Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
13/10/2024, 01:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a715fc39cb28f8f45f340e131d4cd253a287520da82ad2de7d28ae148d42700c.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
General
-
Target
a715fc39cb28f8f45f340e131d4cd253a287520da82ad2de7d28ae148d42700c.exe
-
Size
333KB
-
MD5
99c93ebfa22eaa5e393ef5ea1c1a94a6
-
SHA1
c8b93fe8d29aadcc95fdc8f17a2e458adb613463
-
SHA256
a715fc39cb28f8f45f340e131d4cd253a287520da82ad2de7d28ae148d42700c
-
SHA512
01dcfe6e8680934213d1d0e26a8b76e84dae11398fd84a98ec3cbb631c18b0b888eba8a368a415c732b9c016fbed614b8f16ef23829b60499c229478985e0abf
-
SSDEEP
6144:3cm7ImGddXsJdJIjaRleL42bL37BoTPkhu9gX5yGsTshQc8R0nxA5ij8+RC7tPhD:F7Tc8JdSjylh2b77BoTMA9gX59sTsuTz
Malware Config
Signatures
-
Detect Blackmoon payload 55 IoCs
resource yara_rule behavioral1/memory/1708-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1624-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/352-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2280-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1984-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1796-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/440-207-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/564-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1584-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1356-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/328-268-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2524-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1996-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2080-291-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2080-290-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1600-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-333-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2756-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-355-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2688-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-400-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2468-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1800-470-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1800-471-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-521-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1484-528-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-550-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1600-572-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2136-599-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-612-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2912-667-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-679-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1984-724-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2348-839-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2916-890-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2612-932-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2784-947-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2524-1066-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2580-1167-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1508-1174-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2672-1206-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2440-1244-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/652-1287-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1624 7nbnth.exe 2208 5lrfffl.exe 2108 dpjjj.exe 352 llrlxff.exe 2844 bbnhbn.exe 2716 7jvdv.exe 2280 nhbnbh.exe 2768 3nhhnt.exe 2624 xllfrrl.exe 2636 fxrlrfx.exe 2620 pppjv.exe 1248 fllrfrf.exe 2660 vvvdv.exe 2784 1djpp.exe 2928 tbnhth.exe 2004 dvpjj.exe 1968 nnbthh.exe 1984 djvjd.exe 2440 fllxfll.exe 1796 5hthtn.exe 1776 djjdv.exe 440 fxlxlxl.exe 888 hbbhnh.exe 564 vdjdd.exe 1280 llxlrfl.exe 1584 3htbnn.exe 1356 llfxfff.exe 2524 vpjjp.exe 328 frxflrr.exe 1996 btbtbb.exe 2080 rxrlfll.exe 1600 tbnhht.exe 2352 lffrfrl.exe 2504 nhhtth.exe 2892 djjvp.exe 2704 ffxllfx.exe 2824 9xxffrf.exe 2880 bhhbtn.exe 2828 jdjpp.exe 2756 7fxlxxl.exe 2796 frlrflx.exe 2688 tnnhth.exe 2648 ppvpj.exe 2600 rxflxxl.exe 3052 ffrxfrx.exe 1756 5nnbbh.exe 2752 pjpdp.exe 1480 jvpvj.exe 2556 rxlrxlx.exe 2468 bbttth.exe 1140 vvpdv.exe 2336 jpjpp.exe 3020 7llxlrr.exe 2088 hhhbtn.exe 1984 ddddv.exe 2536 djjdd.exe 2052 ffxxflr.exe 1800 hhbhhb.exe 1540 tbtbtb.exe 2984 vpjpv.exe 888 9lllffx.exe 1616 fxrflrf.exe 1388 ntnhbb.exe 108 jdpdv.exe -
resource yara_rule behavioral1/memory/1708-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/352-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1796-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/564-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1356-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-521-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1484-528-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-567-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-599-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-667-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-679-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2912-687-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/3068-786-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1500-805-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-871-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-890-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2612-932-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2524-1066-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2580-1167-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1508-1174-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2672-1206-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2004-1225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-1244-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1540-1275-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xlrrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxflxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hnbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrllrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pjvd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1708 wrote to memory of 1624 1708 a715fc39cb28f8f45f340e131d4cd253a287520da82ad2de7d28ae148d42700c.exe 31 PID 1708 wrote to memory of 1624 1708 a715fc39cb28f8f45f340e131d4cd253a287520da82ad2de7d28ae148d42700c.exe 31 PID 1708 wrote to memory of 1624 1708 a715fc39cb28f8f45f340e131d4cd253a287520da82ad2de7d28ae148d42700c.exe 31 PID 1708 wrote to memory of 1624 1708 a715fc39cb28f8f45f340e131d4cd253a287520da82ad2de7d28ae148d42700c.exe 31 PID 1624 wrote to memory of 2208 1624 7nbnth.exe 32 PID 1624 wrote to memory of 2208 1624 7nbnth.exe 32 PID 1624 wrote to memory of 2208 1624 7nbnth.exe 32 PID 1624 wrote to memory of 2208 1624 7nbnth.exe 32 PID 2208 wrote to memory of 2108 2208 5lrfffl.exe 33 PID 2208 wrote to memory of 2108 2208 5lrfffl.exe 33 PID 2208 wrote to memory of 2108 2208 5lrfffl.exe 33 PID 2208 wrote to memory of 2108 2208 5lrfffl.exe 33 PID 2108 wrote to memory of 352 2108 dpjjj.exe 34 PID 2108 wrote to memory of 352 2108 dpjjj.exe 34 PID 2108 wrote to memory of 352 2108 dpjjj.exe 34 PID 2108 wrote to memory of 352 2108 dpjjj.exe 34 PID 352 wrote to memory of 2844 352 llrlxff.exe 35 PID 352 wrote to memory of 2844 352 llrlxff.exe 35 PID 352 wrote to memory of 2844 352 llrlxff.exe 35 PID 352 wrote to memory of 2844 352 llrlxff.exe 35 PID 2844 wrote to memory of 2716 2844 bbnhbn.exe 36 PID 2844 wrote to memory of 2716 2844 bbnhbn.exe 36 PID 2844 wrote to memory of 2716 2844 bbnhbn.exe 36 PID 2844 wrote to memory of 2716 2844 bbnhbn.exe 36 PID 2716 wrote to memory of 2280 2716 7jvdv.exe 37 PID 2716 wrote to memory of 2280 2716 7jvdv.exe 37 PID 2716 wrote to memory of 2280 2716 7jvdv.exe 37 PID 2716 wrote to memory of 2280 2716 7jvdv.exe 37 PID 2280 wrote to memory of 2768 2280 nhbnbh.exe 38 PID 2280 wrote to memory of 2768 2280 nhbnbh.exe 38 PID 2280 wrote to memory of 2768 2280 nhbnbh.exe 38 PID 2280 wrote to memory of 2768 2280 nhbnbh.exe 38 PID 2768 wrote to memory of 2624 2768 3nhhnt.exe 39 PID 2768 wrote to memory of 2624 2768 3nhhnt.exe 39 PID 2768 wrote to memory of 2624 2768 3nhhnt.exe 39 PID 2768 wrote to memory of 2624 2768 3nhhnt.exe 39 PID 2624 wrote to memory of 2636 2624 xllfrrl.exe 40 PID 2624 wrote to memory of 2636 2624 xllfrrl.exe 40 PID 2624 wrote to memory of 2636 2624 xllfrrl.exe 40 PID 2624 wrote to memory of 2636 2624 xllfrrl.exe 40 PID 2636 wrote to memory of 2620 2636 fxrlrfx.exe 41 PID 2636 wrote to memory of 2620 2636 fxrlrfx.exe 41 PID 2636 wrote to memory of 2620 2636 fxrlrfx.exe 41 PID 2636 wrote to memory of 2620 2636 fxrlrfx.exe 41 PID 2620 wrote to memory of 1248 2620 pppjv.exe 42 PID 2620 wrote to memory of 1248 2620 pppjv.exe 42 PID 2620 wrote to memory of 1248 2620 pppjv.exe 42 PID 2620 wrote to memory of 1248 2620 pppjv.exe 42 PID 1248 wrote to memory of 2660 1248 fllrfrf.exe 43 PID 1248 wrote to memory of 2660 1248 fllrfrf.exe 43 PID 1248 wrote to memory of 2660 1248 fllrfrf.exe 43 PID 1248 wrote to memory of 2660 1248 fllrfrf.exe 43 PID 2660 wrote to memory of 2784 2660 vvvdv.exe 44 PID 2660 wrote to memory of 2784 2660 vvvdv.exe 44 PID 2660 wrote to memory of 2784 2660 vvvdv.exe 44 PID 2660 wrote to memory of 2784 2660 vvvdv.exe 44 PID 2784 wrote to memory of 2928 2784 1djpp.exe 45 PID 2784 wrote to memory of 2928 2784 1djpp.exe 45 PID 2784 wrote to memory of 2928 2784 1djpp.exe 45 PID 2784 wrote to memory of 2928 2784 1djpp.exe 45 PID 2928 wrote to memory of 2004 2928 tbnhth.exe 46 PID 2928 wrote to memory of 2004 2928 tbnhth.exe 46 PID 2928 wrote to memory of 2004 2928 tbnhth.exe 46 PID 2928 wrote to memory of 2004 2928 tbnhth.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\a715fc39cb28f8f45f340e131d4cd253a287520da82ad2de7d28ae148d42700c.exe"C:\Users\Admin\AppData\Local\Temp\a715fc39cb28f8f45f340e131d4cd253a287520da82ad2de7d28ae148d42700c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\7nbnth.exec:\7nbnth.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\5lrfffl.exec:\5lrfffl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\dpjjj.exec:\dpjjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\llrlxff.exec:\llrlxff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:352 -
\??\c:\bbnhbn.exec:\bbnhbn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\7jvdv.exec:\7jvdv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\nhbnbh.exec:\nhbnbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\3nhhnt.exec:\3nhhnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\xllfrrl.exec:\xllfrrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\fxrlrfx.exec:\fxrlrfx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\pppjv.exec:\pppjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\fllrfrf.exec:\fllrfrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
\??\c:\vvvdv.exec:\vvvdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\1djpp.exec:\1djpp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\tbnhth.exec:\tbnhth.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\dvpjj.exec:\dvpjj.exe17⤵
- Executes dropped EXE
PID:2004 -
\??\c:\nnbthh.exec:\nnbthh.exe18⤵
- Executes dropped EXE
PID:1968 -
\??\c:\djvjd.exec:\djvjd.exe19⤵
- Executes dropped EXE
PID:1984 -
\??\c:\fllxfll.exec:\fllxfll.exe20⤵
- Executes dropped EXE
PID:2440 -
\??\c:\5hthtn.exec:\5hthtn.exe21⤵
- Executes dropped EXE
PID:1796 -
\??\c:\djjdv.exec:\djjdv.exe22⤵
- Executes dropped EXE
PID:1776 -
\??\c:\fxlxlxl.exec:\fxlxlxl.exe23⤵
- Executes dropped EXE
PID:440 -
\??\c:\hbbhnh.exec:\hbbhnh.exe24⤵
- Executes dropped EXE
PID:888 -
\??\c:\vdjdd.exec:\vdjdd.exe25⤵
- Executes dropped EXE
PID:564 -
\??\c:\llxlrfl.exec:\llxlrfl.exe26⤵
- Executes dropped EXE
PID:1280 -
\??\c:\3htbnn.exec:\3htbnn.exe27⤵
- Executes dropped EXE
PID:1584 -
\??\c:\llfxfff.exec:\llfxfff.exe28⤵
- Executes dropped EXE
PID:1356 -
\??\c:\vpjjp.exec:\vpjjp.exe29⤵
- Executes dropped EXE
PID:2524 -
\??\c:\frxflrr.exec:\frxflrr.exe30⤵
- Executes dropped EXE
PID:328 -
\??\c:\btbtbb.exec:\btbtbb.exe31⤵
- Executes dropped EXE
PID:1996 -
\??\c:\rxrlfll.exec:\rxrlfll.exe32⤵
- Executes dropped EXE
PID:2080 -
\??\c:\tbnhht.exec:\tbnhht.exe33⤵
- Executes dropped EXE
PID:1600 -
\??\c:\lffrfrl.exec:\lffrfrl.exe34⤵
- Executes dropped EXE
PID:2352 -
\??\c:\nhhtth.exec:\nhhtth.exe35⤵
- Executes dropped EXE
PID:2504 -
\??\c:\djjvp.exec:\djjvp.exe36⤵
- Executes dropped EXE
PID:2892 -
\??\c:\ffxllfx.exec:\ffxllfx.exe37⤵
- Executes dropped EXE
PID:2704 -
\??\c:\9xxffrf.exec:\9xxffrf.exe38⤵
- Executes dropped EXE
PID:2824 -
\??\c:\bhhbtn.exec:\bhhbtn.exe39⤵
- Executes dropped EXE
PID:2880 -
\??\c:\jdjpp.exec:\jdjpp.exe40⤵
- Executes dropped EXE
PID:2828 -
\??\c:\7fxlxxl.exec:\7fxlxxl.exe41⤵
- Executes dropped EXE
PID:2756 -
\??\c:\frlrflx.exec:\frlrflx.exe42⤵
- Executes dropped EXE
PID:2796 -
\??\c:\tnnhth.exec:\tnnhth.exe43⤵
- Executes dropped EXE
PID:2688 -
\??\c:\ppvpj.exec:\ppvpj.exe44⤵
- Executes dropped EXE
PID:2648 -
\??\c:\rxflxxl.exec:\rxflxxl.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2600 -
\??\c:\ffrxfrx.exec:\ffrxfrx.exe46⤵
- Executes dropped EXE
PID:3052 -
\??\c:\5nnbbh.exec:\5nnbbh.exe47⤵
- Executes dropped EXE
PID:1756 -
\??\c:\pjpdp.exec:\pjpdp.exe48⤵
- Executes dropped EXE
PID:2752 -
\??\c:\jvpvj.exec:\jvpvj.exe49⤵
- Executes dropped EXE
PID:1480 -
\??\c:\rxlrxlx.exec:\rxlrxlx.exe50⤵
- Executes dropped EXE
PID:2556 -
\??\c:\bbttth.exec:\bbttth.exe51⤵
- Executes dropped EXE
PID:2468 -
\??\c:\vvpdv.exec:\vvpdv.exe52⤵
- Executes dropped EXE
PID:1140 -
\??\c:\jpjpp.exec:\jpjpp.exe53⤵
- Executes dropped EXE
PID:2336 -
\??\c:\7llxlrr.exec:\7llxlrr.exe54⤵
- Executes dropped EXE
PID:3020 -
\??\c:\hhhbtn.exec:\hhhbtn.exe55⤵
- Executes dropped EXE
PID:2088 -
\??\c:\ddddv.exec:\ddddv.exe56⤵
- Executes dropped EXE
PID:1984 -
\??\c:\djjdd.exec:\djjdd.exe57⤵
- Executes dropped EXE
PID:2536 -
\??\c:\ffxxflr.exec:\ffxxflr.exe58⤵
- Executes dropped EXE
PID:2052 -
\??\c:\hhbhhb.exec:\hhbhhb.exe59⤵
- Executes dropped EXE
PID:1800 -
\??\c:\tbtbtb.exec:\tbtbtb.exe60⤵
- Executes dropped EXE
PID:1540 -
\??\c:\vpjpv.exec:\vpjpv.exe61⤵
- Executes dropped EXE
PID:2984 -
\??\c:\9lllffx.exec:\9lllffx.exe62⤵
- Executes dropped EXE
PID:888 -
\??\c:\fxrflrf.exec:\fxrflrf.exe63⤵
- Executes dropped EXE
PID:1616 -
\??\c:\ntnhbb.exec:\ntnhbb.exe64⤵
- Executes dropped EXE
PID:1388 -
\??\c:\jdpdv.exec:\jdpdv.exe65⤵
- Executes dropped EXE
PID:108 -
\??\c:\dddvj.exec:\dddvj.exe66⤵PID:2028
-
\??\c:\xxxfllf.exec:\xxxfllf.exe67⤵PID:2448
-
\??\c:\hbtbtt.exec:\hbtbtt.exe68⤵PID:1484
-
\??\c:\nnhnbh.exec:\nnhnbh.exe69⤵PID:2372
-
\??\c:\dddpd.exec:\dddpd.exe70⤵PID:324
-
\??\c:\rxxxrfr.exec:\rxxxrfr.exe71⤵PID:2412
-
\??\c:\thnbhn.exec:\thnbhn.exe72⤵PID:2252
-
\??\c:\1bnbnt.exec:\1bnbnt.exe73⤵PID:1596
-
\??\c:\5jddj.exec:\5jddj.exe74⤵PID:580
-
\??\c:\flfrflf.exec:\flfrflf.exe75⤵PID:1600
-
\??\c:\fffxlrf.exec:\fffxlrf.exe76⤵PID:2496
-
\??\c:\bnntnh.exec:\bnntnh.exe77⤵PID:2504
-
\??\c:\djvdp.exec:\djvdp.exe78⤵PID:2892
-
\??\c:\jppdv.exec:\jppdv.exe79⤵PID:2136
-
\??\c:\1rfrxfr.exec:\1rfrxfr.exe80⤵PID:2824
-
\??\c:\nnthhn.exec:\nnthhn.exe81⤵PID:2576
-
\??\c:\jdvvj.exec:\jdvvj.exe82⤵PID:2736
-
\??\c:\pvjvj.exec:\pvjvj.exe83⤵PID:2692
-
\??\c:\flffxrl.exec:\flffxrl.exe84⤵PID:2796
-
\??\c:\ffrxxfr.exec:\ffrxxfr.exe85⤵PID:2856
-
\??\c:\ntthtb.exec:\ntthtb.exe86⤵PID:2588
-
\??\c:\jpjdd.exec:\jpjdd.exe87⤵PID:3036
-
\??\c:\3frxrxr.exec:\3frxrxr.exe88⤵PID:2620
-
\??\c:\3rlrfrx.exec:\3rlrfrx.exe89⤵PID:780
-
\??\c:\bntntt.exec:\bntntt.exe90⤵PID:2912
-
\??\c:\vvvvj.exec:\vvvvj.exe91⤵PID:2660
-
\??\c:\vpjvd.exec:\vpjvd.exe92⤵PID:2896
-
\??\c:\rrxlfxr.exec:\rrxlfxr.exe93⤵PID:2928
-
\??\c:\ttnhbn.exec:\ttnhbn.exe94⤵PID:1852
-
\??\c:\dvvjv.exec:\dvvjv.exe95⤵PID:1976
-
\??\c:\vvvdp.exec:\vvvdp.exe96⤵PID:1968
-
\??\c:\lrfxfrx.exec:\lrfxfrx.exe97⤵PID:1936
-
\??\c:\btnbht.exec:\btnbht.exe98⤵PID:2088
-
\??\c:\bthhnn.exec:\bthhnn.exe99⤵PID:1984
-
\??\c:\vvjpv.exec:\vvjpv.exe100⤵PID:1796
-
\??\c:\xflxxll.exec:\xflxxll.exe101⤵PID:2476
-
\??\c:\btnbbt.exec:\btnbbt.exe102⤵PID:864
-
\??\c:\hnhnhn.exec:\hnhnhn.exe103⤵PID:1628
-
\??\c:\3vdpd.exec:\3vdpd.exe104⤵PID:2984
-
\??\c:\xxlxlxl.exec:\xxlxlxl.exe105⤵PID:888
-
\??\c:\rlrffxf.exec:\rlrffxf.exe106⤵PID:1616
-
\??\c:\7hthth.exec:\7hthth.exe107⤵PID:1028
-
\??\c:\vppvj.exec:\vppvj.exe108⤵PID:108
-
\??\c:\pppdv.exec:\pppdv.exe109⤵PID:1584
-
\??\c:\rlfxllr.exec:\rlfxllr.exe110⤵PID:3068
-
\??\c:\bttbbn.exec:\bttbbn.exe111⤵PID:328
-
\??\c:\hhhnbt.exec:\hhhnbt.exe112⤵PID:2128
-
\??\c:\jdvdp.exec:\jdvdp.exe113⤵PID:1500
-
\??\c:\3lflxfl.exec:\3lflxfl.exe114⤵PID:1676
-
\??\c:\3lrfrxr.exec:\3lrfrxr.exe115⤵PID:2116
-
\??\c:\hnnttb.exec:\hnnttb.exe116⤵PID:1652
-
\??\c:\vjpjj.exec:\vjpjj.exe117⤵PID:1684
-
\??\c:\xfrlfrr.exec:\xfrlfrr.exe118⤵PID:2348
-
\??\c:\7xrlrxf.exec:\7xrlrxf.exe119⤵PID:276
-
\??\c:\1hnbhn.exec:\1hnbhn.exe120⤵
- System Location Discovery: System Language Discovery
PID:2508 -
\??\c:\vvvjd.exec:\vvvjd.exe121⤵PID:2248
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-