Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
30/09/2024, 16:31
Behavioral task
behavioral1
Sample
df1df6218f043ac582083466aab80427b01eb109a73fa9a8d39cd72ec45fcd1aN.exe
Resource
win7-20240729-en
windows7-x64
6 signatures
120 seconds
General
-
Target
df1df6218f043ac582083466aab80427b01eb109a73fa9a8d39cd72ec45fcd1aN.exe
-
Size
331KB
-
MD5
fa62cada574af3dac5880195e2de5af0
-
SHA1
79efe4e51cc196a35354b344f2e4b18760a0a1f2
-
SHA256
df1df6218f043ac582083466aab80427b01eb109a73fa9a8d39cd72ec45fcd1a
-
SHA512
ea1893612c9a26fe92eeb913170d9366ba46180f5386a661d11381e4edcb58ad9ee7c3036c5314ee9a963520c950fcf3379ec25e8830220838f6a02e7fe7d2cc
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeR:R4wFHoSHYHUrAwfMp3CDR
Malware Config
Signatures
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/2532-0-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/740-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2224-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2732-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2864-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2212-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2772-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1748-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3056-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2008-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1956-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2452-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1112-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3032-143-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2764-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1508-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1216-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1980-243-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2280-252-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2280-254-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2168-276-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1780-282-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2260-295-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2636-347-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2428-365-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1072-398-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1072-404-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1080-410-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2912-422-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2360-440-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2252-473-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/900-512-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/1104-535-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1580-556-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1040-644-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2872-681-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1132-708-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3020-8913-0x0000000077780000-0x000000007789F000-memory.dmp family_blackmoon behavioral1/memory/3020-10948-0x00000000778A0000-0x000000007799A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 740 hbttnb.exe 2224 jdjpv.exe 2732 9vvpj.exe 2864 xxfrflf.exe 2212 jjpvd.exe 2772 lfxflxl.exe 1748 hbnthn.exe 2700 jjdpd.exe 2652 bntntt.exe 3056 hhnhtb.exe 2008 fxrlxrx.exe 1956 lfrxlrf.exe 2452 vpjjp.exe 2132 rfrfrxr.exe 1112 djvpj.exe 3032 pppvj.exe 2764 nhthbh.exe 3028 rrlfrlx.exe 2388 bbbhnt.exe 1508 vvpvj.exe 1216 nhtbhh.exe 2432 hbnnnt.exe 2384 xlfflfl.exe 2404 bbhthh.exe 2044 5vvvp.exe 824 xxrxlrf.exe 1528 vjvvd.exe 1844 3lflrxf.exe 1980 hbthtn.exe 2280 1jpdj.exe 2364 hbthhn.exe 3012 5vjvd.exe 2168 hbhhtb.exe 1780 ddjpv.exe 2532 dvjjj.exe 2260 lfxxffr.exe 2316 1nhhhn.exe 2192 9bttnt.exe 2224 vpdvv.exe 2740 fxllrxf.exe 1504 tnbhnt.exe 2780 tthnhh.exe 2084 vvdvv.exe 2752 9fxffrr.exe 2636 9rlxffl.exe 2644 5hbhtt.exe 2276 3vdvp.exe 2428 jdjjp.exe 1940 5rrxxxx.exe 2008 nnhntb.exe 2536 vjjjj.exe 1956 dvjdp.exe 1340 frfrrll.exe 1320 ththnn.exe 1072 bnnttt.exe 1080 7vddp.exe 1632 lrxlffr.exe 2912 nhtbnt.exe 2764 vppjv.exe 2072 7vpvp.exe 2360 rlxrflr.exe 1440 1fxlllx.exe 1460 hbntbb.exe 2572 jdjjv.exe -
resource yara_rule behavioral1/memory/2532-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000120fd-8.dat upx behavioral1/memory/740-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/740-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/740-13-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x00070000000193f7-18.dat upx behavioral1/memory/2224-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000194c4-35.dat upx behavioral1/memory/2732-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001949e-28.dat upx behavioral1/files/0x00060000000194d2-43.dat upx behavioral1/memory/2864-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2864-42-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x00060000000194db-52.dat upx behavioral1/memory/2212-51-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2772-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000194e3-59.dat upx behavioral1/files/0x00080000000194e9-67.dat upx behavioral1/memory/1748-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000001958e-75.dat upx behavioral1/files/0x000500000001a41e-82.dat upx behavioral1/files/0x000500000001a427-89.dat upx behavioral1/memory/3056-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1956-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a42d-98.dat upx behavioral1/memory/2008-97-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a46f-107.dat upx behavioral1/memory/1956-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2452-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a48b-117.dat upx behavioral1/files/0x000500000001a48d-127.dat upx behavioral1/memory/1112-128-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a499-135.dat upx behavioral1/memory/3032-143-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a49a-142.dat upx behavioral1/memory/2764-150-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2764-152-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x003000000001939b-151.dat upx behavioral1/files/0x000500000001a4a9-159.dat upx behavioral1/files/0x000500000001a4af-167.dat upx behavioral1/files/0x000500000001a4b1-174.dat upx behavioral1/memory/1508-175-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1216-178-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4b3-184.dat upx behavioral1/files/0x000500000001a4b5-191.dat upx behavioral1/files/0x000500000001a4b7-199.dat upx behavioral1/files/0x000500000001a4b9-206.dat upx behavioral1/files/0x000500000001a4bb-214.dat upx behavioral1/files/0x000500000001a4bd-221.dat upx behavioral1/files/0x000500000001a4bf-229.dat upx behavioral1/files/0x000500000001a4c1-236.dat upx behavioral1/memory/1980-243-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4c3-245.dat upx behavioral1/files/0x000500000001a4c5-253.dat upx behavioral1/memory/2280-254-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4c7-263.dat upx behavioral1/memory/1780-282-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2260-295-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2316-296-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2636-341-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2636-347-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2276-356-0x00000000003C0000-0x00000000003E7000-memory.dmp upx behavioral1/memory/2428-365-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1072-398-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nthnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3httbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflffxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lflxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vjdj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2532 wrote to memory of 740 2532 df1df6218f043ac582083466aab80427b01eb109a73fa9a8d39cd72ec45fcd1aN.exe 29 PID 2532 wrote to memory of 740 2532 df1df6218f043ac582083466aab80427b01eb109a73fa9a8d39cd72ec45fcd1aN.exe 29 PID 2532 wrote to memory of 740 2532 df1df6218f043ac582083466aab80427b01eb109a73fa9a8d39cd72ec45fcd1aN.exe 29 PID 2532 wrote to memory of 740 2532 df1df6218f043ac582083466aab80427b01eb109a73fa9a8d39cd72ec45fcd1aN.exe 29 PID 740 wrote to memory of 2224 740 hbttnb.exe 30 PID 740 wrote to memory of 2224 740 hbttnb.exe 30 PID 740 wrote to memory of 2224 740 hbttnb.exe 30 PID 740 wrote to memory of 2224 740 hbttnb.exe 30 PID 2224 wrote to memory of 2732 2224 jdjpv.exe 31 PID 2224 wrote to memory of 2732 2224 jdjpv.exe 31 PID 2224 wrote to memory of 2732 2224 jdjpv.exe 31 PID 2224 wrote to memory of 2732 2224 jdjpv.exe 31 PID 2732 wrote to memory of 2864 2732 9vvpj.exe 32 PID 2732 wrote to memory of 2864 2732 9vvpj.exe 32 PID 2732 wrote to memory of 2864 2732 9vvpj.exe 32 PID 2732 wrote to memory of 2864 2732 9vvpj.exe 32 PID 2864 wrote to memory of 2212 2864 xxfrflf.exe 33 PID 2864 wrote to memory of 2212 2864 xxfrflf.exe 33 PID 2864 wrote to memory of 2212 2864 xxfrflf.exe 33 PID 2864 wrote to memory of 2212 2864 xxfrflf.exe 33 PID 2212 wrote to memory of 2772 2212 jjpvd.exe 34 PID 2212 wrote to memory of 2772 2212 jjpvd.exe 34 PID 2212 wrote to memory of 2772 2212 jjpvd.exe 34 PID 2212 wrote to memory of 2772 2212 jjpvd.exe 34 PID 2772 wrote to memory of 1748 2772 lfxflxl.exe 35 PID 2772 wrote to memory of 1748 2772 lfxflxl.exe 35 PID 2772 wrote to memory of 1748 2772 lfxflxl.exe 35 PID 2772 wrote to memory of 1748 2772 lfxflxl.exe 35 PID 1748 wrote to memory of 2700 1748 hbnthn.exe 36 PID 1748 wrote to memory of 2700 1748 hbnthn.exe 36 PID 1748 wrote to memory of 2700 1748 hbnthn.exe 36 PID 1748 wrote to memory of 2700 1748 hbnthn.exe 36 PID 2700 wrote to memory of 2652 2700 jjdpd.exe 37 PID 2700 wrote to memory of 2652 2700 jjdpd.exe 37 PID 2700 wrote to memory of 2652 2700 jjdpd.exe 37 PID 2700 wrote to memory of 2652 2700 jjdpd.exe 37 PID 2652 wrote to memory of 3056 2652 bntntt.exe 38 PID 2652 wrote to memory of 3056 2652 bntntt.exe 38 PID 2652 wrote to memory of 3056 2652 bntntt.exe 38 PID 2652 wrote to memory of 3056 2652 bntntt.exe 38 PID 3056 wrote to memory of 2008 3056 hhnhtb.exe 39 PID 3056 wrote to memory of 2008 3056 hhnhtb.exe 39 PID 3056 wrote to memory of 2008 3056 hhnhtb.exe 39 PID 3056 wrote to memory of 2008 3056 hhnhtb.exe 39 PID 2008 wrote to memory of 1956 2008 fxrlxrx.exe 40 PID 2008 wrote to memory of 1956 2008 fxrlxrx.exe 40 PID 2008 wrote to memory of 1956 2008 fxrlxrx.exe 40 PID 2008 wrote to memory of 1956 2008 fxrlxrx.exe 40 PID 1956 wrote to memory of 2452 1956 lfrxlrf.exe 41 PID 1956 wrote to memory of 2452 1956 lfrxlrf.exe 41 PID 1956 wrote to memory of 2452 1956 lfrxlrf.exe 41 PID 1956 wrote to memory of 2452 1956 lfrxlrf.exe 41 PID 2452 wrote to memory of 2132 2452 vpjjp.exe 42 PID 2452 wrote to memory of 2132 2452 vpjjp.exe 42 PID 2452 wrote to memory of 2132 2452 vpjjp.exe 42 PID 2452 wrote to memory of 2132 2452 vpjjp.exe 42 PID 2132 wrote to memory of 1112 2132 rfrfrxr.exe 43 PID 2132 wrote to memory of 1112 2132 rfrfrxr.exe 43 PID 2132 wrote to memory of 1112 2132 rfrfrxr.exe 43 PID 2132 wrote to memory of 1112 2132 rfrfrxr.exe 43 PID 1112 wrote to memory of 3032 1112 djvpj.exe 44 PID 1112 wrote to memory of 3032 1112 djvpj.exe 44 PID 1112 wrote to memory of 3032 1112 djvpj.exe 44 PID 1112 wrote to memory of 3032 1112 djvpj.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\df1df6218f043ac582083466aab80427b01eb109a73fa9a8d39cd72ec45fcd1aN.exe"C:\Users\Admin\AppData\Local\Temp\df1df6218f043ac582083466aab80427b01eb109a73fa9a8d39cd72ec45fcd1aN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\hbttnb.exec:\hbttnb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:740 -
\??\c:\jdjpv.exec:\jdjpv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\9vvpj.exec:\9vvpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\xxfrflf.exec:\xxfrflf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\jjpvd.exec:\jjpvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\lfxflxl.exec:\lfxflxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\hbnthn.exec:\hbnthn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\jjdpd.exec:\jjdpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\bntntt.exec:\bntntt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\hhnhtb.exec:\hhnhtb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\fxrlxrx.exec:\fxrlxrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\lfrxlrf.exec:\lfrxlrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\vpjjp.exec:\vpjjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\rfrfrxr.exec:\rfrfrxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\djvpj.exec:\djvpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
\??\c:\pppvj.exec:\pppvj.exe17⤵
- Executes dropped EXE
PID:3032 -
\??\c:\nhthbh.exec:\nhthbh.exe18⤵
- Executes dropped EXE
PID:2764 -
\??\c:\rrlfrlx.exec:\rrlfrlx.exe19⤵
- Executes dropped EXE
PID:3028 -
\??\c:\bbbhnt.exec:\bbbhnt.exe20⤵
- Executes dropped EXE
PID:2388 -
\??\c:\vvpvj.exec:\vvpvj.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1508 -
\??\c:\nhtbhh.exec:\nhtbhh.exe22⤵
- Executes dropped EXE
PID:1216 -
\??\c:\hbnnnt.exec:\hbnnnt.exe23⤵
- Executes dropped EXE
PID:2432 -
\??\c:\xlfflfl.exec:\xlfflfl.exe24⤵
- Executes dropped EXE
PID:2384 -
\??\c:\bbhthh.exec:\bbhthh.exe25⤵
- Executes dropped EXE
PID:2404 -
\??\c:\5vvvp.exec:\5vvvp.exe26⤵
- Executes dropped EXE
PID:2044 -
\??\c:\xxrxlrf.exec:\xxrxlrf.exe27⤵
- Executes dropped EXE
PID:824 -
\??\c:\vjvvd.exec:\vjvvd.exe28⤵
- Executes dropped EXE
PID:1528 -
\??\c:\3lflrxf.exec:\3lflrxf.exe29⤵
- Executes dropped EXE
PID:1844 -
\??\c:\hbthtn.exec:\hbthtn.exe30⤵
- Executes dropped EXE
PID:1980 -
\??\c:\1jpdj.exec:\1jpdj.exe31⤵
- Executes dropped EXE
PID:2280 -
\??\c:\hbthhn.exec:\hbthhn.exe32⤵
- Executes dropped EXE
PID:2364 -
\??\c:\5vjvd.exec:\5vjvd.exe33⤵
- Executes dropped EXE
PID:3012 -
\??\c:\hbhhtb.exec:\hbhhtb.exe34⤵
- Executes dropped EXE
PID:2168 -
\??\c:\ddjpv.exec:\ddjpv.exe35⤵
- Executes dropped EXE
PID:1780 -
\??\c:\dvjjj.exec:\dvjjj.exe36⤵
- Executes dropped EXE
PID:2532 -
\??\c:\lfxxffr.exec:\lfxxffr.exe37⤵
- Executes dropped EXE
PID:2260 -
\??\c:\1nhhhn.exec:\1nhhhn.exe38⤵
- Executes dropped EXE
PID:2316 -
\??\c:\9bttnt.exec:\9bttnt.exe39⤵
- Executes dropped EXE
PID:2192 -
\??\c:\vpdvv.exec:\vpdvv.exe40⤵
- Executes dropped EXE
PID:2224 -
\??\c:\fxllrxf.exec:\fxllrxf.exe41⤵
- Executes dropped EXE
PID:2740 -
\??\c:\tnbhnt.exec:\tnbhnt.exe42⤵
- Executes dropped EXE
PID:1504 -
\??\c:\tthnhh.exec:\tthnhh.exe43⤵
- Executes dropped EXE
PID:2780 -
\??\c:\vvdvv.exec:\vvdvv.exe44⤵
- Executes dropped EXE
PID:2084 -
\??\c:\9fxffrr.exec:\9fxffrr.exe45⤵
- Executes dropped EXE
PID:2752 -
\??\c:\9rlxffl.exec:\9rlxffl.exe46⤵
- Executes dropped EXE
PID:2636 -
\??\c:\5hbhtt.exec:\5hbhtt.exe47⤵
- Executes dropped EXE
PID:2644 -
\??\c:\3vdvp.exec:\3vdvp.exe48⤵
- Executes dropped EXE
PID:2276 -
\??\c:\jdjjp.exec:\jdjjp.exe49⤵
- Executes dropped EXE
PID:2428 -
\??\c:\5rrxxxx.exec:\5rrxxxx.exe50⤵
- Executes dropped EXE
PID:1940 -
\??\c:\nnhntb.exec:\nnhntb.exe51⤵
- Executes dropped EXE
PID:2008 -
\??\c:\vjjjj.exec:\vjjjj.exe52⤵
- Executes dropped EXE
PID:2536 -
\??\c:\dvjdp.exec:\dvjdp.exe53⤵
- Executes dropped EXE
PID:1956 -
\??\c:\frfrrll.exec:\frfrrll.exe54⤵
- Executes dropped EXE
PID:1340 -
\??\c:\ththnn.exec:\ththnn.exe55⤵
- Executes dropped EXE
PID:1320 -
\??\c:\bnnttt.exec:\bnnttt.exe56⤵
- Executes dropped EXE
PID:1072 -
\??\c:\7vddp.exec:\7vddp.exe57⤵
- Executes dropped EXE
PID:1080 -
\??\c:\lrxlffr.exec:\lrxlffr.exe58⤵
- Executes dropped EXE
PID:1632 -
\??\c:\nhtbnt.exec:\nhtbnt.exe59⤵
- Executes dropped EXE
PID:2912 -
\??\c:\vppjv.exec:\vppjv.exe60⤵
- Executes dropped EXE
PID:2764 -
\??\c:\7vpvp.exec:\7vpvp.exe61⤵
- Executes dropped EXE
PID:2072 -
\??\c:\rlxrflr.exec:\rlxrflr.exe62⤵
- Executes dropped EXE
PID:2360 -
\??\c:\1fxlllx.exec:\1fxlllx.exe63⤵
- Executes dropped EXE
PID:1440 -
\??\c:\hbntbb.exec:\hbntbb.exe64⤵
- Executes dropped EXE
PID:1460 -
\??\c:\jdjjv.exec:\jdjjv.exe65⤵
- Executes dropped EXE
PID:2572 -
\??\c:\jvppp.exec:\jvppp.exe66⤵PID:1732
-
\??\c:\lfrfxlx.exec:\lfrfxlx.exe67⤵PID:1784
-
\??\c:\7hhthn.exec:\7hhthn.exe68⤵PID:2252
-
\??\c:\jddvj.exec:\jddvj.exe69⤵PID:2468
-
\??\c:\3xrxffl.exec:\3xrxffl.exe70⤵PID:2044
-
\??\c:\xxrrflx.exec:\xxrrflx.exe71⤵PID:1540
-
\??\c:\bnbhtt.exec:\bnbhtt.exe72⤵PID:1896
-
\??\c:\dvjjv.exec:\dvjjv.exe73⤵PID:1268
-
\??\c:\ppjdj.exec:\ppjdj.exe74⤵PID:2004
-
\??\c:\xxxlrfl.exec:\xxxlrfl.exe75⤵PID:900
-
\??\c:\5fxlflr.exec:\5fxlflr.exe76⤵PID:3000
-
\??\c:\tnnhbt.exec:\tnnhbt.exe77⤵PID:852
-
\??\c:\3djjp.exec:\3djjp.exe78⤵PID:1848
-
\??\c:\3pvpv.exec:\3pvpv.exe79⤵PID:1104
-
\??\c:\9lrxxxr.exec:\9lrxxxr.exe80⤵PID:864
-
\??\c:\ththnt.exec:\ththnt.exe81⤵PID:2512
-
\??\c:\nnhnhn.exec:\nnhnhn.exe82⤵PID:1780
-
\??\c:\ppjpj.exec:\ppjpj.exe83⤵PID:1580
-
\??\c:\xxfllxr.exec:\xxfllxr.exe84⤵PID:2148
-
\??\c:\5fxfrfr.exec:\5fxfrfr.exe85⤵PID:2316
-
\??\c:\nhttbh.exec:\nhttbh.exe86⤵PID:2412
-
\??\c:\3dvpv.exec:\3dvpv.exe87⤵PID:2716
-
\??\c:\3jpjp.exec:\3jpjp.exe88⤵PID:2844
-
\??\c:\5fxxflx.exec:\5fxxflx.exe89⤵PID:2868
-
\??\c:\htbbhn.exec:\htbbhn.exe90⤵PID:2836
-
\??\c:\vpvvd.exec:\vpvvd.exe91⤵PID:2612
-
\??\c:\9djdd.exec:\9djdd.exe92⤵PID:2756
-
\??\c:\xrfxxrx.exec:\xrfxxrx.exe93⤵PID:2584
-
\??\c:\hnbbhb.exec:\hnbbhb.exe94⤵PID:2660
-
\??\c:\htnttt.exec:\htnttt.exe95⤵PID:2644
-
\??\c:\jjdjv.exec:\jjdjv.exe96⤵PID:3064
-
\??\c:\frlffll.exec:\frlffll.exe97⤵PID:2428
-
\??\c:\hbnnbt.exec:\hbnnbt.exe98⤵PID:2436
-
\??\c:\hhbhbh.exec:\hhbhbh.exe99⤵PID:1040
-
\??\c:\ddpvv.exec:\ddpvv.exe100⤵PID:1648
-
\??\c:\vvpdd.exec:\vvpdd.exe101⤵PID:2684
-
\??\c:\rlxrffl.exec:\rlxrffl.exe102⤵PID:2040
-
\??\c:\bnbbnt.exec:\bnbbnt.exe103⤵PID:1320
-
\??\c:\dvdvv.exec:\dvdvv.exe104⤵PID:2796
-
\??\c:\7pdjv.exec:\7pdjv.exe105⤵PID:2576
-
\??\c:\fxfflrx.exec:\fxfflrx.exe106⤵PID:2872
-
\??\c:\rrlrxlx.exec:\rrlrxlx.exe107⤵PID:2904
-
\??\c:\nhhhnn.exec:\nhhhnn.exe108⤵PID:2764
-
\??\c:\jjdvj.exec:\jjdvj.exe109⤵PID:3016
-
\??\c:\dvpdd.exec:\dvpdd.exe110⤵PID:1684
-
\??\c:\rlxrfrx.exec:\rlxrfrx.exe111⤵PID:1132
-
\??\c:\rrffrxl.exec:\rrffrxl.exe112⤵PID:2980
-
\??\c:\tnbthh.exec:\tnbthh.exe113⤵PID:1240
-
\??\c:\pjvjp.exec:\pjvjp.exe114⤵PID:2568
-
\??\c:\ddjjd.exec:\ddjjd.exe115⤵PID:2180
-
\??\c:\rrrfrfl.exec:\rrrfrfl.exe116⤵PID:1244
-
\??\c:\tthtnt.exec:\tthtnt.exe117⤵PID:2232
-
\??\c:\ttnnbh.exec:\ttnnbh.exe118⤵PID:2996
-
\??\c:\jdvjj.exec:\jdvjj.exe119⤵PID:2292
-
\??\c:\vvjvp.exec:\vvjvp.exe120⤵PID:2672
-
\??\c:\7rlxfrx.exec:\7rlxfrx.exe121⤵PID:2880
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-