Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
21/09/2024, 17:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
368dccce20b264ff0341b13aff5b755866237fb089ed21efabd784066c5dc65eN.exe
Resource
win7-20240729-en
windows7-x64
6 signatures
120 seconds
General
-
Target
368dccce20b264ff0341b13aff5b755866237fb089ed21efabd784066c5dc65eN.exe
-
Size
332KB
-
MD5
9e8a754c309363f8123e7e44134888d0
-
SHA1
7ae09b09628a175377cf19f8bd1cd1943ab8f593
-
SHA256
368dccce20b264ff0341b13aff5b755866237fb089ed21efabd784066c5dc65e
-
SHA512
a28640056203f869e52d6990db7da2890234a5ece87b6924b4ee8ffeb17233862f82d31f9479d2f31bce194b908fae91ac9c43b41292b06efd2d76a42a9306f2
-
SSDEEP
6144:3cm7ImGddXsJdJIjaRleL42bL37BoTPkhu9gX5yGsTshQc8R0nxA5ij8+RC7tPhJ:F7Tc8JdSjylh2b77BoTMA9gX59sTsuTZ
Malware Config
Signatures
-
Detect Blackmoon payload 53 IoCs
resource yara_rule behavioral1/memory/2524-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3052-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1792-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2452-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3044-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2036-191-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1204-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1268-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/356-287-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1564-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-358-0x00000000002D0000-0x00000000002FA000-memory.dmp family_blackmoon behavioral1/memory/2096-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1040-441-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2036-461-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1684-521-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-586-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/864-614-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2640-636-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-672-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2928-699-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2364-529-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2352-489-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-454-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1208-448-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2908-403-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1956-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/356-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2268-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/596-229-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2036-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-173-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1372-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3044-137-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2780-64-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2864-44-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1040-720-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1196-728-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1196-726-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2576-767-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2908-978-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/268-986-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2512 llxlffx.exe 2680 bbbhtb.exe 2728 9frxllf.exe 2864 rfrxllx.exe 2956 7thnbb.exe 2780 3vjpv.exe 2800 lrlxllx.exe 2604 hbtthn.exe 3052 dvddj.exe 1792 3fxxxfl.exe 2144 1xxxlxf.exe 2452 1nnnbh.exe 1388 ddjjj.exe 3044 rlfrllf.exe 1372 bttthh.exe 2916 vpvvp.exe 1824 lxxffxr.exe 2488 5lflffl.exe 2056 nhbnbb.exe 2036 9jpvj.exe 2068 xfrflrf.exe 2152 tntntt.exe 1204 tthnbh.exe 596 vpddp.exe 1544 7btttt.exe 1268 3pdjd.exe 1220 rrlfrrx.exe 276 nnthtb.exe 1456 rlflrxf.exe 2268 5bhthn.exe 356 jjvdp.exe 2528 ppddv.exe 1564 tnhhbt.exe 2188 hhbhbh.exe 2716 jjppd.exe 2696 fxlxrrf.exe 2212 ttthtt.exe 2748 djvjj.exe 2892 jjdpj.exe 2700 fxrfrfl.exe 2632 ttntnt.exe 2856 7tnhnh.exe 620 dvdpj.exe 1956 9fflrrr.exe 2096 9fxfxxl.exe 2784 7nbtbh.exe 3040 hbbbtn.exe 2908 vdjjj.exe 2000 lrxfrfr.exe 2940 rrflrxx.exe 2928 nttntb.exe 2900 9ttthh.exe 1320 dvpdv.exe 1040 lfflfff.exe 1208 fxrxflx.exe 2980 bbttbh.exe 2036 5pjjp.exe 2468 1jjpj.exe 2164 1rxlfrl.exe 680 9lflxfl.exe 2352 bthnnt.exe 596 pppdv.exe 3036 dvppd.exe 2880 lffrrrf.exe -
resource yara_rule behavioral1/memory/2524-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1204-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1268-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1564-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-521-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-586-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-636-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-529-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-496-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-489-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/356-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1372-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-782-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/268-984-0x00000000003C0000-0x00000000003EA000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlfllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfrxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxflrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ddjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rlxrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhtnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2524 wrote to memory of 2512 2524 368dccce20b264ff0341b13aff5b755866237fb089ed21efabd784066c5dc65eN.exe 29 PID 2524 wrote to memory of 2512 2524 368dccce20b264ff0341b13aff5b755866237fb089ed21efabd784066c5dc65eN.exe 29 PID 2524 wrote to memory of 2512 2524 368dccce20b264ff0341b13aff5b755866237fb089ed21efabd784066c5dc65eN.exe 29 PID 2524 wrote to memory of 2512 2524 368dccce20b264ff0341b13aff5b755866237fb089ed21efabd784066c5dc65eN.exe 29 PID 2512 wrote to memory of 2680 2512 llxlffx.exe 30 PID 2512 wrote to memory of 2680 2512 llxlffx.exe 30 PID 2512 wrote to memory of 2680 2512 llxlffx.exe 30 PID 2512 wrote to memory of 2680 2512 llxlffx.exe 30 PID 2680 wrote to memory of 2728 2680 bbbhtb.exe 31 PID 2680 wrote to memory of 2728 2680 bbbhtb.exe 31 PID 2680 wrote to memory of 2728 2680 bbbhtb.exe 31 PID 2680 wrote to memory of 2728 2680 bbbhtb.exe 31 PID 2728 wrote to memory of 2864 2728 9frxllf.exe 32 PID 2728 wrote to memory of 2864 2728 9frxllf.exe 32 PID 2728 wrote to memory of 2864 2728 9frxllf.exe 32 PID 2728 wrote to memory of 2864 2728 9frxllf.exe 32 PID 2864 wrote to memory of 2956 2864 rfrxllx.exe 107 PID 2864 wrote to memory of 2956 2864 rfrxllx.exe 107 PID 2864 wrote to memory of 2956 2864 rfrxllx.exe 107 PID 2864 wrote to memory of 2956 2864 rfrxllx.exe 107 PID 2956 wrote to memory of 2780 2956 7thnbb.exe 34 PID 2956 wrote to memory of 2780 2956 7thnbb.exe 34 PID 2956 wrote to memory of 2780 2956 7thnbb.exe 34 PID 2956 wrote to memory of 2780 2956 7thnbb.exe 34 PID 2780 wrote to memory of 2800 2780 3vjpv.exe 35 PID 2780 wrote to memory of 2800 2780 3vjpv.exe 35 PID 2780 wrote to memory of 2800 2780 3vjpv.exe 35 PID 2780 wrote to memory of 2800 2780 3vjpv.exe 35 PID 2800 wrote to memory of 2604 2800 lrlxllx.exe 36 PID 2800 wrote to memory of 2604 2800 lrlxllx.exe 36 PID 2800 wrote to memory of 2604 2800 lrlxllx.exe 36 PID 2800 wrote to memory of 2604 2800 lrlxllx.exe 36 PID 2604 wrote to memory of 3052 2604 hbtthn.exe 37 PID 2604 wrote to memory of 3052 2604 hbtthn.exe 37 PID 2604 wrote to memory of 3052 2604 hbtthn.exe 37 PID 2604 wrote to memory of 3052 2604 hbtthn.exe 37 PID 3052 wrote to memory of 1792 3052 dvddj.exe 38 PID 3052 wrote to memory of 1792 3052 dvddj.exe 38 PID 3052 wrote to memory of 1792 3052 dvddj.exe 38 PID 3052 wrote to memory of 1792 3052 dvddj.exe 38 PID 1792 wrote to memory of 2144 1792 3fxxxfl.exe 39 PID 1792 wrote to memory of 2144 1792 3fxxxfl.exe 39 PID 1792 wrote to memory of 2144 1792 3fxxxfl.exe 39 PID 1792 wrote to memory of 2144 1792 3fxxxfl.exe 39 PID 2144 wrote to memory of 2452 2144 1xxxlxf.exe 40 PID 2144 wrote to memory of 2452 2144 1xxxlxf.exe 40 PID 2144 wrote to memory of 2452 2144 1xxxlxf.exe 40 PID 2144 wrote to memory of 2452 2144 1xxxlxf.exe 40 PID 2452 wrote to memory of 1388 2452 1nnnbh.exe 41 PID 2452 wrote to memory of 1388 2452 1nnnbh.exe 41 PID 2452 wrote to memory of 1388 2452 1nnnbh.exe 41 PID 2452 wrote to memory of 1388 2452 1nnnbh.exe 41 PID 1388 wrote to memory of 3044 1388 ddjjj.exe 42 PID 1388 wrote to memory of 3044 1388 ddjjj.exe 42 PID 1388 wrote to memory of 3044 1388 ddjjj.exe 42 PID 1388 wrote to memory of 3044 1388 ddjjj.exe 42 PID 3044 wrote to memory of 1372 3044 rlfrllf.exe 43 PID 3044 wrote to memory of 1372 3044 rlfrllf.exe 43 PID 3044 wrote to memory of 1372 3044 rlfrllf.exe 43 PID 3044 wrote to memory of 1372 3044 rlfrllf.exe 43 PID 1372 wrote to memory of 2916 1372 bttthh.exe 44 PID 1372 wrote to memory of 2916 1372 bttthh.exe 44 PID 1372 wrote to memory of 2916 1372 bttthh.exe 44 PID 1372 wrote to memory of 2916 1372 bttthh.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\368dccce20b264ff0341b13aff5b755866237fb089ed21efabd784066c5dc65eN.exe"C:\Users\Admin\AppData\Local\Temp\368dccce20b264ff0341b13aff5b755866237fb089ed21efabd784066c5dc65eN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\llxlffx.exec:\llxlffx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\bbbhtb.exec:\bbbhtb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\9frxllf.exec:\9frxllf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\rfrxllx.exec:\rfrxllx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\7thnbb.exec:\7thnbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\3vjpv.exec:\3vjpv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\lrlxllx.exec:\lrlxllx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\hbtthn.exec:\hbtthn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\dvddj.exec:\dvddj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\3fxxxfl.exec:\3fxxxfl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\1xxxlxf.exec:\1xxxlxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\1nnnbh.exec:\1nnnbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\ddjjj.exec:\ddjjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\rlfrllf.exec:\rlfrllf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\bttthh.exec:\bttthh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
\??\c:\vpvvp.exec:\vpvvp.exe17⤵
- Executes dropped EXE
PID:2916 -
\??\c:\lxxffxr.exec:\lxxffxr.exe18⤵
- Executes dropped EXE
PID:1824 -
\??\c:\5lflffl.exec:\5lflffl.exe19⤵
- Executes dropped EXE
PID:2488 -
\??\c:\nhbnbb.exec:\nhbnbb.exe20⤵
- Executes dropped EXE
PID:2056 -
\??\c:\9jpvj.exec:\9jpvj.exe21⤵
- Executes dropped EXE
PID:2036 -
\??\c:\xfrflrf.exec:\xfrflrf.exe22⤵
- Executes dropped EXE
PID:2068 -
\??\c:\tntntt.exec:\tntntt.exe23⤵
- Executes dropped EXE
PID:2152 -
\??\c:\tthnbh.exec:\tthnbh.exe24⤵
- Executes dropped EXE
PID:1204 -
\??\c:\vpddp.exec:\vpddp.exe25⤵
- Executes dropped EXE
PID:596 -
\??\c:\7btttt.exec:\7btttt.exe26⤵
- Executes dropped EXE
PID:1544 -
\??\c:\3pdjd.exec:\3pdjd.exe27⤵
- Executes dropped EXE
PID:1268 -
\??\c:\rrlfrrx.exec:\rrlfrrx.exe28⤵
- Executes dropped EXE
PID:1220 -
\??\c:\nnthtb.exec:\nnthtb.exe29⤵
- Executes dropped EXE
PID:276 -
\??\c:\rlflrxf.exec:\rlflrxf.exe30⤵
- Executes dropped EXE
PID:1456 -
\??\c:\5bhthn.exec:\5bhthn.exe31⤵
- Executes dropped EXE
PID:2268 -
\??\c:\jjvdp.exec:\jjvdp.exe32⤵
- Executes dropped EXE
PID:356 -
\??\c:\ppddv.exec:\ppddv.exe33⤵
- Executes dropped EXE
PID:2528 -
\??\c:\tnhhbt.exec:\tnhhbt.exe34⤵
- Executes dropped EXE
PID:1564 -
\??\c:\hhbhbh.exec:\hhbhbh.exe35⤵
- Executes dropped EXE
PID:2188 -
\??\c:\jjppd.exec:\jjppd.exe36⤵
- Executes dropped EXE
PID:2716 -
\??\c:\fxlxrrf.exec:\fxlxrrf.exe37⤵
- Executes dropped EXE
PID:2696 -
\??\c:\ttthtt.exec:\ttthtt.exe38⤵
- Executes dropped EXE
PID:2212 -
\??\c:\djvjj.exec:\djvjj.exe39⤵
- Executes dropped EXE
PID:2748 -
\??\c:\jjdpj.exec:\jjdpj.exe40⤵
- Executes dropped EXE
PID:2892 -
\??\c:\fxrfrfl.exec:\fxrfrfl.exe41⤵
- Executes dropped EXE
PID:2700 -
\??\c:\ttntnt.exec:\ttntnt.exe42⤵
- Executes dropped EXE
PID:2632 -
\??\c:\7tnhnh.exec:\7tnhnh.exe43⤵
- Executes dropped EXE
PID:2856 -
\??\c:\dvdpj.exec:\dvdpj.exe44⤵
- Executes dropped EXE
PID:620 -
\??\c:\9fflrrr.exec:\9fflrrr.exe45⤵
- Executes dropped EXE
PID:1956 -
\??\c:\9fxfxxl.exec:\9fxfxxl.exe46⤵
- Executes dropped EXE
PID:2096 -
\??\c:\7nbtbh.exec:\7nbtbh.exe47⤵
- Executes dropped EXE
PID:2784 -
\??\c:\hbbbtn.exec:\hbbbtn.exe48⤵
- Executes dropped EXE
PID:3040 -
\??\c:\vdjjj.exec:\vdjjj.exe49⤵
- Executes dropped EXE
PID:2908 -
\??\c:\lrxfrfr.exec:\lrxfrfr.exe50⤵
- Executes dropped EXE
PID:2000 -
\??\c:\rrflrxx.exec:\rrflrxx.exe51⤵
- Executes dropped EXE
PID:2940 -
\??\c:\nttntb.exec:\nttntb.exe52⤵
- Executes dropped EXE
PID:2928 -
\??\c:\9ttthh.exec:\9ttthh.exe53⤵
- Executes dropped EXE
PID:2900 -
\??\c:\dvpdv.exec:\dvpdv.exe54⤵
- Executes dropped EXE
PID:1320 -
\??\c:\lfflfff.exec:\lfflfff.exe55⤵
- Executes dropped EXE
PID:1040 -
\??\c:\fxrxflx.exec:\fxrxflx.exe56⤵
- Executes dropped EXE
PID:1208 -
\??\c:\bbttbh.exec:\bbttbh.exe57⤵
- Executes dropped EXE
PID:2980 -
\??\c:\5pjjp.exec:\5pjjp.exe58⤵
- Executes dropped EXE
PID:2036 -
\??\c:\1jjpj.exec:\1jjpj.exe59⤵
- Executes dropped EXE
PID:2468 -
\??\c:\1rxlfrl.exec:\1rxlfrl.exe60⤵
- Executes dropped EXE
PID:2164 -
\??\c:\9lflxfl.exec:\9lflxfl.exe61⤵
- Executes dropped EXE
PID:680 -
\??\c:\bthnnt.exec:\bthnnt.exe62⤵
- Executes dropped EXE
PID:2352 -
\??\c:\pppdv.exec:\pppdv.exe63⤵
- Executes dropped EXE
PID:596 -
\??\c:\dvppd.exec:\dvppd.exe64⤵
- Executes dropped EXE
PID:3036 -
\??\c:\lffrrrf.exec:\lffrrrf.exe65⤵
- Executes dropped EXE
PID:2880 -
\??\c:\tnnnhn.exec:\tnnnhn.exe66⤵PID:2216
-
\??\c:\5ntbnh.exec:\5ntbnh.exe67⤵PID:1684
-
\??\c:\dvpdp.exec:\dvpdp.exe68⤵PID:2364
-
\??\c:\rxflffx.exec:\rxflffx.exe69⤵PID:1880
-
\??\c:\rxllxfr.exec:\rxllxfr.exe70⤵PID:1456
-
\??\c:\ttnbtn.exec:\ttnbtn.exe71⤵PID:860
-
\??\c:\3bthtt.exec:\3bthtt.exe72⤵PID:3024
-
\??\c:\3pvdp.exec:\3pvdp.exe73⤵PID:1472
-
\??\c:\rrlrfrf.exec:\rrlrfrf.exe74⤵PID:1712
-
\??\c:\xlrllrr.exec:\xlrllrr.exe75⤵PID:2944
-
\??\c:\1bttnh.exec:\1bttnh.exe76⤵PID:2188
-
\??\c:\9vpvp.exec:\9vpvp.exe77⤵PID:576
-
\??\c:\pdjjv.exec:\pdjjv.exe78⤵PID:664
-
\??\c:\lfrxflx.exec:\lfrxflx.exe79⤵PID:2120
-
\??\c:\xxlrxxf.exec:\xxlrxxf.exe80⤵PID:2956
-
\??\c:\hhbbnt.exec:\hhbbnt.exe81⤵PID:2748
-
\??\c:\nhhnht.exec:\nhhnht.exe82⤵PID:864
-
\??\c:\vpvdj.exec:\vpvdj.exe83⤵PID:2712
-
\??\c:\3lfxfrl.exec:\3lfxfrl.exe84⤵PID:2652
-
\??\c:\7rlxrxl.exec:\7rlxrxl.exe85⤵
- System Location Discovery: System Language Discovery
PID:2640 -
\??\c:\tnnbnn.exec:\tnnbnn.exe86⤵PID:2024
-
\??\c:\bbnbtt.exec:\bbnbtt.exe87⤵PID:2536
-
\??\c:\jjdvd.exec:\jjdvd.exe88⤵
- System Location Discovery: System Language Discovery
PID:1228 -
\??\c:\xfxflrf.exec:\xfxflrf.exe89⤵PID:2096
-
\??\c:\lllrrrx.exec:\lllrrrx.exe90⤵PID:2784
-
\??\c:\hhhnhh.exec:\hhhnhh.exe91⤵PID:2724
-
\??\c:\9bbhnb.exec:\9bbhnb.exe92⤵PID:1652
-
\??\c:\3dpjj.exec:\3dpjj.exe93⤵PID:2000
-
\??\c:\jdvvj.exec:\jdvvj.exe94⤵PID:2940
-
\??\c:\lfxxfxf.exec:\lfxxfxf.exe95⤵PID:2928
-
\??\c:\tnhhnn.exec:\tnhhnn.exe96⤵PID:1440
-
\??\c:\nbthtb.exec:\nbthtb.exe97⤵PID:1320
-
\??\c:\9dvdv.exec:\9dvdv.exe98⤵PID:1040
-
\??\c:\ffflxrf.exec:\ffflxrf.exe99⤵PID:1196
-
\??\c:\tnbhnt.exec:\tnbhnt.exe100⤵PID:2244
-
\??\c:\vvvjp.exec:\vvvjp.exe101⤵PID:2252
-
\??\c:\ntbnbt.exec:\ntbnbt.exe102⤵PID:2888
-
\??\c:\dvpvd.exec:\dvpvd.exe103⤵PID:1204
-
\??\c:\xxxxffl.exec:\xxxxffl.exe104⤵PID:2236
-
\??\c:\rlxxfrf.exec:\rlxxfrf.exe105⤵PID:2576
-
\??\c:\ttbbhn.exec:\ttbbhn.exe106⤵PID:2176
-
\??\c:\1pdpp.exec:\1pdpp.exe107⤵PID:1832
-
\??\c:\rrrfxlx.exec:\rrrfxlx.exe108⤵PID:1984
-
\??\c:\5bntnb.exec:\5bntnb.exe109⤵PID:2976
-
\??\c:\5pddd.exec:\5pddd.exe110⤵PID:264
-
\??\c:\vpddv.exec:\vpddv.exe111⤵PID:2080
-
\??\c:\bnhnhh.exec:\bnhnhh.exe112⤵PID:1216
-
\??\c:\9nbhth.exec:\9nbhth.exe113⤵PID:1476
-
\??\c:\rrxfrlf.exec:\rrxfrlf.exe114⤵PID:3020
-
\??\c:\bttthh.exec:\bttthh.exe115⤵PID:2568
-
\??\c:\ddvpd.exec:\ddvpd.exe116⤵PID:2228
-
\??\c:\nnnhnn.exec:\nnnhnn.exe117⤵PID:772
-
\??\c:\dddpd.exec:\dddpd.exe118⤵
- System Location Discovery: System Language Discovery
PID:820 -
\??\c:\lflrffr.exec:\lflrffr.exe119⤵PID:2716
-
\??\c:\hhhnht.exec:\hhhnht.exe120⤵PID:2808
-
\??\c:\tnbbnb.exec:\tnbbnb.exe121⤵PID:2212
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-