Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05-10-2024 23:35
Behavioral task
behavioral1
Sample
863635bcc114b61385065bcf9d5c23d886db181056b32b2804ed7ecb8ffe72e0.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
General
-
Target
863635bcc114b61385065bcf9d5c23d886db181056b32b2804ed7ecb8ffe72e0.exe
-
Size
248KB
-
MD5
c8872e0300df5927add0bb1848f3fc87
-
SHA1
7384ddad5c342c8d2563965da08ca04e9628cdcb
-
SHA256
863635bcc114b61385065bcf9d5c23d886db181056b32b2804ed7ecb8ffe72e0
-
SHA512
48a710c20cfdd0af87451ff7e20eb3b3736af7610ff1c2b9cc956da608500e63ab6de25d44620e5a4c6c873a22ee37fc906d8bd8f40be508923f9d2aca41afcc
-
SSDEEP
3072:chOmTsF93UYfwC6GIoutieyhC2lbgGi5yLpcgDE4JBuItR8pTsgZ9WT4iaz+6u:ccm4FmowdHoSi9EIBftapTs4WZazm
Malware Config
Signatures
-
Detect Blackmoon payload 56 IoCs
resource yara_rule behavioral1/memory/2336-9-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1976-17-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1548-28-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2428-46-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2996-54-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2196-66-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/3024-81-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2532-83-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2532-90-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/2572-104-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2772-101-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2572-106-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/1180-122-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1180-124-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/1652-146-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2456-155-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/1032-177-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1256-174-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2824-192-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2948-194-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1436-212-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1712-235-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2060-253-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2200-262-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/2200-264-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1832-296-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/1264-322-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/3000-323-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2688-336-0x0000000000440000-0x0000000000476000-memory.dmp family_blackmoon behavioral1/memory/2664-350-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2796-358-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2628-391-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/1840-424-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1620-428-0x00000000002D0000-0x0000000000306000-memory.dmp family_blackmoon behavioral1/memory/1732-444-0x0000000000440000-0x0000000000476000-memory.dmp family_blackmoon behavioral1/memory/1032-465-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1896-472-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/2020-485-0x0000000000230000-0x0000000000266000-memory.dmp family_blackmoon behavioral1/memory/380-488-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/1908-513-0x00000000002A0000-0x00000000002D6000-memory.dmp family_blackmoon behavioral1/memory/2176-526-0x00000000001B0000-0x00000000001E6000-memory.dmp family_blackmoon behavioral1/memory/772-546-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2080-555-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/1516-578-0x0000000001B70000-0x0000000001BA6000-memory.dmp family_blackmoon behavioral1/memory/1780-579-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2924-639-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2532-646-0x00000000002B0000-0x00000000002E6000-memory.dmp family_blackmoon behavioral1/memory/2252-666-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/336-770-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2540-926-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1196-996-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/1032-1003-0x00000000003C0000-0x00000000003F6000-memory.dmp family_blackmoon behavioral1/memory/1032-1008-0x00000000003C0000-0x00000000003F6000-memory.dmp family_blackmoon behavioral1/memory/1344-1015-0x00000000005D0000-0x0000000000606000-memory.dmp family_blackmoon behavioral1/memory/380-1034-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/2592-1065-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1976 pppdp.exe 1548 3lxxxfl.exe 2120 5frrrxl.exe 2428 vvpvd.exe 2996 xrlrffr.exe 2748 hbtbth.exe 2196 vjvvp.exe 3024 lfffrrf.exe 2532 bnbhnn.exe 2772 9thhnn.exe 2572 xxrrlrx.exe 2332 rlllrrf.exe 1180 jdpvp.exe 1360 3vpdp.exe 1652 thnntn.exe 2456 3nnnbt.exe 2284 llxlrfr.exe 1256 xlfflrl.exe 1032 ttthht.exe 2824 1vpvd.exe 2948 frflllx.exe 380 btnnbb.exe 1436 jdppd.exe 408 7xlrlxf.exe 1712 nnbbnh.exe 1208 hhbthn.exe 2060 vppvj.exe 2200 tnbnnt.exe 1832 dvjdv.exe 1136 vpddp.exe 2144 fxfxrff.exe 2336 bthntb.exe 2920 jvvjp.exe 2400 lxllxfr.exe 2972 lfxxlxf.exe 1264 5tnbtb.exe 3000 ppjpv.exe 2688 7ddjd.exe 2996 lfflrxf.exe 2664 3rlfrfr.exe 2796 ttnnth.exe 2780 ppjpp.exe 2852 7pdjj.exe 2564 fxrxffl.exe 2672 nnthtb.exe 2628 btthhn.exe 2960 7ddvv.exe 1120 llflflx.exe 1744 3rllxxf.exe 1140 3ntbbh.exe 1840 jvdjp.exe 1620 1pdjp.exe 1244 xrxfflr.exe 1732 tbnnbt.exe 1896 hhttnt.exe 1196 5djjd.exe 1032 pjppp.exe 2908 lxffrxf.exe 2724 1nttbb.exe 2020 nhnntn.exe 380 jpvpp.exe 920 dpjpd.exe 2176 5fxlxfr.exe 1908 3thtbh.exe -
resource yara_rule behavioral1/memory/2336-0-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0009000000012117-7.dat upx behavioral1/memory/2336-9-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x000700000001878c-19.dat upx behavioral1/memory/1976-17-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1548-26-0x0000000000220000-0x0000000000256000-memory.dmp upx behavioral1/memory/2120-29-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1548-28-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0008000000018bf3-27.dat upx behavioral1/files/0x000700000001922c-37.dat upx behavioral1/files/0x0006000000019261-45.dat upx behavioral1/memory/2428-46-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x000600000001926a-55.dat upx behavioral1/memory/2996-54-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000019279-63.dat upx behavioral1/memory/2196-66-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x00080000000192a9-72.dat upx behavioral1/memory/3024-81-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x00050000000194fc-80.dat upx behavioral1/memory/2532-83-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0005000000019506-91.dat upx behavioral1/memory/2772-99-0x00000000003C0000-0x00000000003F6000-memory.dmp upx behavioral1/files/0x000500000001952f-100.dat upx behavioral1/memory/2572-104-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2772-101-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x000500000001957e-111.dat upx behavioral1/files/0x00050000000195a7-119.dat upx behavioral1/memory/1180-122-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x00050000000195e6-128.dat upx behavioral1/files/0x000500000001961d-137.dat upx behavioral1/files/0x000500000001961f-145.dat upx behavioral1/memory/2456-147-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1652-146-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0005000000019621-156.dat upx behavioral1/memory/2456-155-0x0000000000220000-0x0000000000256000-memory.dmp upx behavioral1/files/0x0005000000019622-164.dat upx behavioral1/files/0x0005000000019623-173.dat upx behavioral1/memory/1032-177-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1256-174-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0005000000019625-183.dat upx behavioral1/files/0x0005000000019627-191.dat upx behavioral1/memory/2824-192-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2948-194-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0005000000019629-201.dat upx behavioral1/files/0x000500000001962b-210.dat upx behavioral1/memory/1436-212-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x000500000001963b-219.dat upx behavioral1/files/0x0007000000018731-227.dat upx behavioral1/memory/1712-235-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x000500000001967f-237.dat upx behavioral1/files/0x00050000000196c0-245.dat upx behavioral1/files/0x000500000001970b-254.dat upx behavioral1/memory/2060-253-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x00050000000199b9-263.dat upx behavioral1/memory/2200-264-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0005000000019c54-272.dat upx behavioral1/files/0x0005000000019c56-280.dat upx behavioral1/files/0x0005000000019c58-288.dat upx behavioral1/memory/2920-297-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1264-322-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/3000-323-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2664-350-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2796-358-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1120-404-0x0000000000220000-0x0000000000256000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rlfrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlllfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxllxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2336 wrote to memory of 1976 2336 863635bcc114b61385065bcf9d5c23d886db181056b32b2804ed7ecb8ffe72e0.exe 30 PID 2336 wrote to memory of 1976 2336 863635bcc114b61385065bcf9d5c23d886db181056b32b2804ed7ecb8ffe72e0.exe 30 PID 2336 wrote to memory of 1976 2336 863635bcc114b61385065bcf9d5c23d886db181056b32b2804ed7ecb8ffe72e0.exe 30 PID 2336 wrote to memory of 1976 2336 863635bcc114b61385065bcf9d5c23d886db181056b32b2804ed7ecb8ffe72e0.exe 30 PID 1976 wrote to memory of 1548 1976 pppdp.exe 31 PID 1976 wrote to memory of 1548 1976 pppdp.exe 31 PID 1976 wrote to memory of 1548 1976 pppdp.exe 31 PID 1976 wrote to memory of 1548 1976 pppdp.exe 31 PID 1548 wrote to memory of 2120 1548 3lxxxfl.exe 32 PID 1548 wrote to memory of 2120 1548 3lxxxfl.exe 32 PID 1548 wrote to memory of 2120 1548 3lxxxfl.exe 32 PID 1548 wrote to memory of 2120 1548 3lxxxfl.exe 32 PID 2120 wrote to memory of 2428 2120 5frrrxl.exe 33 PID 2120 wrote to memory of 2428 2120 5frrrxl.exe 33 PID 2120 wrote to memory of 2428 2120 5frrrxl.exe 33 PID 2120 wrote to memory of 2428 2120 5frrrxl.exe 33 PID 2428 wrote to memory of 2996 2428 vvpvd.exe 34 PID 2428 wrote to memory of 2996 2428 vvpvd.exe 34 PID 2428 wrote to memory of 2996 2428 vvpvd.exe 34 PID 2428 wrote to memory of 2996 2428 vvpvd.exe 34 PID 2996 wrote to memory of 2748 2996 xrlrffr.exe 35 PID 2996 wrote to memory of 2748 2996 xrlrffr.exe 35 PID 2996 wrote to memory of 2748 2996 xrlrffr.exe 35 PID 2996 wrote to memory of 2748 2996 xrlrffr.exe 35 PID 2748 wrote to memory of 2196 2748 hbtbth.exe 36 PID 2748 wrote to memory of 2196 2748 hbtbth.exe 36 PID 2748 wrote to memory of 2196 2748 hbtbth.exe 36 PID 2748 wrote to memory of 2196 2748 hbtbth.exe 36 PID 2196 wrote to memory of 3024 2196 vjvvp.exe 37 PID 2196 wrote to memory of 3024 2196 vjvvp.exe 37 PID 2196 wrote to memory of 3024 2196 vjvvp.exe 37 PID 2196 wrote to memory of 3024 2196 vjvvp.exe 37 PID 3024 wrote to memory of 2532 3024 lfffrrf.exe 38 PID 3024 wrote to memory of 2532 3024 lfffrrf.exe 38 PID 3024 wrote to memory of 2532 3024 lfffrrf.exe 38 PID 3024 wrote to memory of 2532 3024 lfffrrf.exe 38 PID 2532 wrote to memory of 2772 2532 bnbhnn.exe 39 PID 2532 wrote to memory of 2772 2532 bnbhnn.exe 39 PID 2532 wrote to memory of 2772 2532 bnbhnn.exe 39 PID 2532 wrote to memory of 2772 2532 bnbhnn.exe 39 PID 2772 wrote to memory of 2572 2772 9thhnn.exe 40 PID 2772 wrote to memory of 2572 2772 9thhnn.exe 40 PID 2772 wrote to memory of 2572 2772 9thhnn.exe 40 PID 2772 wrote to memory of 2572 2772 9thhnn.exe 40 PID 2572 wrote to memory of 2332 2572 xxrrlrx.exe 41 PID 2572 wrote to memory of 2332 2572 xxrrlrx.exe 41 PID 2572 wrote to memory of 2332 2572 xxrrlrx.exe 41 PID 2572 wrote to memory of 2332 2572 xxrrlrx.exe 41 PID 2332 wrote to memory of 1180 2332 rlllrrf.exe 42 PID 2332 wrote to memory of 1180 2332 rlllrrf.exe 42 PID 2332 wrote to memory of 1180 2332 rlllrrf.exe 42 PID 2332 wrote to memory of 1180 2332 rlllrrf.exe 42 PID 1180 wrote to memory of 1360 1180 jdpvp.exe 43 PID 1180 wrote to memory of 1360 1180 jdpvp.exe 43 PID 1180 wrote to memory of 1360 1180 jdpvp.exe 43 PID 1180 wrote to memory of 1360 1180 jdpvp.exe 43 PID 1360 wrote to memory of 1652 1360 3vpdp.exe 44 PID 1360 wrote to memory of 1652 1360 3vpdp.exe 44 PID 1360 wrote to memory of 1652 1360 3vpdp.exe 44 PID 1360 wrote to memory of 1652 1360 3vpdp.exe 44 PID 1652 wrote to memory of 2456 1652 thnntn.exe 45 PID 1652 wrote to memory of 2456 1652 thnntn.exe 45 PID 1652 wrote to memory of 2456 1652 thnntn.exe 45 PID 1652 wrote to memory of 2456 1652 thnntn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\863635bcc114b61385065bcf9d5c23d886db181056b32b2804ed7ecb8ffe72e0.exe"C:\Users\Admin\AppData\Local\Temp\863635bcc114b61385065bcf9d5c23d886db181056b32b2804ed7ecb8ffe72e0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\pppdp.exec:\pppdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\3lxxxfl.exec:\3lxxxfl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\5frrrxl.exec:\5frrrxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\vvpvd.exec:\vvpvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\xrlrffr.exec:\xrlrffr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\hbtbth.exec:\hbtbth.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\vjvvp.exec:\vjvvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\lfffrrf.exec:\lfffrrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\bnbhnn.exec:\bnbhnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\9thhnn.exec:\9thhnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\xxrrlrx.exec:\xxrrlrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\rlllrrf.exec:\rlllrrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\jdpvp.exec:\jdpvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
\??\c:\3vpdp.exec:\3vpdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
\??\c:\thnntn.exec:\thnntn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\3nnnbt.exec:\3nnnbt.exe17⤵
- Executes dropped EXE
PID:2456 -
\??\c:\llxlrfr.exec:\llxlrfr.exe18⤵
- Executes dropped EXE
PID:2284 -
\??\c:\xlfflrl.exec:\xlfflrl.exe19⤵
- Executes dropped EXE
PID:1256 -
\??\c:\ttthht.exec:\ttthht.exe20⤵
- Executes dropped EXE
PID:1032 -
\??\c:\1vpvd.exec:\1vpvd.exe21⤵
- Executes dropped EXE
PID:2824 -
\??\c:\frflllx.exec:\frflllx.exe22⤵
- Executes dropped EXE
PID:2948 -
\??\c:\btnnbb.exec:\btnnbb.exe23⤵
- Executes dropped EXE
PID:380 -
\??\c:\jdppd.exec:\jdppd.exe24⤵
- Executes dropped EXE
PID:1436 -
\??\c:\7xlrlxf.exec:\7xlrlxf.exe25⤵
- Executes dropped EXE
PID:408 -
\??\c:\nnbbnh.exec:\nnbbnh.exe26⤵
- Executes dropped EXE
PID:1712 -
\??\c:\hhbthn.exec:\hhbthn.exe27⤵
- Executes dropped EXE
PID:1208 -
\??\c:\vppvj.exec:\vppvj.exe28⤵
- Executes dropped EXE
PID:2060 -
\??\c:\tnbnnt.exec:\tnbnnt.exe29⤵
- Executes dropped EXE
PID:2200 -
\??\c:\dvjdv.exec:\dvjdv.exe30⤵
- Executes dropped EXE
PID:1832 -
\??\c:\vpddp.exec:\vpddp.exe31⤵
- Executes dropped EXE
PID:1136 -
\??\c:\fxfxrff.exec:\fxfxrff.exe32⤵
- Executes dropped EXE
PID:2144 -
\??\c:\bthntb.exec:\bthntb.exe33⤵
- Executes dropped EXE
PID:2336 -
\??\c:\jvvjp.exec:\jvvjp.exe34⤵
- Executes dropped EXE
PID:2920 -
\??\c:\lxllxfr.exec:\lxllxfr.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2400 -
\??\c:\lfxxlxf.exec:\lfxxlxf.exe36⤵
- Executes dropped EXE
PID:2972 -
\??\c:\5tnbtb.exec:\5tnbtb.exe37⤵
- Executes dropped EXE
PID:1264 -
\??\c:\ppjpv.exec:\ppjpv.exe38⤵
- Executes dropped EXE
PID:3000 -
\??\c:\7ddjd.exec:\7ddjd.exe39⤵
- Executes dropped EXE
PID:2688 -
\??\c:\lfflrxf.exec:\lfflrxf.exe40⤵
- Executes dropped EXE
PID:2996 -
\??\c:\3rlfrfr.exec:\3rlfrfr.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2664 -
\??\c:\ttnnth.exec:\ttnnth.exe42⤵
- Executes dropped EXE
PID:2796 -
\??\c:\ppjpp.exec:\ppjpp.exe43⤵
- Executes dropped EXE
PID:2780 -
\??\c:\7pdjj.exec:\7pdjj.exe44⤵
- Executes dropped EXE
PID:2852 -
\??\c:\fxrxffl.exec:\fxrxffl.exe45⤵
- Executes dropped EXE
PID:2564 -
\??\c:\nnthtb.exec:\nnthtb.exe46⤵
- Executes dropped EXE
PID:2672 -
\??\c:\btthhn.exec:\btthhn.exe47⤵
- Executes dropped EXE
PID:2628 -
\??\c:\7ddvv.exec:\7ddvv.exe48⤵
- Executes dropped EXE
PID:2960 -
\??\c:\llflflx.exec:\llflflx.exe49⤵
- Executes dropped EXE
PID:1120 -
\??\c:\3rllxxf.exec:\3rllxxf.exe50⤵
- Executes dropped EXE
PID:1744 -
\??\c:\3ntbbh.exec:\3ntbbh.exe51⤵
- Executes dropped EXE
PID:1140 -
\??\c:\jvdjp.exec:\jvdjp.exe52⤵
- Executes dropped EXE
PID:1840 -
\??\c:\1pdjp.exec:\1pdjp.exe53⤵
- Executes dropped EXE
PID:1620 -
\??\c:\xrxfflr.exec:\xrxfflr.exe54⤵
- Executes dropped EXE
PID:1244 -
\??\c:\tbnnbt.exec:\tbnnbt.exe55⤵
- Executes dropped EXE
PID:1732 -
\??\c:\hhttnt.exec:\hhttnt.exe56⤵
- Executes dropped EXE
PID:1896 -
\??\c:\5djjd.exec:\5djjd.exe57⤵
- Executes dropped EXE
PID:1196 -
\??\c:\pjppp.exec:\pjppp.exe58⤵
- Executes dropped EXE
PID:1032 -
\??\c:\lxffrxf.exec:\lxffrxf.exe59⤵
- Executes dropped EXE
PID:2908 -
\??\c:\1nttbb.exec:\1nttbb.exe60⤵
- Executes dropped EXE
PID:2724 -
\??\c:\nhnntn.exec:\nhnntn.exe61⤵
- Executes dropped EXE
PID:2020 -
\??\c:\jpvpp.exec:\jpvpp.exe62⤵
- Executes dropped EXE
PID:380 -
\??\c:\dpjpd.exec:\dpjpd.exe63⤵
- Executes dropped EXE
PID:920 -
\??\c:\5fxlxfr.exec:\5fxlxfr.exe64⤵
- Executes dropped EXE
PID:2176 -
\??\c:\3thtbh.exec:\3thtbh.exe65⤵
- Executes dropped EXE
PID:1908 -
\??\c:\1thbnh.exec:\1thbnh.exe66⤵PID:108
-
\??\c:\vpvvv.exec:\vpvvv.exe67⤵PID:1692
-
\??\c:\9dvpp.exec:\9dvpp.exe68⤵PID:1600
-
\??\c:\xrlrxrr.exec:\xrlrxrr.exe69⤵PID:880
-
\??\c:\htbhtt.exec:\htbhtt.exe70⤵PID:772
-
\??\c:\hbhhhh.exec:\hbhhhh.exe71⤵PID:2436
-
\??\c:\7pvpp.exec:\7pvpp.exe72⤵PID:2080
-
\??\c:\jvdvd.exec:\jvdvd.exe73⤵PID:2144
-
\??\c:\lxllxxx.exec:\lxllxxx.exe74⤵PID:352
-
\??\c:\ththhn.exec:\ththhn.exe75⤵PID:1516
-
\??\c:\bbnnbt.exec:\bbnnbt.exe76⤵PID:1780
-
\??\c:\9pppv.exec:\9pppv.exe77⤵PID:1848
-
\??\c:\jvpvj.exec:\jvpvj.exe78⤵PID:2788
-
\??\c:\rfrrxfl.exec:\rfrrxfl.exe79⤵PID:2056
-
\??\c:\hthbhh.exec:\hthbhh.exe80⤵PID:3068
-
\??\c:\bthntt.exec:\bthntt.exe81⤵PID:2656
-
\??\c:\dppjj.exec:\dppjj.exe82⤵PID:2760
-
\??\c:\pjddj.exec:\pjddj.exe83⤵PID:2516
-
\??\c:\9lfrxlx.exec:\9lfrxlx.exe84⤵PID:2924
-
\??\c:\bnbhbb.exec:\bnbhbb.exe85⤵PID:2532
-
\??\c:\btnhnn.exec:\btnhnn.exe86⤵
- System Location Discovery: System Language Discovery
PID:2620 -
\??\c:\vjjpd.exec:\vjjpd.exe87⤵PID:2772
-
\??\c:\jpdpp.exec:\jpdpp.exe88⤵PID:2252
-
\??\c:\fxllrrl.exec:\fxllrrl.exe89⤵PID:680
-
\??\c:\nbnttn.exec:\nbnttn.exe90⤵PID:2332
-
\??\c:\ttnnbh.exec:\ttnnbh.exe91⤵PID:1352
-
\??\c:\7jvpp.exec:\7jvpp.exe92⤵PID:1956
-
\??\c:\jvpvv.exec:\jvpvv.exe93⤵PID:2288
-
\??\c:\ffrrffr.exec:\ffrrffr.exe94⤵PID:1232
-
\??\c:\frfxfff.exec:\frfxfff.exe95⤵PID:1620
-
\??\c:\7thtbh.exec:\7thtbh.exe96⤵PID:2284
-
\??\c:\jdpvd.exec:\jdpvd.exe97⤵PID:1732
-
\??\c:\5jpjd.exec:\5jpjd.exe98⤵PID:1896
-
\??\c:\3lxfffr.exec:\3lxfffr.exe99⤵PID:1720
-
\??\c:\3lxfxxx.exec:\3lxfxxx.exe100⤵PID:2812
-
\??\c:\tnttbt.exec:\tnttbt.exe101⤵PID:2728
-
\??\c:\pdvvp.exec:\pdvvp.exe102⤵PID:1772
-
\??\c:\jdpdj.exec:\jdpdj.exe103⤵PID:1392
-
\??\c:\frllxff.exec:\frllxff.exe104⤵PID:2716
-
\??\c:\rllxxrf.exec:\rllxxrf.exe105⤵PID:336
-
\??\c:\bntttn.exec:\bntttn.exe106⤵PID:408
-
\??\c:\thhntt.exec:\thhntt.exe107⤵PID:236
-
\??\c:\dpvpd.exec:\dpvpd.exe108⤵PID:1908
-
\??\c:\jdjjp.exec:\jdjjp.exe109⤵PID:1988
-
\??\c:\rfrllll.exec:\rfrllll.exe110⤵PID:2068
-
\??\c:\fffxflx.exec:\fffxflx.exe111⤵PID:568
-
\??\c:\5hnhhb.exec:\5hnhhb.exe112⤵PID:1496
-
\??\c:\hthhhn.exec:\hthhhn.exe113⤵PID:684
-
\??\c:\jpppp.exec:\jpppp.exe114⤵PID:2992
-
\??\c:\fxrfxfl.exec:\fxrfxfl.exe115⤵PID:2080
-
\??\c:\frxxllr.exec:\frxxllr.exe116⤵PID:2388
-
\??\c:\3tbtbb.exec:\3tbtbb.exe117⤵PID:352
-
\??\c:\1bnnbb.exec:\1bnnbb.exe118⤵PID:2376
-
\??\c:\ddppj.exec:\ddppj.exe119⤵PID:1548
-
\??\c:\9ppjj.exec:\9ppjj.exe120⤵PID:2124
-
\??\c:\rlxrfrr.exec:\rlxrfrr.exe121⤵PID:2600
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-