Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29/09/2024, 23:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
760e36f111546b72c64c0b03a61ea79bc79861c62df2fbff68ff19a1d563f696N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
760e36f111546b72c64c0b03a61ea79bc79861c62df2fbff68ff19a1d563f696N.exe
-
Size
465KB
-
MD5
b338a24b1ed173de3b8a82036407eba0
-
SHA1
8b17a4757a2267fa7819547fc53742c912010265
-
SHA256
760e36f111546b72c64c0b03a61ea79bc79861c62df2fbff68ff19a1d563f696
-
SHA512
3027bdbc48f108194ba7f9f1fd8bf8cb98530a03a4c9c0f2277a5c19412a0f4698e821ef0a0cc649f60e7843948b731916b6583859f1d32ff8676d7cadfea925
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwT+aZKl7pg1c:q7Tc2NYHUrAwT+OKLSc
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral1/memory/2156-13-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2172-8-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2400-32-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2788-50-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2960-62-0x0000000001D20000-0x0000000001DE4000-memory.dmp family_blackmoon behavioral1/memory/2820-71-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/3068-107-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1812-147-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2868-165-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/352-204-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2644-256-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1148-314-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2736-381-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2016-428-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2412-452-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/3024-644-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/600-656-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/552-668-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2232-632-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2828-620-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2824-608-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1808-596-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1684-584-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1772-536-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2900-524-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1428-512-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2992-500-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1984-488-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1516-476-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1612-464-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2188-440-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2824-416-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1912-404-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1912-397-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1316-396-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2736-388-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/3068-380-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1916-372-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1916-371-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1916-366-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2604-364-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2820-355-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2820-348-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2432-347-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2756-338-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2756-332-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2780-330-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2780-323-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/268-322-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/268-315-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/3028-304-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/3028-297-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2368-294-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2436-284-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2436-278-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1312-265-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1704-247-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1704-242-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1956-238-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1612-223-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2916-220-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/352-210-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2120-200-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2120-192-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2156 rxrfrxr.exe 1772 flfrxfx.exe 2400 dvpvp.exe 860 rlfflrf.exe 2788 nhbbtb.exe 2960 jdjvj.exe 2820 xxxfllf.exe 2696 3nhnnt.exe 2564 vpdjv.exe 2728 rllrxlx.exe 3068 1nnbnn.exe 2736 1dvvj.exe 2000 9lxlxfl.exe 1912 5htbtb.exe 1812 xrrxxxr.exe 1744 tnhnbh.exe 2868 vpdvj.exe 2804 lrfxxrl.exe 2260 bttthh.exe 2120 xlxlffx.exe 352 bthhhh.exe 2916 vpvjj.exe 1612 xfxfxfr.exe 1956 9nhbbh.exe 1704 3ppvd.exe 2644 llflrxl.exe 1312 5pddv.exe 332 xrlrxlf.exe 2436 nbnhnt.exe 2368 ppjpj.exe 3028 1fflrxr.exe 1148 5nthnt.exe 268 ppjvd.exe 2780 rlfffxl.exe 2756 hnhtnh.exe 2432 vpdjv.exe 2820 3fxfxlx.exe 2604 nnbntb.exe 1916 7jvpd.exe 3068 xxxllrx.exe 2736 bbtthh.exe 1316 ppjpd.exe 1912 nhhntb.exe 2628 jvjjv.exe 2824 rlflllr.exe 1640 7nbtnb.exe 2016 bnbnht.exe 2912 djvdv.exe 2188 nbnhbn.exe 2720 jjdpj.exe 2412 xlfflrf.exe 448 thbbnt.exe 1612 ddvdj.exe 552 rlxxffl.exe 1516 1tnhtt.exe 904 3jpvd.exe 1984 fxxlrxl.exe 1948 nbttbh.exe 2992 7pvdd.exe 1504 lfflxxl.exe 1428 5htbtb.exe 2064 dpjjp.exe 2900 xxxflrx.exe 268 nhbhnt.exe -
resource yara_rule behavioral1/memory/2156-13-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2172-8-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2400-32-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2788-50-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2960-62-0x0000000001D20000-0x0000000001DE4000-memory.dmp upx behavioral1/memory/2820-71-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/3068-107-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1812-147-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2868-165-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/352-204-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2644-256-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1148-314-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2736-381-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2016-428-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2412-452-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/3024-644-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/600-656-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/552-668-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2232-632-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2828-620-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2824-608-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1808-596-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1772-536-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2900-524-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1428-512-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2992-500-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1984-488-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1516-476-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1612-464-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2188-440-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2824-416-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1912-404-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1912-397-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1316-396-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2736-388-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/3068-380-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1916-372-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1916-366-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2604-364-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2820-355-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2820-348-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2432-347-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2756-338-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2756-332-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2780-330-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/268-322-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/268-315-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/3028-304-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/3028-297-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2368-294-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2436-284-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2436-278-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1312-265-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1704-242-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1956-238-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1612-223-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2916-220-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/352-210-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2120-200-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2260-190-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2260-184-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2804-180-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2868-170-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1744-161-0x0000000000400000-0x00000000004C4000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffflffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bbbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xlxxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btntnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfllrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2172 wrote to memory of 2156 2172 760e36f111546b72c64c0b03a61ea79bc79861c62df2fbff68ff19a1d563f696N.exe 31 PID 2172 wrote to memory of 2156 2172 760e36f111546b72c64c0b03a61ea79bc79861c62df2fbff68ff19a1d563f696N.exe 31 PID 2172 wrote to memory of 2156 2172 760e36f111546b72c64c0b03a61ea79bc79861c62df2fbff68ff19a1d563f696N.exe 31 PID 2172 wrote to memory of 2156 2172 760e36f111546b72c64c0b03a61ea79bc79861c62df2fbff68ff19a1d563f696N.exe 31 PID 2156 wrote to memory of 1772 2156 rxrfrxr.exe 95 PID 2156 wrote to memory of 1772 2156 rxrfrxr.exe 95 PID 2156 wrote to memory of 1772 2156 rxrfrxr.exe 95 PID 2156 wrote to memory of 1772 2156 rxrfrxr.exe 95 PID 1772 wrote to memory of 2400 1772 flfrxfx.exe 33 PID 1772 wrote to memory of 2400 1772 flfrxfx.exe 33 PID 1772 wrote to memory of 2400 1772 flfrxfx.exe 33 PID 1772 wrote to memory of 2400 1772 flfrxfx.exe 33 PID 2400 wrote to memory of 860 2400 dvpvp.exe 34 PID 2400 wrote to memory of 860 2400 dvpvp.exe 34 PID 2400 wrote to memory of 860 2400 dvpvp.exe 34 PID 2400 wrote to memory of 860 2400 dvpvp.exe 34 PID 860 wrote to memory of 2788 860 rlfflrf.exe 35 PID 860 wrote to memory of 2788 860 rlfflrf.exe 35 PID 860 wrote to memory of 2788 860 rlfflrf.exe 35 PID 860 wrote to memory of 2788 860 rlfflrf.exe 35 PID 2788 wrote to memory of 2960 2788 nhbbtb.exe 36 PID 2788 wrote to memory of 2960 2788 nhbbtb.exe 36 PID 2788 wrote to memory of 2960 2788 nhbbtb.exe 36 PID 2788 wrote to memory of 2960 2788 nhbbtb.exe 36 PID 2960 wrote to memory of 2820 2960 jdjvj.exe 37 PID 2960 wrote to memory of 2820 2960 jdjvj.exe 37 PID 2960 wrote to memory of 2820 2960 jdjvj.exe 37 PID 2960 wrote to memory of 2820 2960 jdjvj.exe 37 PID 2820 wrote to memory of 2696 2820 xxxfllf.exe 38 PID 2820 wrote to memory of 2696 2820 xxxfllf.exe 38 PID 2820 wrote to memory of 2696 2820 xxxfllf.exe 38 PID 2820 wrote to memory of 2696 2820 xxxfllf.exe 38 PID 2696 wrote to memory of 2564 2696 3nhnnt.exe 39 PID 2696 wrote to memory of 2564 2696 3nhnnt.exe 39 PID 2696 wrote to memory of 2564 2696 3nhnnt.exe 39 PID 2696 wrote to memory of 2564 2696 3nhnnt.exe 39 PID 2564 wrote to memory of 2728 2564 vpdjv.exe 104 PID 2564 wrote to memory of 2728 2564 vpdjv.exe 104 PID 2564 wrote to memory of 2728 2564 vpdjv.exe 104 PID 2564 wrote to memory of 2728 2564 vpdjv.exe 104 PID 2728 wrote to memory of 3068 2728 rllrxlx.exe 41 PID 2728 wrote to memory of 3068 2728 rllrxlx.exe 41 PID 2728 wrote to memory of 3068 2728 rllrxlx.exe 41 PID 2728 wrote to memory of 3068 2728 rllrxlx.exe 41 PID 3068 wrote to memory of 2736 3068 1nnbnn.exe 42 PID 3068 wrote to memory of 2736 3068 1nnbnn.exe 42 PID 3068 wrote to memory of 2736 3068 1nnbnn.exe 42 PID 3068 wrote to memory of 2736 3068 1nnbnn.exe 42 PID 2736 wrote to memory of 2000 2736 1dvvj.exe 43 PID 2736 wrote to memory of 2000 2736 1dvvj.exe 43 PID 2736 wrote to memory of 2000 2736 1dvvj.exe 43 PID 2736 wrote to memory of 2000 2736 1dvvj.exe 43 PID 2000 wrote to memory of 1912 2000 9lxlxfl.exe 44 PID 2000 wrote to memory of 1912 2000 9lxlxfl.exe 44 PID 2000 wrote to memory of 1912 2000 9lxlxfl.exe 44 PID 2000 wrote to memory of 1912 2000 9lxlxfl.exe 44 PID 1912 wrote to memory of 1812 1912 5htbtb.exe 45 PID 1912 wrote to memory of 1812 1912 5htbtb.exe 45 PID 1912 wrote to memory of 1812 1912 5htbtb.exe 45 PID 1912 wrote to memory of 1812 1912 5htbtb.exe 45 PID 1812 wrote to memory of 1744 1812 xrrxxxr.exe 46 PID 1812 wrote to memory of 1744 1812 xrrxxxr.exe 46 PID 1812 wrote to memory of 1744 1812 xrrxxxr.exe 46 PID 1812 wrote to memory of 1744 1812 xrrxxxr.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\760e36f111546b72c64c0b03a61ea79bc79861c62df2fbff68ff19a1d563f696N.exe"C:\Users\Admin\AppData\Local\Temp\760e36f111546b72c64c0b03a61ea79bc79861c62df2fbff68ff19a1d563f696N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\rxrfrxr.exec:\rxrfrxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\flfrxfx.exec:\flfrxfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
\??\c:\dvpvp.exec:\dvpvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\rlfflrf.exec:\rlfflrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
\??\c:\nhbbtb.exec:\nhbbtb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\jdjvj.exec:\jdjvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\xxxfllf.exec:\xxxfllf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\3nhnnt.exec:\3nhnnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\vpdjv.exec:\vpdjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\rllrxlx.exec:\rllrxlx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\1nnbnn.exec:\1nnbnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\1dvvj.exec:\1dvvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\9lxlxfl.exec:\9lxlxfl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\5htbtb.exec:\5htbtb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\xrrxxxr.exec:\xrrxxxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\tnhnbh.exec:\tnhnbh.exe17⤵
- Executes dropped EXE
PID:1744 -
\??\c:\vpdvj.exec:\vpdvj.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2868 -
\??\c:\lrfxxrl.exec:\lrfxxrl.exe19⤵
- Executes dropped EXE
PID:2804 -
\??\c:\bttthh.exec:\bttthh.exe20⤵
- Executes dropped EXE
PID:2260 -
\??\c:\xlxlffx.exec:\xlxlffx.exe21⤵
- Executes dropped EXE
PID:2120 -
\??\c:\bthhhh.exec:\bthhhh.exe22⤵
- Executes dropped EXE
PID:352 -
\??\c:\vpvjj.exec:\vpvjj.exe23⤵
- Executes dropped EXE
PID:2916 -
\??\c:\xfxfxfr.exec:\xfxfxfr.exe24⤵
- Executes dropped EXE
PID:1612 -
\??\c:\9nhbbh.exec:\9nhbbh.exe25⤵
- Executes dropped EXE
PID:1956 -
\??\c:\3ppvd.exec:\3ppvd.exe26⤵
- Executes dropped EXE
PID:1704 -
\??\c:\llflrxl.exec:\llflrxl.exe27⤵
- Executes dropped EXE
PID:2644 -
\??\c:\5pddv.exec:\5pddv.exe28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1312 -
\??\c:\xrlrxlf.exec:\xrlrxlf.exe29⤵
- Executes dropped EXE
PID:332 -
\??\c:\nbnhnt.exec:\nbnhnt.exe30⤵
- Executes dropped EXE
PID:2436 -
\??\c:\ppjpj.exec:\ppjpj.exe31⤵
- Executes dropped EXE
PID:2368 -
\??\c:\1fflrxr.exec:\1fflrxr.exe32⤵
- Executes dropped EXE
PID:3028 -
\??\c:\5nthnt.exec:\5nthnt.exe33⤵
- Executes dropped EXE
PID:1148 -
\??\c:\ppjvd.exec:\ppjvd.exe34⤵
- Executes dropped EXE
PID:268 -
\??\c:\rlfffxl.exec:\rlfffxl.exe35⤵
- Executes dropped EXE
PID:2780 -
\??\c:\hnhtnh.exec:\hnhtnh.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2756 -
\??\c:\vpdjv.exec:\vpdjv.exe37⤵
- Executes dropped EXE
PID:2432 -
\??\c:\3fxfxlx.exec:\3fxfxlx.exe38⤵
- Executes dropped EXE
PID:2820 -
\??\c:\nnbntb.exec:\nnbntb.exe39⤵
- Executes dropped EXE
PID:2604 -
\??\c:\7jvpd.exec:\7jvpd.exe40⤵
- Executes dropped EXE
PID:1916 -
\??\c:\xxxllrx.exec:\xxxllrx.exe41⤵
- Executes dropped EXE
PID:3068 -
\??\c:\bbtthh.exec:\bbtthh.exe42⤵
- Executes dropped EXE
PID:2736 -
\??\c:\ppjpd.exec:\ppjpd.exe43⤵
- Executes dropped EXE
PID:1316 -
\??\c:\nhhntb.exec:\nhhntb.exe44⤵
- Executes dropped EXE
PID:1912 -
\??\c:\jvjjv.exec:\jvjjv.exe45⤵
- Executes dropped EXE
PID:2628 -
\??\c:\rlflllr.exec:\rlflllr.exe46⤵
- Executes dropped EXE
PID:2824 -
\??\c:\7nbtnb.exec:\7nbtnb.exe47⤵
- Executes dropped EXE
PID:1640 -
\??\c:\bnbnht.exec:\bnbnht.exe48⤵
- Executes dropped EXE
PID:2016 -
\??\c:\djvdv.exec:\djvdv.exe49⤵
- Executes dropped EXE
PID:2912 -
\??\c:\nbnhbn.exec:\nbnhbn.exe50⤵
- Executes dropped EXE
PID:2188 -
\??\c:\jjdpj.exec:\jjdpj.exe51⤵
- Executes dropped EXE
PID:2720 -
\??\c:\xlfflrf.exec:\xlfflrf.exe52⤵
- Executes dropped EXE
PID:2412 -
\??\c:\thbbnt.exec:\thbbnt.exe53⤵
- Executes dropped EXE
PID:448 -
\??\c:\ddvdj.exec:\ddvdj.exe54⤵
- Executes dropped EXE
PID:1612 -
\??\c:\rlxxffl.exec:\rlxxffl.exe55⤵
- Executes dropped EXE
PID:552 -
\??\c:\1tnhtt.exec:\1tnhtt.exe56⤵
- Executes dropped EXE
PID:1516 -
\??\c:\3jpvd.exec:\3jpvd.exe57⤵
- Executes dropped EXE
PID:904 -
\??\c:\fxxlrxl.exec:\fxxlrxl.exe58⤵
- Executes dropped EXE
PID:1984 -
\??\c:\nbttbh.exec:\nbttbh.exe59⤵
- Executes dropped EXE
PID:1948 -
\??\c:\7pvdd.exec:\7pvdd.exe60⤵
- Executes dropped EXE
PID:2992 -
\??\c:\lfflxxl.exec:\lfflxxl.exe61⤵
- Executes dropped EXE
PID:1504 -
\??\c:\5htbtb.exec:\5htbtb.exe62⤵
- Executes dropped EXE
PID:1428 -
\??\c:\dpjjp.exec:\dpjjp.exe63⤵
- Executes dropped EXE
PID:2064 -
\??\c:\xxxflrx.exec:\xxxflrx.exe64⤵
- Executes dropped EXE
PID:2900 -
\??\c:\nhbhnt.exec:\nhbhnt.exe65⤵
- Executes dropped EXE
PID:268 -
\??\c:\3pjpv.exec:\3pjpv.exe66⤵PID:1772
-
\??\c:\3fxlrlr.exec:\3fxlrlr.exe67⤵PID:2264
-
\??\c:\nbttbb.exec:\nbttbb.exe68⤵PID:2216
-
\??\c:\vdvvd.exec:\vdvvd.exe69⤵PID:3052
-
\??\c:\hthnhn.exec:\hthnhn.exe70⤵PID:2788
-
\??\c:\5tbhtt.exec:\5tbhtt.exe71⤵PID:1072
-
\??\c:\vjddp.exec:\vjddp.exe72⤵PID:2872
-
\??\c:\5rrrxxl.exec:\5rrrxxl.exe73⤵PID:2592
-
\??\c:\1thbhn.exec:\1thbhn.exe74⤵PID:1684
-
\??\c:\djvdv.exec:\djvdv.exe75⤵PID:2728
-
\??\c:\1lrxflr.exec:\1lrxflr.exe76⤵PID:1808
-
\??\c:\thttbb.exec:\thttbb.exe77⤵PID:2676
-
\??\c:\5dpjj.exec:\5dpjj.exe78⤵PID:2824
-
\??\c:\xrllxxl.exec:\xrllxxl.exe79⤵PID:2584
-
\??\c:\xrfrxll.exec:\xrfrxll.exe80⤵PID:2828
-
\??\c:\3btntb.exec:\3btntb.exe81⤵PID:1972
-
\??\c:\dvjpd.exec:\dvjpd.exe82⤵PID:2232
-
\??\c:\llxfxxf.exec:\llxfxxf.exe83⤵PID:1700
-
\??\c:\thtbhh.exec:\thtbhh.exe84⤵PID:3024
-
\??\c:\vpjpv.exec:\vpjpv.exe85⤵PID:2412
-
\??\c:\5fxfflx.exec:\5fxfflx.exe86⤵PID:600
-
\??\c:\htnnbb.exec:\htnnbb.exe87⤵PID:1612
-
\??\c:\ppdjp.exec:\ppdjp.exe88⤵PID:552
-
\??\c:\xrflxff.exec:\xrflxff.exe89⤵PID:1320
-
\??\c:\7hbhth.exec:\7hbhth.exe90⤵PID:2092
-
\??\c:\fxllxxf.exec:\fxllxxf.exe91⤵PID:1968
-
\??\c:\lxrrxxf.exec:\lxrrxxf.exe92⤵PID:1592
-
\??\c:\rrxxlrr.exec:\rrxxlrr.exe93⤵PID:2680
-
\??\c:\5jvvj.exec:\5jvvj.exe94⤵PID:2484
-
\??\c:\rrrxlff.exec:\rrrxlff.exe95⤵PID:1856
-
\??\c:\rrlrrrx.exec:\rrlrrrx.exe96⤵PID:1988
-
\??\c:\tnhntb.exec:\tnhntb.exe97⤵PID:3028
-
\??\c:\ffxxllx.exec:\ffxxllx.exe98⤵PID:3060
-
\??\c:\nhbhbb.exec:\nhbhbb.exe99⤵PID:1756
-
\??\c:\llxflrf.exec:\llxflrf.exe100⤵PID:2744
-
\??\c:\5jvjd.exec:\5jvjd.exe101⤵PID:1424
-
\??\c:\7xlrrxf.exec:\7xlrrxf.exe102⤵PID:2392
-
\??\c:\bbbnth.exec:\bbbnth.exe103⤵PID:1156
-
\??\c:\vjpvj.exec:\vjpvj.exe104⤵PID:2256
-
\??\c:\tnhhbb.exec:\tnhhbb.exe105⤵
- System Location Discovery: System Language Discovery
PID:3052 -
\??\c:\jdvvj.exec:\jdvvj.exe106⤵PID:620
-
\??\c:\1pjjj.exec:\1pjjj.exe107⤵PID:2168
-
\??\c:\llfrflx.exec:\llfrflx.exe108⤵PID:636
-
\??\c:\tnhhtb.exec:\tnhhtb.exe109⤵PID:3008
-
\??\c:\1pddj.exec:\1pddj.exe110⤵PID:1604
-
\??\c:\xxrfxfl.exec:\xxrfxfl.exe111⤵PID:1916
-
\??\c:\tbthbh.exec:\tbthbh.exe112⤵PID:2844
-
\??\c:\vpjjp.exec:\vpjjp.exe113⤵PID:2672
-
\??\c:\vvvdj.exec:\vvvdj.exe114⤵PID:2556
-
\??\c:\xrlrflx.exec:\xrlrflx.exe115⤵PID:3056
-
\??\c:\hbntbb.exec:\hbntbb.exe116⤵PID:808
-
\??\c:\hbnthh.exec:\hbnthh.exe117⤵PID:2752
-
\??\c:\jpdjv.exec:\jpdjv.exe118⤵PID:1548
-
\??\c:\xxxrflr.exec:\xxxrflr.exe119⤵PID:2768
-
\??\c:\pjvdj.exec:\pjvdj.exe120⤵PID:1852
-
\??\c:\7flxxrr.exec:\7flxxrr.exe121⤵PID:304
-
\??\c:\nnhhtn.exec:\nnhhtn.exe122⤵PID:1352
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-