483d18cade0b715f95b5e90c31aaba6921c950960e31ed79464910642de48a22ce388cd3d2b89acc53e75d285b6e6779a5a4999581b59a0d1023773
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeF:q7Tc2NYHUrAwfMp3CDF
Malware Config
Signatures
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/2512-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/320-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2088-102-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2088-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1488-112-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1488-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1756-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1032-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1520-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1936-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1952-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/688-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2140-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/576-375-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1656-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/760-393-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1304-401-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/396-442-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/112-479-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1632-480-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1632-488-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1632-487-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2380-514-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2160-593-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-642-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1740-711-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/824-828-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2656-906-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2584-922-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2584-921-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1300-1023-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1996-1125-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2900-1138-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2816-1146-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2588-1172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1860-1272-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2620 fxlxlrf.exe 320 nthnnt.exe 2216 9vvjv.exe 2684 hhtthb.exe 2688 1bnnhb.exe 2652 jvvjp.exe 2848 7xllxrl.exe 2704 fxlflxl.exe 2568 bntnnh.exe 2088 tttbhh.exe 1488 lrfxxll.exe 1032 9tthnt.exe 1756 7vjjp.exe 1520 7xflflr.exe 1928 9dvvj.exe 1936 bthntt.exe 768 dvppd.exe 3036 tthtbb.exe 2108 3dvvd.exe 1240 5xlllxr.exe 1672 ppvvp.exe 1952 7bntbh.exe 1020 thbhbn.exe 688 nhbnnn.exe 1808 9dpvp.exe 1080 httttn.exe 2332 1vpvd.exe 692 nnbhnt.exe 2292 pjpvd.exe 1752 tnhthn.exe 2488 ddjvd.exe 2484 rrfrfrl.exe 3044 pddvv.exe 2140 fllrlfr.exe 1772 ntbtbn.exe 2788 btbhtb.exe 2644 dvjvj.exe 2668 1lxfllr.exe 2372 hbhbtb.exe 3068 5pdvd.exe 2708 pvddd.exe 2592 rlrrxff.exe 576 3nnbth.exe 2192 jddjv.exe 1656 vdvvj.exe 760 nnbbhh.exe 1304 nhhnbh.exe 1880 ppddd.exe 1620 rrflxfl.exe 2724 btnntb.exe 1444 bbbhtt.exe 2360 djjpj.exe 396 xxrxlrx.exe 2976 1bhbnn.exe 2972 9vpjv.exe 2100 rxrrlrl.exe 2300 rfxfffx.exe 2092 nhtntt.exe 112 7vvvj.exe 1632 lfflrfr.exe 1008 bbtnhh.exe 888 vvdpp.exe 1000 5frfrfx.exe 2380 hbbntb.exe -
resource yara_rule behavioral1/memory/2512-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/320-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/320-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1488-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1756-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1032-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1520-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1520-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/768-169-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/3036-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/688-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1444-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/396-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/112-479-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-480-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-507-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-514-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-593-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-618-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-642-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1740-711-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1540-766-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-922-0x0000000000430000-0x000000000045A000-memory.dmp upx behavioral1/memory/2968-978-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1860-991-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1300-1023-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-1094-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-1172-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1llxxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrlrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ddjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrxrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxfrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xllxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrfflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrfflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffxxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2512 wrote to memory of 2620 2512 dc25b80cff5f98322de6038c21dc755bbd7aa97af3ea1c032a96d8333bf02deaN.exe 31 PID 2512 wrote to memory of 2620 2512 dc25b80cff5f98322de6038c21dc755bbd7aa97af3ea1c032a96d8333bf02deaN.exe 31 PID 2512 wrote to memory of 2620 2512 dc25b80cff5f98322de6038c21dc755bbd7aa97af3ea1c032a96d8333bf02deaN.exe 31 PID 2512 wrote to memory of 2620 2512 dc25b80cff5f98322de6038c21dc755bbd7aa97af3ea1c032a96d8333bf02deaN.exe 31 PID 2620 wrote to memory of 320 2620 fxlxlrf.exe 32 PID 2620 wrote to memory of 320 2620 fxlxlrf.exe 32 PID 2620 wrote to memory of 320 2620 fxlxlrf.exe 32 PID 2620 wrote to memory of 320 2620 fxlxlrf.exe 32 PID 320 wrote to memory of 2216 320 nthnnt.exe 33 PID 320 wrote to memory of 2216 320 nthnnt.exe 33 PID 320 wrote to memory of 2216 320 nthnnt.exe 33 PID 320 wrote to memory of 2216 320 nthnnt.exe 33 PID 2216 wrote to memory of 2684 2216 9vvjv.exe 34 PID 2216 wrote to memory of 2684 2216 9vvjv.exe 34 PID 2216 wrote to memory of 2684 2216 9vvjv.exe 34 PID 2216 wrote to memory of 2684 2216 9vvjv.exe 34 PID 2684 wrote to memory of 2688 2684 hhtthb.exe 35 PID 2684 wrote to memory of 2688 2684 hhtthb.exe 35 PID 2684 wrote to memory of 2688 2684 hhtthb.exe 35 PID 2684 wrote to memory of 2688 2684 hhtthb.exe 35 PID 2688 wrote to memory of 2652 2688 1bnnhb.exe 36 PID 2688 wrote to memory of 2652 2688 1bnnhb.exe 36 PID 2688 wrote to memory of 2652 2688 1bnnhb.exe 36 PID 2688 wrote to memory of 2652 2688 1bnnhb.exe 36 PID 2652 wrote to memory of 2848 2652 jvvjp.exe 37 PID 2652 wrote to memory of 2848 2652 jvvjp.exe 37 PID 2652 wrote to memory of 2848 2652 jvvjp.exe 37 PID 2652 wrote to memory of 2848 2652 jvvjp.exe 37 PID 2848 wrote to memory of 2704 2848 7xllxrl.exe 38 PID 2848 wrote to memory of 2704 2848 7xllxrl.exe 38 PID 2848 wrote to memory of 2704 2848 7xllxrl.exe 38 PID 2848 wrote to memory of 2704 2848 7xllxrl.exe 38 PID 2704 wrote to memory of 2568 2704 fxlflxl.exe 39 PID 2704 wrote to memory of 2568 2704 fxlflxl.exe 39 PID 2704 wrote to memory of 2568 2704 fxlflxl.exe 39 PID 2704 wrote to memory of 2568 2704 fxlflxl.exe 39 PID 2568 wrote to memory of 2088 2568 bntnnh.exe 40 PID 2568 wrote to memory of 2088 2568 bntnnh.exe 40 PID 2568 wrote to memory of 2088 2568 bntnnh.exe 40 PID 2568 wrote to memory of 2088 2568 bntnnh.exe 40 PID 2088 wrote to memory of 1488 2088 tttbhh.exe 41 PID 2088 wrote to memory of 1488 2088 tttbhh.exe 41 PID 2088 wrote to memory of 1488 2088 tttbhh.exe 41 PID 2088 wrote to memory of 1488 2088 tttbhh.exe 41 PID 1488 wrote to memory of 1032 1488 lrfxxll.exe 42 PID 1488 wrote to memory of 1032 1488 lrfxxll.exe 42 PID 1488 wrote to memory of 1032 1488 lrfxxll.exe 42 PID 1488 wrote to memory of 1032 1488 lrfxxll.exe 42 PID 1032 wrote to memory of 1756 1032 9tthnt.exe 43 PID 1032 wrote to memory of 1756 1032 9tthnt.exe 43 PID 1032 wrote to memory of 1756 1032 9tthnt.exe 43 PID 1032 wrote to memory of 1756 1032 9tthnt.exe 43 PID 1756 wrote to memory of 1520 1756 7vjjp.exe 44 PID 1756 wrote to memory of 1520 1756 7vjjp.exe 44 PID 1756 wrote to memory of 1520 1756 7vjjp.exe 44 PID 1756 wrote to memory of 1520 1756 7vjjp.exe 44 PID 1520 wrote to memory of 1928 1520 7xflflr.exe 45 PID 1520 wrote to memory of 1928 1520 7xflflr.exe 45 PID 1520 wrote to memory of 1928 1520 7xflflr.exe 45 PID 1520 wrote to memory of 1928 1520 7xflflr.exe 45 PID 1928 wrote to memory of 1936 1928 9dvvj.exe 46 PID 1928 wrote to memory of 1936 1928 9dvvj.exe 46 PID 1928 wrote to memory of 1936 1928 9dvvj.exe 46 PID 1928 wrote to memory of 1936 1928 9dvvj.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc25b80cff5f98322de6038c21dc755bbd7aa97af3ea1c032a96d8333bf02deaN.exe"C:\Users\Admin\AppData\Local\Temp\dc25b80cff5f98322de6038c21dc755bbd7aa97af3ea1c032a96d8333bf02deaN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\fxlxlrf.exec:\fxlxlrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\nthnnt.exec:\nthnnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\9vvjv.exec:\9vvjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\hhtthb.exec:\hhtthb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\1bnnhb.exec:\1bnnhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\jvvjp.exec:\jvvjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\7xllxrl.exec:\7xllxrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\fxlflxl.exec:\fxlflxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\bntnnh.exec:\bntnnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\tttbhh.exec:\tttbhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\lrfxxll.exec:\lrfxxll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\9tthnt.exec:\9tthnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
\??\c:\7vjjp.exec:\7vjjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
\??\c:\7xflflr.exec:\7xflflr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\9dvvj.exec:\9dvvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\bthntt.exec:\bthntt.exe17⤵
- Executes dropped EXE
PID:1936 -
\??\c:\dvppd.exec:\dvppd.exe18⤵
- Executes dropped EXE
PID:768 -
\??\c:\tthtbb.exec:\tthtbb.exe19⤵
- Executes dropped EXE
PID:3036 -
\??\c:\3dvvd.exec:\3dvvd.exe20⤵
- Executes dropped EXE
PID:2108 -
\??\c:\5xlllxr.exec:\5xlllxr.exe21⤵
- Executes dropped EXE
PID:1240 -
\??\c:\ppvvp.exec:\ppvvp.exe22⤵
- Executes dropped EXE
PID:1672 -
\??\c:\7bntbh.exec:\7bntbh.exe23⤵
- Executes dropped EXE
PID:1952 -
\??\c:\thbhbn.exec:\thbhbn.exe24⤵
- Executes dropped EXE
PID:1020 -
\??\c:\nhbnnn.exec:\nhbnnn.exe25⤵
- Executes dropped EXE
PID:688 -
\??\c:\9dpvp.exec:\9dpvp.exe26⤵
- Executes dropped EXE
PID:1808 -
\??\c:\httttn.exec:\httttn.exe27⤵
- Executes dropped EXE
PID:1080 -
\??\c:\1vpvd.exec:\1vpvd.exe28⤵
- Executes dropped EXE
PID:2332 -
\??\c:\nnbhnt.exec:\nnbhnt.exe29⤵
- Executes dropped EXE
PID:692 -
\??\c:\pjpvd.exec:\pjpvd.exe30⤵
- Executes dropped EXE
PID:2292 -
\??\c:\tnhthn.exec:\tnhthn.exe31⤵
- Executes dropped EXE
PID:1752 -
\??\c:\ddjvd.exec:\ddjvd.exe32⤵
- Executes dropped EXE
PID:2488 -
\??\c:\rrfrfrl.exec:\rrfrfrl.exe33⤵
- Executes dropped EXE
PID:2484 -
\??\c:\pddvv.exec:\pddvv.exe34⤵
- Executes dropped EXE
PID:3044 -
\??\c:\fllrlfr.exec:\fllrlfr.exe35⤵
- Executes dropped EXE
PID:2140 -
\??\c:\ntbtbn.exec:\ntbtbn.exe36⤵
- Executes dropped EXE
PID:1772 -
\??\c:\btbhtb.exec:\btbhtb.exe37⤵
- Executes dropped EXE
PID:2788 -
\??\c:\dvjvj.exec:\dvjvj.exe38⤵
- Executes dropped EXE
PID:2644 -
\??\c:\1lxfllr.exec:\1lxfllr.exe39⤵
- Executes dropped EXE
PID:2668 -
\??\c:\hbhbtb.exec:\hbhbtb.exe40⤵
- Executes dropped EXE
PID:2372 -
\??\c:\5pdvd.exec:\5pdvd.exe41⤵
- Executes dropped EXE
PID:3068 -
\??\c:\pvddd.exec:\pvddd.exe42⤵
- Executes dropped EXE
PID:2708 -
\??\c:\rlrrxff.exec:\rlrrxff.exe43⤵
- Executes dropped EXE
PID:2592 -
\??\c:\3nnbth.exec:\3nnbth.exe44⤵
- Executes dropped EXE
PID:576 -
\??\c:\jddjv.exec:\jddjv.exe45⤵
- Executes dropped EXE
PID:2192 -
\??\c:\vdvvj.exec:\vdvvj.exe46⤵
- Executes dropped EXE
PID:1656 -
\??\c:\nnbbhh.exec:\nnbbhh.exe47⤵
- Executes dropped EXE
PID:760 -
\??\c:\nhhnbh.exec:\nhhnbh.exe48⤵
- Executes dropped EXE
PID:1304 -
\??\c:\ppddd.exec:\ppddd.exe49⤵
- Executes dropped EXE
PID:1880 -
\??\c:\rrflxfl.exec:\rrflxfl.exe50⤵
- Executes dropped EXE
PID:1620 -
\??\c:\btnntb.exec:\btnntb.exe51⤵
- Executes dropped EXE
PID:2724 -
\??\c:\bbbhtt.exec:\bbbhtt.exe52⤵
- Executes dropped EXE
PID:1444 -
\??\c:\djjpj.exec:\djjpj.exe53⤵
- Executes dropped EXE
PID:2360 -
\??\c:\xxrxlrx.exec:\xxrxlrx.exe54⤵
- Executes dropped EXE
PID:396 -
\??\c:\1bhbnn.exec:\1bhbnn.exe55⤵
- Executes dropped EXE
PID:2976 -
\??\c:\9vpjv.exec:\9vpjv.exe56⤵
- Executes dropped EXE
PID:2972 -
\??\c:\rxrrlrl.exec:\rxrrlrl.exe57⤵
- Executes dropped EXE
PID:2100 -
\??\c:\rfxfffx.exec:\rfxfffx.exe58⤵
- Executes dropped EXE
PID:2300 -
\??\c:\nhtntt.exec:\nhtntt.exe59⤵
- Executes dropped EXE
PID:2092 -
\??\c:\7vvvj.exec:\7vvvj.exe60⤵
- Executes dropped EXE
PID:112 -
\??\c:\lfflrfr.exec:\lfflrfr.exe61⤵
- Executes dropped EXE
PID:1632 -
\??\c:\bbtnhh.exec:\bbtnhh.exe62⤵
- Executes dropped EXE
PID:1008 -
\??\c:\vvdpp.exec:\vvdpp.exe63⤵
- Executes dropped EXE
PID:888 -
\??\c:\5frfrfx.exec:\5frfrfx.exe64⤵
- Executes dropped EXE
PID:1000 -
\??\c:\hbbntb.exec:\hbbntb.exe65⤵
- Executes dropped EXE
PID:2380 -
\??\c:\hnhnbh.exec:\hnhnbh.exe66⤵PID:2196
-
\??\c:\ppjvj.exec:\ppjvj.exe67⤵PID:1080
-
\??\c:\9rrrflf.exec:\9rrrflf.exe68⤵PID:2412
-
\??\c:\btntbh.exec:\btntbh.exe69⤵PID:924
-
\??\c:\vvvpp.exec:\vvvpp.exe70⤵PID:2924
-
\??\c:\llfrllf.exec:\llfrllf.exe71⤵PID:904
-
\??\c:\rxxlflx.exec:\rxxlflx.exe72⤵PID:2348
-
\??\c:\bhhbth.exec:\bhhbth.exe73⤵PID:2404
-
\??\c:\ddjvp.exec:\ddjvp.exe74⤵PID:2616
-
\??\c:\rffxxlf.exec:\rffxxlf.exe75⤵
- System Location Discovery: System Language Discovery
PID:1544 -
\??\c:\3ntnht.exec:\3ntnht.exe76⤵PID:1592
-
\??\c:\1nthnt.exec:\1nthnt.exe77⤵PID:2140
-
\??\c:\ddjjd.exec:\ddjjd.exe78⤵PID:2160
-
\??\c:\xxxfrrl.exec:\xxxfrrl.exe79⤵PID:2660
-
\??\c:\ttthhh.exec:\ttthhh.exe80⤵PID:2212
-
\??\c:\pjdjv.exec:\pjdjv.exe81⤵PID:2692
-
\??\c:\jppdd.exec:\jppdd.exe82⤵PID:2236
-
\??\c:\rxllrrf.exec:\rxllrrf.exe83⤵PID:2372
-
\??\c:\nnhntb.exec:\nnhntb.exe84⤵PID:2540
-
\??\c:\pvvvd.exec:\pvvvd.exe85⤵PID:2708
-
\??\c:\xffflfr.exec:\xffflfr.exe86⤵PID:2552
-
\??\c:\9ttnbt.exec:\9ttnbt.exe87⤵PID:3000
-
\??\c:\ntnbht.exec:\ntnbht.exe88⤵PID:2996
-
\??\c:\pjvvd.exec:\pjvvd.exe89⤵PID:1640
-
\??\c:\xxrxlrl.exec:\xxrxlrl.exe90⤵PID:2288
-
\??\c:\nnbbtt.exec:\nnbbtt.exe91⤵PID:1440
-
\??\c:\5tbnbn.exec:\5tbnbn.exe92⤵PID:664
-
\??\c:\vpjpd.exec:\vpjpd.exe93⤵PID:1780
-
\??\c:\xlllflx.exec:\xlllflx.exe94⤵PID:1520
-
\??\c:\bthbbh.exec:\bthbbh.exe95⤵PID:1272
-
\??\c:\jjpdv.exec:\jjpdv.exe96⤵PID:1376
-
\??\c:\ppvjd.exec:\ppvjd.exe97⤵PID:1740
-
\??\c:\5lfxlxl.exec:\5lfxlxl.exe98⤵PID:396
-
\??\c:\tttnbn.exec:\tttnbn.exe99⤵PID:2976
-
\??\c:\jdvjd.exec:\jdvjd.exe100⤵PID:2188
-
\??\c:\xflrrxr.exec:\xflrrxr.exe101⤵PID:2124
-
\??\c:\rlfrflf.exec:\rlfrflf.exe102⤵PID:1988
-
\??\c:\tttbht.exec:\tttbht.exe103⤵PID:448
-
\??\c:\3ffrlrf.exec:\3ffrlrf.exe104⤵PID:1956
-
\??\c:\1rrfflf.exec:\1rrfflf.exe105⤵PID:1952
-
\??\c:\nttbth.exec:\nttbth.exe106⤵PID:1644
-
\??\c:\vdjjp.exec:\vdjjp.exe107⤵PID:1540
-
\??\c:\lfxxflf.exec:\lfxxflf.exe108⤵PID:1864
-
\??\c:\bnnbnt.exec:\bnnbnt.exe109⤵PID:1384
-
\??\c:\nhhntn.exec:\nhhntn.exe110⤵PID:848
-
\??\c:\jjjpj.exec:\jjjpj.exe111⤵PID:2012
-
\??\c:\ttthtn.exec:\ttthtn.exe112⤵PID:2496
-
\??\c:\jjpdp.exec:\jjpdp.exe113⤵PID:692
-
\??\c:\rflxrlf.exec:\rflxrlf.exe114⤵PID:1076
-
\??\c:\frxlfll.exec:\frxlfll.exe115⤵PID:3048
-
\??\c:\hhhnhn.exec:\hhhnhn.exe116⤵PID:824
-
\??\c:\djpjd.exec:\djpjd.exe117⤵PID:2204
-
\??\c:\ddpjd.exec:\ddpjd.exe118⤵PID:2084
-
\??\c:\xfxlxlf.exec:\xfxlxlf.exe119⤵PID:3044
-
\??\c:\hhhttt.exec:\hhhttt.exe120⤵PID:2732
-
\??\c:\9pdvv.exec:\9pdvv.exe121⤵PID:2140
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-