Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21/09/2024, 20:40
Behavioral task
behavioral1
Sample
50a688f4e9ea8c883a4ec10749792551ebf7dd0c967a931ed91b294425d98880.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
General
-
Target
50a688f4e9ea8c883a4ec10749792551ebf7dd0c967a931ed91b294425d98880.exe
-
Size
330KB
-
MD5
9ac8b0e180e7a026d052ead77a176c47
-
SHA1
ebcc4c5be4449f9162baece99d7d39cc5936f39e
-
SHA256
50a688f4e9ea8c883a4ec10749792551ebf7dd0c967a931ed91b294425d98880
-
SHA512
e010f389141f06f505f1b60aa0f0028fc7058c4a7507529171a185ca2b705a9a826d525c8b6f30323c14497fa8b7bc3c62de6e5e9de97c3f00d315938bad4cae
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeB:R4wFHoSHYHUrAwfMp3CDB
Malware Config
Signatures
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/2400-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2724-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2724-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2780-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2688-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2596-41-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2596-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2640-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/264-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1308-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2540-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2012-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2012-129-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1264-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1760-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2232-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1076-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2716-287-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2716-286-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/2728-310-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2136-446-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2960-452-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2932-316-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2388-274-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1448-259-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1448-257-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/608-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1652-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1476-226-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1076-210-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3032-497-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2552-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1760-161-0x00000000002F0000-0x0000000000317000-memory.dmp family_blackmoon behavioral1/memory/2924-503-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2644-122-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2644-120-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/1584-113-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2540-103-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/576-95-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/304-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2736-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/912-520-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/696-604-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/112-700-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2332-1297-0x00000000775E0000-0x00000000776FF000-memory.dmp family_blackmoon behavioral1/memory/2332-4830-0x0000000077700000-0x00000000777FA000-memory.dmp family_blackmoon behavioral1/memory/2332-5572-0x0000000077700000-0x00000000777FA000-memory.dmp family_blackmoon behavioral1/memory/2332-6311-0x0000000077700000-0x00000000777FA000-memory.dmp family_blackmoon behavioral1/memory/2332-6802-0x00000000775E0000-0x00000000776FF000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2724 lflxrxr.exe 2780 nnhtbn.exe 2736 5bnthn.exe 2596 tntbhn.exe 2688 dvpvj.exe 2640 rrlrfrf.exe 304 9xrlxll.exe 264 xfxlflx.exe 1308 dvpvd.exe 576 jjjpd.exe 2540 fxlrlrf.exe 1584 tnnnhb.exe 2644 7dvpd.exe 2012 xxrlrfl.exe 1264 hbhbnt.exe 1880 ddpvv.exe 2756 xxxxrff.exe 1760 xxrxrxl.exe 1744 thhnbb.exe 2552 7xxflrr.exe 2232 lrllrrl.exe 2088 ttnbnn.exe 2240 pdvvj.exe 1076 1ffxllx.exe 552 7bhttn.exe 1476 pjjdj.exe 1652 xxxllrl.exe 608 nbnnth.exe 1248 jvjvj.exe 1448 llrffll.exe 572 ntthbn.exe 2388 9dvdp.exe 3024 1llfrfr.exe 2716 5fxlrll.exe 2776 9tbbtt.exe 1496 3ffrlxl.exe 2940 rrrxrlx.exe 2728 htbnnh.exe 2932 jjjvd.exe 2596 flrlfxr.exe 2688 5lfrflx.exe 2772 nnhthn.exe 2836 bthbth.exe 2584 dddvv.exe 1660 bbthnt.exe 1220 hnbnht.exe 3020 vppdj.exe 1216 vvpjv.exe 2152 1xxrlfr.exe 2540 5rfxlrx.exe 836 nhtttb.exe 2480 btbnhn.exe 2220 3vpdd.exe 984 lllfxll.exe 2816 1fxlrfl.exe 1272 ntthhn.exe 2476 bttbtb.exe 1964 1jdpj.exe 1760 lxlxflf.exe 2556 fffxlfr.exe 2472 3ntnnt.exe 2552 hbttth.exe 2136 1dvpd.exe 2960 lllffrl.exe -
resource yara_rule behavioral1/memory/2400-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2400-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2724-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000b000000012280-8.dat upx behavioral1/files/0x000700000001939f-18.dat upx behavioral1/memory/2724-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2724-15-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2780-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000193d0-25.dat upx behavioral1/memory/2688-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2688-53-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000019428-52.dat upx behavioral1/files/0x0006000000019426-45.dat upx behavioral1/memory/2596-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000194c3-61.dat upx behavioral1/memory/2640-62-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000194d5-71.dat upx behavioral1/memory/264-79-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1308-88-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019650-97.dat upx behavioral1/memory/2540-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000197e4-106.dat upx behavioral1/files/0x0005000000019a85-114.dat upx behavioral1/memory/2012-131-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019b18-130.dat upx behavioral1/memory/1264-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019c79-140.dat upx behavioral1/files/0x0005000000019c8f-148.dat upx behavioral1/memory/1760-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019d98-170.dat upx behavioral1/files/0x0005000000019f62-180.dat upx behavioral1/memory/2232-187-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0032000000019354-188.dat upx behavioral1/files/0x000500000001a077-204.dat upx behavioral1/memory/1076-212-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a07f-213.dat upx behavioral1/files/0x000500000001a30e-227.dat upx behavioral1/files/0x000500000001a444-244.dat upx behavioral1/files/0x000500000001a446-251.dat upx behavioral1/files/0x000500000001a448-267.dat upx behavioral1/memory/2716-287-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2728-310-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2960-452-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/836-377-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2596-317-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2932-316-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2728-303-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2036-474-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/3024-275-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2388-274-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a447-260.dat upx behavioral1/memory/1448-259-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/608-242-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a340-236.dat upx behavioral1/memory/1652-235-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2076-486-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1476-226-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a0b4-220.dat upx behavioral1/files/0x0005000000019f77-197.dat upx behavioral1/memory/2240-196-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3032-497-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2552-179-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019cc8-164.dat upx behavioral1/memory/2924-503-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbntbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nhtnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllxfrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhtbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhntht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3fxfrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1fxllxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2400 wrote to memory of 2724 2400 50a688f4e9ea8c883a4ec10749792551ebf7dd0c967a931ed91b294425d98880.exe 30 PID 2400 wrote to memory of 2724 2400 50a688f4e9ea8c883a4ec10749792551ebf7dd0c967a931ed91b294425d98880.exe 30 PID 2400 wrote to memory of 2724 2400 50a688f4e9ea8c883a4ec10749792551ebf7dd0c967a931ed91b294425d98880.exe 30 PID 2400 wrote to memory of 2724 2400 50a688f4e9ea8c883a4ec10749792551ebf7dd0c967a931ed91b294425d98880.exe 30 PID 2724 wrote to memory of 2780 2724 lflxrxr.exe 31 PID 2724 wrote to memory of 2780 2724 lflxrxr.exe 31 PID 2724 wrote to memory of 2780 2724 lflxrxr.exe 31 PID 2724 wrote to memory of 2780 2724 lflxrxr.exe 31 PID 2780 wrote to memory of 2736 2780 nnhtbn.exe 32 PID 2780 wrote to memory of 2736 2780 nnhtbn.exe 32 PID 2780 wrote to memory of 2736 2780 nnhtbn.exe 32 PID 2780 wrote to memory of 2736 2780 nnhtbn.exe 32 PID 2736 wrote to memory of 2596 2736 5bnthn.exe 33 PID 2736 wrote to memory of 2596 2736 5bnthn.exe 33 PID 2736 wrote to memory of 2596 2736 5bnthn.exe 33 PID 2736 wrote to memory of 2596 2736 5bnthn.exe 33 PID 2596 wrote to memory of 2688 2596 tntbhn.exe 34 PID 2596 wrote to memory of 2688 2596 tntbhn.exe 34 PID 2596 wrote to memory of 2688 2596 tntbhn.exe 34 PID 2596 wrote to memory of 2688 2596 tntbhn.exe 34 PID 2688 wrote to memory of 2640 2688 dvpvj.exe 118 PID 2688 wrote to memory of 2640 2688 dvpvj.exe 118 PID 2688 wrote to memory of 2640 2688 dvpvj.exe 118 PID 2688 wrote to memory of 2640 2688 dvpvj.exe 118 PID 2640 wrote to memory of 304 2640 rrlrfrf.exe 36 PID 2640 wrote to memory of 304 2640 rrlrfrf.exe 36 PID 2640 wrote to memory of 304 2640 rrlrfrf.exe 36 PID 2640 wrote to memory of 304 2640 rrlrfrf.exe 36 PID 304 wrote to memory of 264 304 9xrlxll.exe 37 PID 304 wrote to memory of 264 304 9xrlxll.exe 37 PID 304 wrote to memory of 264 304 9xrlxll.exe 37 PID 304 wrote to memory of 264 304 9xrlxll.exe 37 PID 264 wrote to memory of 1308 264 xfxlflx.exe 38 PID 264 wrote to memory of 1308 264 xfxlflx.exe 38 PID 264 wrote to memory of 1308 264 xfxlflx.exe 38 PID 264 wrote to memory of 1308 264 xfxlflx.exe 38 PID 1308 wrote to memory of 576 1308 dvpvd.exe 39 PID 1308 wrote to memory of 576 1308 dvpvd.exe 39 PID 1308 wrote to memory of 576 1308 dvpvd.exe 39 PID 1308 wrote to memory of 576 1308 dvpvd.exe 39 PID 576 wrote to memory of 2540 576 jjjpd.exe 79 PID 576 wrote to memory of 2540 576 jjjpd.exe 79 PID 576 wrote to memory of 2540 576 jjjpd.exe 79 PID 576 wrote to memory of 2540 576 jjjpd.exe 79 PID 2540 wrote to memory of 1584 2540 fxlrlrf.exe 41 PID 2540 wrote to memory of 1584 2540 fxlrlrf.exe 41 PID 2540 wrote to memory of 1584 2540 fxlrlrf.exe 41 PID 2540 wrote to memory of 1584 2540 fxlrlrf.exe 41 PID 1584 wrote to memory of 2644 1584 tnnnhb.exe 42 PID 1584 wrote to memory of 2644 1584 tnnnhb.exe 42 PID 1584 wrote to memory of 2644 1584 tnnnhb.exe 42 PID 1584 wrote to memory of 2644 1584 tnnnhb.exe 42 PID 2644 wrote to memory of 2012 2644 7dvpd.exe 129 PID 2644 wrote to memory of 2012 2644 7dvpd.exe 129 PID 2644 wrote to memory of 2012 2644 7dvpd.exe 129 PID 2644 wrote to memory of 2012 2644 7dvpd.exe 129 PID 2012 wrote to memory of 1264 2012 xxrlrfl.exe 44 PID 2012 wrote to memory of 1264 2012 xxrlrfl.exe 44 PID 2012 wrote to memory of 1264 2012 xxrlrfl.exe 44 PID 2012 wrote to memory of 1264 2012 xxrlrfl.exe 44 PID 1264 wrote to memory of 1880 1264 hbhbnt.exe 45 PID 1264 wrote to memory of 1880 1264 hbhbnt.exe 45 PID 1264 wrote to memory of 1880 1264 hbhbnt.exe 45 PID 1264 wrote to memory of 1880 1264 hbhbnt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\50a688f4e9ea8c883a4ec10749792551ebf7dd0c967a931ed91b294425d98880.exe"C:\Users\Admin\AppData\Local\Temp\50a688f4e9ea8c883a4ec10749792551ebf7dd0c967a931ed91b294425d98880.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\lflxrxr.exec:\lflxrxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\nnhtbn.exec:\nnhtbn.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\5bnthn.exec:\5bnthn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\tntbhn.exec:\tntbhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\dvpvj.exec:\dvpvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\rrlrfrf.exec:\rrlrfrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\9xrlxll.exec:\9xrlxll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:304 -
\??\c:\xfxlflx.exec:\xfxlflx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:264 -
\??\c:\dvpvd.exec:\dvpvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
\??\c:\jjjpd.exec:\jjjpd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:576 -
\??\c:\fxlrlrf.exec:\fxlrlrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\tnnnhb.exec:\tnnnhb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\7dvpd.exec:\7dvpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\xxrlrfl.exec:\xxrlrfl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\hbhbnt.exec:\hbhbnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
\??\c:\ddpvv.exec:\ddpvv.exe17⤵
- Executes dropped EXE
PID:1880 -
\??\c:\xxxxrff.exec:\xxxxrff.exe18⤵
- Executes dropped EXE
PID:2756 -
\??\c:\xxrxrxl.exec:\xxrxrxl.exe19⤵
- Executes dropped EXE
PID:1760 -
\??\c:\thhnbb.exec:\thhnbb.exe20⤵
- Executes dropped EXE
PID:1744 -
\??\c:\7xxflrr.exec:\7xxflrr.exe21⤵
- Executes dropped EXE
PID:2552 -
\??\c:\lrllrrl.exec:\lrllrrl.exe22⤵
- Executes dropped EXE
PID:2232 -
\??\c:\ttnbnn.exec:\ttnbnn.exe23⤵
- Executes dropped EXE
PID:2088 -
\??\c:\pdvvj.exec:\pdvvj.exe24⤵
- Executes dropped EXE
PID:2240 -
\??\c:\1ffxllx.exec:\1ffxllx.exe25⤵
- Executes dropped EXE
PID:1076 -
\??\c:\7bhttn.exec:\7bhttn.exe26⤵
- Executes dropped EXE
PID:552 -
\??\c:\pjjdj.exec:\pjjdj.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1476 -
\??\c:\xxxllrl.exec:\xxxllrl.exe28⤵
- Executes dropped EXE
PID:1652 -
\??\c:\nbnnth.exec:\nbnnth.exe29⤵
- Executes dropped EXE
PID:608 -
\??\c:\jvjvj.exec:\jvjvj.exe30⤵
- Executes dropped EXE
PID:1248 -
\??\c:\llrffll.exec:\llrffll.exe31⤵
- Executes dropped EXE
PID:1448 -
\??\c:\ntthbn.exec:\ntthbn.exe32⤵
- Executes dropped EXE
PID:572 -
\??\c:\9dvdp.exec:\9dvdp.exe33⤵
- Executes dropped EXE
PID:2388 -
\??\c:\1llfrfr.exec:\1llfrfr.exe34⤵
- Executes dropped EXE
PID:3024 -
\??\c:\5fxlrll.exec:\5fxlrll.exe35⤵
- Executes dropped EXE
PID:2716 -
\??\c:\9tbbtt.exec:\9tbbtt.exe36⤵
- Executes dropped EXE
PID:2776 -
\??\c:\3ffrlxl.exec:\3ffrlxl.exe37⤵
- Executes dropped EXE
PID:1496 -
\??\c:\rrrxrlx.exec:\rrrxrlx.exe38⤵
- Executes dropped EXE
PID:2940 -
\??\c:\htbnnh.exec:\htbnnh.exe39⤵
- Executes dropped EXE
PID:2728 -
\??\c:\jjjvd.exec:\jjjvd.exe40⤵
- Executes dropped EXE
PID:2932 -
\??\c:\flrlfxr.exec:\flrlfxr.exe41⤵
- Executes dropped EXE
PID:2596 -
\??\c:\5lfrflx.exec:\5lfrflx.exe42⤵
- Executes dropped EXE
PID:2688 -
\??\c:\nnhthn.exec:\nnhthn.exe43⤵
- Executes dropped EXE
PID:2772 -
\??\c:\bthbth.exec:\bthbth.exe44⤵
- Executes dropped EXE
PID:2836 -
\??\c:\dddvv.exec:\dddvv.exe45⤵
- Executes dropped EXE
PID:2584 -
\??\c:\bbthnt.exec:\bbthnt.exe46⤵
- Executes dropped EXE
PID:1660 -
\??\c:\hnbnht.exec:\hnbnht.exe47⤵
- Executes dropped EXE
PID:1220 -
\??\c:\vppdj.exec:\vppdj.exe48⤵
- Executes dropped EXE
PID:3020 -
\??\c:\vvpjv.exec:\vvpjv.exe49⤵
- Executes dropped EXE
PID:1216 -
\??\c:\1xxrlfr.exec:\1xxrlfr.exe50⤵
- Executes dropped EXE
PID:2152 -
\??\c:\5rfxlrx.exec:\5rfxlrx.exe51⤵
- Executes dropped EXE
PID:2540 -
\??\c:\nhtttb.exec:\nhtttb.exe52⤵
- Executes dropped EXE
PID:836 -
\??\c:\btbnhn.exec:\btbnhn.exe53⤵
- Executes dropped EXE
PID:2480 -
\??\c:\3vpdd.exec:\3vpdd.exe54⤵
- Executes dropped EXE
PID:2220 -
\??\c:\lllfxll.exec:\lllfxll.exe55⤵
- Executes dropped EXE
PID:984 -
\??\c:\1fxlrfl.exec:\1fxlrfl.exe56⤵
- Executes dropped EXE
PID:2816 -
\??\c:\ntthhn.exec:\ntthhn.exe57⤵
- Executes dropped EXE
PID:1272 -
\??\c:\bttbtb.exec:\bttbtb.exe58⤵
- Executes dropped EXE
PID:2476 -
\??\c:\1jdpj.exec:\1jdpj.exe59⤵
- Executes dropped EXE
PID:1964 -
\??\c:\lxlxflf.exec:\lxlxflf.exe60⤵
- Executes dropped EXE
PID:1760 -
\??\c:\fffxlfr.exec:\fffxlfr.exe61⤵
- Executes dropped EXE
PID:2556 -
\??\c:\3ntnnt.exec:\3ntnnt.exe62⤵
- Executes dropped EXE
PID:2472 -
\??\c:\hbttth.exec:\hbttth.exe63⤵
- Executes dropped EXE
PID:2552 -
\??\c:\1dvpd.exec:\1dvpd.exe64⤵
- Executes dropped EXE
PID:2136 -
\??\c:\lllffrl.exec:\lllffrl.exe65⤵
- Executes dropped EXE
PID:2960 -
\??\c:\3lflxlf.exec:\3lflxlf.exe66⤵PID:2864
-
\??\c:\nnhhnb.exec:\nnhhnb.exe67⤵PID:1508
-
\??\c:\btnbtn.exec:\btnbtn.exe68⤵PID:2168
-
\??\c:\vdpdd.exec:\vdpdd.exe69⤵PID:2036
-
\??\c:\vjjdj.exec:\vjjdj.exe70⤵PID:2280
-
\??\c:\ffxrlxf.exec:\ffxrlxf.exe71⤵PID:2276
-
\??\c:\xflfxff.exec:\xflfxff.exe72⤵PID:2076
-
\??\c:\nnbtht.exec:\nnbtht.exe73⤵PID:3032
-
\??\c:\jdvvp.exec:\jdvvp.exe74⤵PID:2924
-
\??\c:\dvvpj.exec:\dvvpj.exe75⤵PID:1808
-
\??\c:\rrlrxlx.exec:\rrlrxlx.exe76⤵PID:2944
-
\??\c:\ffxfrfr.exec:\ffxfrfr.exe77⤵PID:1644
-
\??\c:\5thbtb.exec:\5thbtb.exe78⤵PID:912
-
\??\c:\dddpd.exec:\dddpd.exe79⤵PID:1936
-
\??\c:\pvvdp.exec:\pvvdp.exe80⤵PID:2976
-
\??\c:\1frfxrl.exec:\1frfxrl.exe81⤵PID:2368
-
\??\c:\1rlflrf.exec:\1rlflrf.exe82⤵PID:2724
-
\??\c:\tttbtb.exec:\tttbtb.exe83⤵PID:2848
-
\??\c:\jdvdj.exec:\jdvdj.exe84⤵PID:2056
-
\??\c:\ppppd.exec:\ppppd.exe85⤵PID:1160
-
\??\c:\7lxlrxr.exec:\7lxlrxr.exe86⤵PID:1800
-
\??\c:\1xxfrfr.exec:\1xxfrfr.exe87⤵PID:2700
-
\??\c:\5nnhth.exec:\5nnhth.exe88⤵PID:2696
-
\??\c:\vvpdp.exec:\vvpdp.exe89⤵PID:1420
-
\??\c:\jvjpp.exec:\jvjpp.exe90⤵PID:2640
-
\??\c:\lfxlrxl.exec:\lfxlrxl.exe91⤵PID:1012
-
\??\c:\bbttnt.exec:\bbttnt.exe92⤵PID:696
-
\??\c:\nnhtnn.exec:\nnhtnn.exe93⤵PID:1560
-
\??\c:\vvpjp.exec:\vvpjp.exe94⤵PID:336
-
\??\c:\fllfxrx.exec:\fllfxrx.exe95⤵PID:2436
-
\??\c:\lfxfxxf.exec:\lfxfxxf.exe96⤵PID:2156
-
\??\c:\bbhbbn.exec:\bbhbbn.exe97⤵PID:2176
-
\??\c:\ttbtnh.exec:\ttbtnh.exe98⤵PID:2888
-
\??\c:\vvdpj.exec:\vvdpj.exe99⤵PID:1748
-
\??\c:\9dppd.exec:\9dppd.exe100⤵PID:2544
-
\??\c:\rlrxrxf.exec:\rlrxrxf.exe101⤵PID:2012
-
\??\c:\1tbhhn.exec:\1tbhhn.exe102⤵PID:532
-
\??\c:\thtttn.exec:\thtttn.exe103⤵PID:2912
-
\??\c:\3vddv.exec:\3vddv.exe104⤵PID:1572
-
\??\c:\vpvjp.exec:\vpvjp.exe105⤵PID:2072
-
\??\c:\9lfrfxl.exec:\9lfrfxl.exe106⤵PID:2632
-
\??\c:\hhhbtn.exec:\hhhbtn.exe107⤵PID:2340
-
\??\c:\htnnbb.exec:\htnnbb.exe108⤵PID:1760
-
\??\c:\vvvjj.exec:\vvvjj.exe109⤵PID:2260
-
\??\c:\fxrflrr.exec:\fxrflrr.exe110⤵PID:112
-
\??\c:\xxxxlfl.exec:\xxxxlfl.exe111⤵PID:2252
-
\??\c:\nnbnth.exec:\nnbnth.exe112⤵PID:2088
-
\??\c:\jdvjd.exec:\jdvjd.exe113⤵PID:1740
-
\??\c:\xxlrfll.exec:\xxlrfll.exe114⤵PID:1472
-
\??\c:\lxxrrxx.exec:\lxxrrxx.exe115⤵PID:1508
-
\??\c:\bbbnbn.exec:\bbbnbn.exe116⤵PID:1292
-
\??\c:\jjdpj.exec:\jjdpj.exe117⤵PID:2308
-
\??\c:\thtnnn.exec:\thtnnn.exe118⤵PID:2140
-
\??\c:\9nttnh.exec:\9nttnh.exe119⤵PID:2276
-
\??\c:\5xfxxfl.exec:\5xfxxfl.exe120⤵PID:2224
-
\??\c:\rrlrfrl.exec:\rrlrfrl.exe121⤵PID:2184
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-