Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
14/10/2024, 12:55
Behavioral task
behavioral1
Sample
1153c6209fbbadfce6ce692d8cf7f0e07cbd32c79e1714f8674c4ca8b4628675N.exe
Resource
win7-20240729-en
windows7-x64
6 signatures
120 seconds
General
-
Target
1153c6209fbbadfce6ce692d8cf7f0e07cbd32c79e1714f8674c4ca8b4628675N.exe
-
Size
329KB
-
MD5
5d74832ce0107b6b114745d24b1755a0
-
SHA1
3eb55d32a3791015440cf9cfa3dce7fa2132b016
-
SHA256
1153c6209fbbadfce6ce692d8cf7f0e07cbd32c79e1714f8674c4ca8b4628675
-
SHA512
6c9521a777d3018d9ed868f3a872826d3e5fb1e56e0f5c5d4a07024cd4aba89b08fae673126d2f4ca99cc0845367f934356f6896f73959a0e20c9febfed91f82
-
SSDEEP
6144:vcm4FmowdHoStJdJIjaRleL42bL37BoTPkhu9gX5yGsTshQc8R0nxA5ij8+RC7ta:94wFHoStJdSjylh2b77BoTMA9gX59sTi
Malware Config
Signatures
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/2316-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2552-23-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2848-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2664-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2264-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1764-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1764-161-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2516-210-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/276-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2368-277-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2676-310-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2028-351-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2744-373-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2300-379-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2872-430-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1292-442-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2000-578-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1920-1265-0x00000000779C0000-0x0000000077ABA000-memory.dmp family_blackmoon behavioral1/memory/1920-1264-0x0000000077AC0000-0x0000000077BDF000-memory.dmp family_blackmoon behavioral1/memory/1932-829-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1920-515-0x0000000077AC0000-0x0000000077BDF000-memory.dmp family_blackmoon behavioral1/memory/488-464-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2484-402-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2488-396-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2568-334-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2596-299-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1516-264-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/880-236-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2996-219-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2872-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1724-154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1724-152-0x0000000000260000-0x0000000000287000-memory.dmp family_blackmoon behavioral1/memory/2300-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1748-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1200-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/236-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/864-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2740-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1928-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2608-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2608-50-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2864-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1920-12693-0x0000000077AC0000-0x0000000077BDF000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2848 vpvjp.exe 2552 xxflrxr.exe 2664 hbnnhn.exe 2864 fflrllf.exe 2608 nnhbth.exe 1928 7nbttn.exe 2740 djjvd.exe 2524 7rfrxll.exe 864 7btbbh.exe 236 tnbhbb.exe 1200 pjppd.exe 2264 lfrfxlr.exe 1748 7hhhbh.exe 2300 vpdvd.exe 2288 3lxrffr.exe 2828 htnbhh.exe 1724 5pdpv.exe 1764 flxrlrf.exe 1956 7rllxfr.exe 1992 1nhbnb.exe 2872 3dvdd.exe 1868 nbhbhb.exe 552 nnbnbb.exe 2516 3rflrfr.exe 2996 7nhhtb.exe 276 ddvjv.exe 880 llfllfr.exe 2624 bhtnhb.exe 2340 1nbthh.exe 2328 vvppv.exe 1516 rfllrrx.exe 2080 1btntb.exe 2368 bbntbh.exe 2068 pjdpd.exe 3000 rxllrfx.exe 1684 5tthtn.exe 2596 7jjpj.exe 2184 7jpvd.exe 2676 llxfrrf.exe 2724 tnbnbh.exe 2584 vpjjv.exe 2444 vjdvj.exe 2568 flxlffl.exe 2016 9bbhhh.exe 1968 bbtbtn.exe 2028 1ddjv.exe 2276 dvjdj.exe 1420 lfxfrxl.exe 2032 llxxxff.exe 2744 tntnbb.exe 2300 pjjdp.exe 2288 ffxxffr.exe 2820 xlfflrx.exe 2488 1bbbth.exe 2484 tnbbhh.exe 2108 9pjvd.exe 1808 xrllxxx.exe 1652 1xfxxll.exe 2572 3ntnnh.exe 2872 nnhtbh.exe 2240 1dpvd.exe 1292 3pvpj.exe 3016 1rlrffx.exe 564 bnbhbh.exe -
resource yara_rule behavioral1/memory/2316-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2316-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000c000000012243-8.dat upx behavioral1/files/0x0007000000018b62-17.dat upx behavioral1/files/0x0007000000018b68-24.dat upx behavioral1/memory/2552-23-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2848-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2864-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2664-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000018bf3-32.dat upx behavioral1/files/0x0008000000019230-44.dat upx behavioral1/files/0x0006000000019240-53.dat upx behavioral1/files/0x000500000001961c-70.dat upx behavioral1/files/0x000500000001961e-77.dat upx behavioral1/files/0x0005000000019667-86.dat upx behavioral1/memory/2264-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019c3e-129.dat upx behavioral1/files/0x0005000000019c57-137.dat upx behavioral1/files/0x0005000000019cba-145.dat upx behavioral1/files/0x0005000000019cca-155.dat upx behavioral1/files/0x0005000000019d8e-164.dat upx behavioral1/memory/1764-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019dbf-171.dat upx behavioral1/files/0x0005000000019f8a-178.dat upx behavioral1/files/0x0005000000019f94-188.dat upx behavioral1/files/0x000500000001a07e-202.dat upx behavioral1/memory/2516-210-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a09e-217.dat upx behavioral1/memory/276-221-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a41b-244.dat upx behavioral1/files/0x000500000001a41d-251.dat upx behavioral1/memory/2368-277-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2676-310-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2028-351-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2744-373-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2872-430-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1920-514-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2000-578-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1920-1264-0x0000000077AC0000-0x0000000077BDF000-memory.dmp upx behavioral1/memory/2824-892-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/1932-823-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1920-515-0x0000000077AC0000-0x0000000077BDF000-memory.dmp upx behavioral1/memory/2344-481-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/488-458-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2108-403-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2484-402-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2488-396-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1968-345-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2568-334-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2444-322-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2596-299-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a427-266.dat upx behavioral1/files/0x000500000001a41e-258.dat upx behavioral1/files/0x000500000001a359-237.dat upx behavioral1/memory/880-236-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a307-228.dat upx behavioral1/memory/2996-219-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0037000000018710-211.dat upx behavioral1/files/0x000500000001a075-195.dat upx behavioral1/memory/2872-187-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1724-154-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2828-144-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2288-136-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2300-128-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3thntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrxlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrlxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7flxlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxxllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bhnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2316 wrote to memory of 2848 2316 1153c6209fbbadfce6ce692d8cf7f0e07cbd32c79e1714f8674c4ca8b4628675N.exe 29 PID 2316 wrote to memory of 2848 2316 1153c6209fbbadfce6ce692d8cf7f0e07cbd32c79e1714f8674c4ca8b4628675N.exe 29 PID 2316 wrote to memory of 2848 2316 1153c6209fbbadfce6ce692d8cf7f0e07cbd32c79e1714f8674c4ca8b4628675N.exe 29 PID 2316 wrote to memory of 2848 2316 1153c6209fbbadfce6ce692d8cf7f0e07cbd32c79e1714f8674c4ca8b4628675N.exe 29 PID 2848 wrote to memory of 2552 2848 vpvjp.exe 30 PID 2848 wrote to memory of 2552 2848 vpvjp.exe 30 PID 2848 wrote to memory of 2552 2848 vpvjp.exe 30 PID 2848 wrote to memory of 2552 2848 vpvjp.exe 30 PID 2552 wrote to memory of 2664 2552 xxflrxr.exe 256 PID 2552 wrote to memory of 2664 2552 xxflrxr.exe 256 PID 2552 wrote to memory of 2664 2552 xxflrxr.exe 256 PID 2552 wrote to memory of 2664 2552 xxflrxr.exe 256 PID 2664 wrote to memory of 2864 2664 hbnnhn.exe 32 PID 2664 wrote to memory of 2864 2664 hbnnhn.exe 32 PID 2664 wrote to memory of 2864 2664 hbnnhn.exe 32 PID 2664 wrote to memory of 2864 2664 hbnnhn.exe 32 PID 2864 wrote to memory of 2608 2864 fflrllf.exe 33 PID 2864 wrote to memory of 2608 2864 fflrllf.exe 33 PID 2864 wrote to memory of 2608 2864 fflrllf.exe 33 PID 2864 wrote to memory of 2608 2864 fflrllf.exe 33 PID 2608 wrote to memory of 1928 2608 nnhbth.exe 34 PID 2608 wrote to memory of 1928 2608 nnhbth.exe 34 PID 2608 wrote to memory of 1928 2608 nnhbth.exe 34 PID 2608 wrote to memory of 1928 2608 nnhbth.exe 34 PID 1928 wrote to memory of 2740 1928 7nbttn.exe 35 PID 1928 wrote to memory of 2740 1928 7nbttn.exe 35 PID 1928 wrote to memory of 2740 1928 7nbttn.exe 35 PID 1928 wrote to memory of 2740 1928 7nbttn.exe 35 PID 2740 wrote to memory of 2524 2740 djjvd.exe 36 PID 2740 wrote to memory of 2524 2740 djjvd.exe 36 PID 2740 wrote to memory of 2524 2740 djjvd.exe 36 PID 2740 wrote to memory of 2524 2740 djjvd.exe 36 PID 2524 wrote to memory of 864 2524 7rfrxll.exe 37 PID 2524 wrote to memory of 864 2524 7rfrxll.exe 37 PID 2524 wrote to memory of 864 2524 7rfrxll.exe 37 PID 2524 wrote to memory of 864 2524 7rfrxll.exe 37 PID 864 wrote to memory of 236 864 7btbbh.exe 38 PID 864 wrote to memory of 236 864 7btbbh.exe 38 PID 864 wrote to memory of 236 864 7btbbh.exe 38 PID 864 wrote to memory of 236 864 7btbbh.exe 38 PID 236 wrote to memory of 1200 236 tnbhbb.exe 39 PID 236 wrote to memory of 1200 236 tnbhbb.exe 39 PID 236 wrote to memory of 1200 236 tnbhbb.exe 39 PID 236 wrote to memory of 1200 236 tnbhbb.exe 39 PID 1200 wrote to memory of 2264 1200 pjppd.exe 40 PID 1200 wrote to memory of 2264 1200 pjppd.exe 40 PID 1200 wrote to memory of 2264 1200 pjppd.exe 40 PID 1200 wrote to memory of 2264 1200 pjppd.exe 40 PID 2264 wrote to memory of 1748 2264 lfrfxlr.exe 41 PID 2264 wrote to memory of 1748 2264 lfrfxlr.exe 41 PID 2264 wrote to memory of 1748 2264 lfrfxlr.exe 41 PID 2264 wrote to memory of 1748 2264 lfrfxlr.exe 41 PID 1748 wrote to memory of 2300 1748 7hhhbh.exe 42 PID 1748 wrote to memory of 2300 1748 7hhhbh.exe 42 PID 1748 wrote to memory of 2300 1748 7hhhbh.exe 42 PID 1748 wrote to memory of 2300 1748 7hhhbh.exe 42 PID 2300 wrote to memory of 2288 2300 vpdvd.exe 43 PID 2300 wrote to memory of 2288 2300 vpdvd.exe 43 PID 2300 wrote to memory of 2288 2300 vpdvd.exe 43 PID 2300 wrote to memory of 2288 2300 vpdvd.exe 43 PID 2288 wrote to memory of 2828 2288 3lxrffr.exe 44 PID 2288 wrote to memory of 2828 2288 3lxrffr.exe 44 PID 2288 wrote to memory of 2828 2288 3lxrffr.exe 44 PID 2288 wrote to memory of 2828 2288 3lxrffr.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\1153c6209fbbadfce6ce692d8cf7f0e07cbd32c79e1714f8674c4ca8b4628675N.exe"C:\Users\Admin\AppData\Local\Temp\1153c6209fbbadfce6ce692d8cf7f0e07cbd32c79e1714f8674c4ca8b4628675N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\vpvjp.exec:\vpvjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\xxflrxr.exec:\xxflrxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\hbnnhn.exec:\hbnnhn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\fflrllf.exec:\fflrllf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\nnhbth.exec:\nnhbth.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\7nbttn.exec:\7nbttn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\djjvd.exec:\djjvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\7rfrxll.exec:\7rfrxll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\7btbbh.exec:\7btbbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\tnbhbb.exec:\tnbhbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:236 -
\??\c:\pjppd.exec:\pjppd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
\??\c:\lfrfxlr.exec:\lfrfxlr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\7hhhbh.exec:\7hhhbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\vpdvd.exec:\vpdvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\3lxrffr.exec:\3lxrffr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\htnbhh.exec:\htnbhh.exe17⤵
- Executes dropped EXE
PID:2828 -
\??\c:\5pdpv.exec:\5pdpv.exe18⤵
- Executes dropped EXE
PID:1724 -
\??\c:\flxrlrf.exec:\flxrlrf.exe19⤵
- Executes dropped EXE
PID:1764 -
\??\c:\7rllxfr.exec:\7rllxfr.exe20⤵
- Executes dropped EXE
PID:1956 -
\??\c:\1nhbnb.exec:\1nhbnb.exe21⤵
- Executes dropped EXE
PID:1992 -
\??\c:\3dvdd.exec:\3dvdd.exe22⤵
- Executes dropped EXE
PID:2872 -
\??\c:\nbhbhb.exec:\nbhbhb.exe23⤵
- Executes dropped EXE
PID:1868 -
\??\c:\nnbnbb.exec:\nnbnbb.exe24⤵
- Executes dropped EXE
PID:552 -
\??\c:\3rflrfr.exec:\3rflrfr.exe25⤵
- Executes dropped EXE
PID:2516 -
\??\c:\7nhhtb.exec:\7nhhtb.exe26⤵
- Executes dropped EXE
PID:2996 -
\??\c:\ddvjv.exec:\ddvjv.exe27⤵
- Executes dropped EXE
PID:276 -
\??\c:\llfllfr.exec:\llfllfr.exe28⤵
- Executes dropped EXE
PID:880 -
\??\c:\bhtnhb.exec:\bhtnhb.exe29⤵
- Executes dropped EXE
PID:2624 -
\??\c:\1nbthh.exec:\1nbthh.exe30⤵
- Executes dropped EXE
PID:2340 -
\??\c:\vvppv.exec:\vvppv.exe31⤵
- Executes dropped EXE
PID:2328 -
\??\c:\rfllrrx.exec:\rfllrrx.exe32⤵
- Executes dropped EXE
PID:1516 -
\??\c:\1btntb.exec:\1btntb.exe33⤵
- Executes dropped EXE
PID:2080 -
\??\c:\bbntbh.exec:\bbntbh.exe34⤵
- Executes dropped EXE
PID:2368 -
\??\c:\pjdpd.exec:\pjdpd.exe35⤵
- Executes dropped EXE
PID:2068 -
\??\c:\rxllrfx.exec:\rxllrfx.exe36⤵
- Executes dropped EXE
PID:3000 -
\??\c:\5tthtn.exec:\5tthtn.exe37⤵
- Executes dropped EXE
PID:1684 -
\??\c:\7jjpj.exec:\7jjpj.exe38⤵
- Executes dropped EXE
PID:2596 -
\??\c:\7jpvd.exec:\7jpvd.exe39⤵
- Executes dropped EXE
PID:2184 -
\??\c:\llxfrrf.exec:\llxfrrf.exe40⤵
- Executes dropped EXE
PID:2676 -
\??\c:\tnbnbh.exec:\tnbnbh.exe41⤵
- Executes dropped EXE
PID:2724 -
\??\c:\vpjjv.exec:\vpjjv.exe42⤵
- Executes dropped EXE
PID:2584 -
\??\c:\vjdvj.exec:\vjdvj.exe43⤵
- Executes dropped EXE
PID:2444 -
\??\c:\flxlffl.exec:\flxlffl.exe44⤵
- Executes dropped EXE
PID:2568 -
\??\c:\9bbhhh.exec:\9bbhhh.exe45⤵
- Executes dropped EXE
PID:2016 -
\??\c:\bbtbtn.exec:\bbtbtn.exe46⤵
- Executes dropped EXE
PID:1968 -
\??\c:\1ddjv.exec:\1ddjv.exe47⤵
- Executes dropped EXE
PID:2028 -
\??\c:\dvjdj.exec:\dvjdj.exe48⤵
- Executes dropped EXE
PID:2276 -
\??\c:\lfxfrxl.exec:\lfxfrxl.exe49⤵
- Executes dropped EXE
PID:1420 -
\??\c:\llxxxff.exec:\llxxxff.exe50⤵
- Executes dropped EXE
PID:2032 -
\??\c:\tntnbb.exec:\tntnbb.exe51⤵
- Executes dropped EXE
PID:2744 -
\??\c:\pjjdp.exec:\pjjdp.exe52⤵
- Executes dropped EXE
PID:2300 -
\??\c:\ffxxffr.exec:\ffxxffr.exe53⤵
- Executes dropped EXE
PID:2288 -
\??\c:\xlfflrx.exec:\xlfflrx.exe54⤵
- Executes dropped EXE
PID:2820 -
\??\c:\1bbbth.exec:\1bbbth.exe55⤵
- Executes dropped EXE
PID:2488 -
\??\c:\tnbbhh.exec:\tnbbhh.exe56⤵
- Executes dropped EXE
PID:2484 -
\??\c:\9pjvd.exec:\9pjvd.exe57⤵
- Executes dropped EXE
PID:2108 -
\??\c:\xrllxxx.exec:\xrllxxx.exe58⤵
- Executes dropped EXE
PID:1808 -
\??\c:\1xfxxll.exec:\1xfxxll.exe59⤵
- Executes dropped EXE
PID:1652 -
\??\c:\3ntnnh.exec:\3ntnnh.exe60⤵
- Executes dropped EXE
PID:2572 -
\??\c:\nnhtbh.exec:\nnhtbh.exe61⤵
- Executes dropped EXE
PID:2872 -
\??\c:\1dpvd.exec:\1dpvd.exe62⤵
- Executes dropped EXE
PID:2240 -
\??\c:\3pvpj.exec:\3pvpj.exe63⤵
- Executes dropped EXE
PID:1292 -
\??\c:\1rlrffx.exec:\1rlrffx.exe64⤵
- Executes dropped EXE
PID:3016 -
\??\c:\bnbhbh.exec:\bnbhbh.exe65⤵
- Executes dropped EXE
PID:564 -
\??\c:\hhbhtt.exec:\hhbhtt.exe66⤵PID:2996
-
\??\c:\vpdpv.exec:\vpdpv.exe67⤵PID:488
-
\??\c:\9vdjj.exec:\9vdjj.exe68⤵PID:2896
-
\??\c:\9rlxrfr.exec:\9rlxrfr.exe69⤵PID:1916
-
\??\c:\7tttbh.exec:\7tttbh.exe70⤵PID:1864
-
\??\c:\hbnntn.exec:\hbnntn.exe71⤵PID:2344
-
\??\c:\pjjdp.exec:\pjjdp.exe72⤵PID:984
-
\??\c:\jjvvd.exec:\jjvvd.exe73⤵PID:2164
-
\??\c:\fxlfllr.exec:\fxlfllr.exe74⤵PID:2104
-
\??\c:\tnbbnt.exec:\tnbbnt.exe75⤵PID:2912
-
\??\c:\thbbbb.exec:\thbbbb.exe76⤵PID:668
-
\??\c:\vjpjd.exec:\vjpjd.exe77⤵PID:1920
-
\??\c:\vpdjj.exec:\vpdjj.exe78⤵PID:1580
-
\??\c:\rlflrxl.exec:\rlflrxl.exe79⤵PID:692
-
\??\c:\7xfllll.exec:\7xfllll.exe80⤵PID:2576
-
\??\c:\bnbhtt.exec:\bnbhtt.exe81⤵PID:2052
-
\??\c:\htbbhb.exec:\htbbhb.exe82⤵PID:2876
-
\??\c:\1jjdj.exec:\1jjdj.exe83⤵PID:2580
-
\??\c:\fxrrflr.exec:\fxrrflr.exe84⤵PID:3068
-
\??\c:\lxrlxrx.exec:\lxrlxrx.exe85⤵PID:2864
-
\??\c:\hbnnnn.exec:\hbnnnn.exe86⤵PID:2724
-
\??\c:\bnbnnh.exec:\bnbnnh.exe87⤵PID:2060
-
\??\c:\5jdpd.exec:\5jdpd.exe88⤵PID:2860
-
\??\c:\dvjpv.exec:\dvjpv.exe89⤵PID:2000
-
\??\c:\9fllrxl.exec:\9fllrxl.exe90⤵PID:2520
-
\??\c:\3rlxxfl.exec:\3rlxxfl.exe91⤵PID:2760
-
\??\c:\ttnbht.exec:\ttnbht.exe92⤵PID:2728
-
\??\c:\ntbhhb.exec:\ntbhhb.exe93⤵PID:2668
-
\??\c:\3vdjj.exec:\3vdjj.exe94⤵PID:1604
-
\??\c:\jdjpd.exec:\jdjpd.exe95⤵PID:1748
-
\??\c:\fxllxxf.exec:\fxllxxf.exe96⤵PID:2604
-
\??\c:\xrllrrr.exec:\xrllrrr.exe97⤵PID:2548
-
\??\c:\3thhbn.exec:\3thhbn.exe98⤵PID:2812
-
\??\c:\tnhbhh.exec:\tnhbhh.exe99⤵PID:1720
-
\??\c:\vpjjv.exec:\vpjjv.exe100⤵PID:2936
-
\??\c:\5jvvp.exec:\5jvvp.exe101⤵PID:1724
-
\??\c:\xrxflrx.exec:\xrxflrx.exe102⤵PID:2188
-
\??\c:\nhnhtb.exec:\nhnhtb.exe103⤵PID:1404
-
\??\c:\bthntt.exec:\bthntt.exe104⤵PID:1764
-
\??\c:\dvddp.exec:\dvddp.exe105⤵PID:1272
-
\??\c:\pjvdp.exec:\pjvdp.exe106⤵PID:1800
-
\??\c:\1xlllll.exec:\1xlllll.exe107⤵PID:2384
-
\??\c:\ffxlxrx.exec:\ffxlxrx.exe108⤵PID:1196
-
\??\c:\xxlrffl.exec:\xxlrffl.exe109⤵PID:900
-
\??\c:\nhhnbh.exec:\nhhnbh.exe110⤵PID:2712
-
\??\c:\nthbbh.exec:\nthbbh.exe111⤵PID:1292
-
\??\c:\jjdjd.exec:\jjdjd.exe112⤵PID:1740
-
\??\c:\rfllllr.exec:\rfllllr.exe113⤵PID:2516
-
\??\c:\lfllxfr.exec:\lfllxfr.exe114⤵PID:2996
-
\??\c:\flffffl.exec:\flffffl.exe115⤵PID:2768
-
\??\c:\tnhhtt.exec:\tnhhtt.exe116⤵PID:2244
-
\??\c:\ttnthb.exec:\ttnthb.exe117⤵PID:756
-
\??\c:\dddpd.exec:\dddpd.exe118⤵PID:2004
-
\??\c:\5jppv.exec:\5jppv.exe119⤵PID:1620
-
\??\c:\llxflxl.exec:\llxflxl.exe120⤵PID:3024
-
\??\c:\rlxfrrf.exec:\rlxfrrf.exe121⤵PID:984
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-