Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
15/10/2024, 06:13
Behavioral task
behavioral1
Sample
6a4c3ef8318c558d0a741bf8fc234874c537351877b3af0ef1bd15e0d857d5e9N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
6a4c3ef8318c558d0a741bf8fc234874c537351877b3af0ef1bd15e0d857d5e9N.exe
-
Size
329KB
-
MD5
9bbec869bdcbc7d8b39e06bfb6341e10
-
SHA1
63d616f7b7ff315a5ed1df28ddb5da2d6d00e344
-
SHA256
6a4c3ef8318c558d0a741bf8fc234874c537351877b3af0ef1bd15e0d857d5e9
-
SHA512
03a8cf7572c147b02fd7195594ed9dd2da254fbc723b6f01a9217fabb59bded210f51f44d0ad4983413e713fea69819f1524e70215dbf71f96e916347d690314
-
SSDEEP
6144:vcm4FmowdHoStJdJIjaRleL42bL37BoTPkhu9gX5yGsTshQc8R0nxA5ij8+RC7tg:94wFHoStJdSjylh2b77BoTMA9gX59sT4
Malware Config
Signatures
-
Detect Blackmoon payload 52 IoCs
resource yara_rule behavioral1/memory/1848-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2176-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1872-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1644-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2760-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/264-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3048-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2772-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2632-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2632-82-0x0000000000260000-0x0000000000287000-memory.dmp family_blackmoon behavioral1/memory/2664-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2464-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2676-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1656-121-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/344-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/344-117-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1884-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1884-132-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2796-143-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2596-151-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2968-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1876-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1244-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1844-185-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2484-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2540-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2540-201-0x00000000005C0000-0x00000000005E7000-memory.dmp family_blackmoon behavioral1/memory/1696-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/340-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/768-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/776-286-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3028-288-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2404-303-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2808-329-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2232-350-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2624-371-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1936-399-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2952-410-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1700-416-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/844-438-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1880-449-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/788-461-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2992-680-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2156-717-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2156-723-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/544-745-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2312-756-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2772-877-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2284-1045-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2516-1081-0x00000000003D0000-0x00000000003F7000-memory.dmp family_blackmoon behavioral1/memory/1748-1178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2560-20705-0x00000000777D0000-0x00000000778EF000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2176 fxrfrrx.exe 1872 7bhthb.exe 1644 vvvjp.exe 264 ppjjd.exe 2760 lllfrxr.exe 3048 xfrrrfl.exe 2852 jvjpp.exe 2772 fxllrrf.exe 2632 bbbnhn.exe 2664 9llrxfr.exe 2676 9bhbhn.exe 2464 xlffffr.exe 344 lxlffff.exe 1656 ppdjv.exe 1884 lfflrrx.exe 2796 bbhbbt.exe 2596 7pvjv.exe 2968 flrxfll.exe 1876 3thhhn.exe 1244 jvppd.exe 1844 xrlxflf.exe 2484 ddvjd.exe 2540 xrrxlrf.exe 2108 rrrxlxl.exe 3064 lxlflll.exe 816 lfxlxxl.exe 340 dppvd.exe 1696 bbhbnb.exe 1052 tthbnt.exe 2196 ppjvd.exe 1648 ttthtn.exe 696 3djdp.exe 2188 fxllxxf.exe 768 bthntb.exe 776 7bbhtn.exe 3028 ddppv.exe 2096 jdvdp.exe 2404 lxllxxr.exe 2536 xfxxlff.exe 2552 3htbhn.exe 2372 vpjjp.exe 2800 1vvvj.exe 2808 lxlfllr.exe 2816 rlfflrl.exe 2740 bbttbn.exe 2236 1dpvj.exe 2232 pppvj.exe 2872 9lflxfl.exe 3016 nnhnbh.exe 2608 hbtthh.exe 2624 jjvjd.exe 2628 7lflrrr.exe 2328 lffrxxl.exe 1060 nnbbnb.exe 676 tnhnnt.exe 1936 vpjjp.exe 2368 vpjdp.exe 2952 7frxxfr.exe 1700 thtnbb.exe 2920 dddvj.exe 2680 3pjvj.exe 2984 rlxxxfr.exe 844 flrfrxl.exe 1876 nthbhb.exe -
resource yara_rule behavioral1/memory/1848-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1848-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000012116-7.dat upx behavioral1/memory/2176-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d9f-16.dat upx behavioral1/memory/2176-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1644-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1872-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016dc8-23.dat upx behavioral1/memory/1644-32-0x0000000001B70000-0x0000000001B97000-memory.dmp upx behavioral1/memory/1644-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/264-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016f9c-35.dat upx behavioral1/memory/2760-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000001739a-44.dat upx behavioral1/memory/264-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000001739c-51.dat upx behavioral1/memory/3048-53-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00090000000173aa-59.dat upx behavioral1/memory/2852-66-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x00080000000173e4-67.dat upx behavioral1/files/0x00050000000191f3-75.dat upx behavioral1/memory/2772-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2632-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000191f7-83.dat upx behavioral1/files/0x0005000000019218-92.dat upx behavioral1/memory/2664-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2464-103-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019229-102.dat upx behavioral1/memory/2676-101-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019234-109.dat upx behavioral1/memory/1656-121-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001924c-120.dat upx behavioral1/memory/344-119-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1884-129-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001926b-128.dat upx behavioral1/files/0x0005000000019271-136.dat upx behavioral1/files/0x0005000000019273-144.dat upx behavioral1/memory/2796-143-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019277-152.dat upx behavioral1/memory/2968-159-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1876-162-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019382-161.dat upx behavioral1/files/0x0009000000016d3f-169.dat upx behavioral1/files/0x0005000000019389-176.dat upx behavioral1/memory/1244-175-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1844-183-0x00000000002C0000-0x00000000002E7000-memory.dmp upx behavioral1/files/0x00050000000193be-186.dat upx behavioral1/files/0x00050000000193c4-194.dat upx behavioral1/memory/2484-192-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2540-203-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193cc-202.dat upx behavioral1/files/0x00050000000193d9-210.dat upx behavioral1/files/0x00050000000193df-217.dat upx behavioral1/files/0x0005000000019401-225.dat upx behavioral1/memory/816-218-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1696-235-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019403-233.dat upx behavioral1/memory/340-232-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001942f-241.dat upx behavioral1/files/0x0005000000019441-248.dat upx behavioral1/files/0x000500000001947e-255.dat upx behavioral1/files/0x00050000000194d8-262.dat upx behavioral1/memory/768-274-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nttbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffflllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nnnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btthnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrffrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxffrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrflllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrflxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrflllr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1848 wrote to memory of 2176 1848 6a4c3ef8318c558d0a741bf8fc234874c537351877b3af0ef1bd15e0d857d5e9N.exe 30 PID 1848 wrote to memory of 2176 1848 6a4c3ef8318c558d0a741bf8fc234874c537351877b3af0ef1bd15e0d857d5e9N.exe 30 PID 1848 wrote to memory of 2176 1848 6a4c3ef8318c558d0a741bf8fc234874c537351877b3af0ef1bd15e0d857d5e9N.exe 30 PID 1848 wrote to memory of 2176 1848 6a4c3ef8318c558d0a741bf8fc234874c537351877b3af0ef1bd15e0d857d5e9N.exe 30 PID 2176 wrote to memory of 1872 2176 fxrfrrx.exe 31 PID 2176 wrote to memory of 1872 2176 fxrfrrx.exe 31 PID 2176 wrote to memory of 1872 2176 fxrfrrx.exe 31 PID 2176 wrote to memory of 1872 2176 fxrfrrx.exe 31 PID 1872 wrote to memory of 1644 1872 7bhthb.exe 32 PID 1872 wrote to memory of 1644 1872 7bhthb.exe 32 PID 1872 wrote to memory of 1644 1872 7bhthb.exe 32 PID 1872 wrote to memory of 1644 1872 7bhthb.exe 32 PID 1644 wrote to memory of 264 1644 vvvjp.exe 33 PID 1644 wrote to memory of 264 1644 vvvjp.exe 33 PID 1644 wrote to memory of 264 1644 vvvjp.exe 33 PID 1644 wrote to memory of 264 1644 vvvjp.exe 33 PID 264 wrote to memory of 2760 264 ppjjd.exe 34 PID 264 wrote to memory of 2760 264 ppjjd.exe 34 PID 264 wrote to memory of 2760 264 ppjjd.exe 34 PID 264 wrote to memory of 2760 264 ppjjd.exe 34 PID 2760 wrote to memory of 3048 2760 lllfrxr.exe 35 PID 2760 wrote to memory of 3048 2760 lllfrxr.exe 35 PID 2760 wrote to memory of 3048 2760 lllfrxr.exe 35 PID 2760 wrote to memory of 3048 2760 lllfrxr.exe 35 PID 3048 wrote to memory of 2852 3048 xfrrrfl.exe 36 PID 3048 wrote to memory of 2852 3048 xfrrrfl.exe 36 PID 3048 wrote to memory of 2852 3048 xfrrrfl.exe 36 PID 3048 wrote to memory of 2852 3048 xfrrrfl.exe 36 PID 2852 wrote to memory of 2772 2852 jvjpp.exe 37 PID 2852 wrote to memory of 2772 2852 jvjpp.exe 37 PID 2852 wrote to memory of 2772 2852 jvjpp.exe 37 PID 2852 wrote to memory of 2772 2852 jvjpp.exe 37 PID 2772 wrote to memory of 2632 2772 fxllrrf.exe 38 PID 2772 wrote to memory of 2632 2772 fxllrrf.exe 38 PID 2772 wrote to memory of 2632 2772 fxllrrf.exe 38 PID 2772 wrote to memory of 2632 2772 fxllrrf.exe 38 PID 2632 wrote to memory of 2664 2632 bbbnhn.exe 39 PID 2632 wrote to memory of 2664 2632 bbbnhn.exe 39 PID 2632 wrote to memory of 2664 2632 bbbnhn.exe 39 PID 2632 wrote to memory of 2664 2632 bbbnhn.exe 39 PID 2664 wrote to memory of 2676 2664 9llrxfr.exe 40 PID 2664 wrote to memory of 2676 2664 9llrxfr.exe 40 PID 2664 wrote to memory of 2676 2664 9llrxfr.exe 40 PID 2664 wrote to memory of 2676 2664 9llrxfr.exe 40 PID 2676 wrote to memory of 2464 2676 9bhbhn.exe 41 PID 2676 wrote to memory of 2464 2676 9bhbhn.exe 41 PID 2676 wrote to memory of 2464 2676 9bhbhn.exe 41 PID 2676 wrote to memory of 2464 2676 9bhbhn.exe 41 PID 2464 wrote to memory of 344 2464 xlffffr.exe 42 PID 2464 wrote to memory of 344 2464 xlffffr.exe 42 PID 2464 wrote to memory of 344 2464 xlffffr.exe 42 PID 2464 wrote to memory of 344 2464 xlffffr.exe 42 PID 344 wrote to memory of 1656 344 lxlffff.exe 43 PID 344 wrote to memory of 1656 344 lxlffff.exe 43 PID 344 wrote to memory of 1656 344 lxlffff.exe 43 PID 344 wrote to memory of 1656 344 lxlffff.exe 43 PID 1656 wrote to memory of 1884 1656 ppdjv.exe 44 PID 1656 wrote to memory of 1884 1656 ppdjv.exe 44 PID 1656 wrote to memory of 1884 1656 ppdjv.exe 44 PID 1656 wrote to memory of 1884 1656 ppdjv.exe 44 PID 1884 wrote to memory of 2796 1884 lfflrrx.exe 45 PID 1884 wrote to memory of 2796 1884 lfflrrx.exe 45 PID 1884 wrote to memory of 2796 1884 lfflrrx.exe 45 PID 1884 wrote to memory of 2796 1884 lfflrrx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\6a4c3ef8318c558d0a741bf8fc234874c537351877b3af0ef1bd15e0d857d5e9N.exe"C:\Users\Admin\AppData\Local\Temp\6a4c3ef8318c558d0a741bf8fc234874c537351877b3af0ef1bd15e0d857d5e9N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1848 -
\??\c:\fxrfrrx.exec:\fxrfrrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\7bhthb.exec:\7bhthb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\vvvjp.exec:\vvvjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\ppjjd.exec:\ppjjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:264 -
\??\c:\lllfrxr.exec:\lllfrxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\xfrrrfl.exec:\xfrrrfl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\jvjpp.exec:\jvjpp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\fxllrrf.exec:\fxllrrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\bbbnhn.exec:\bbbnhn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\9llrxfr.exec:\9llrxfr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\9bhbhn.exec:\9bhbhn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\xlffffr.exec:\xlffffr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\lxlffff.exec:\lxlffff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:344 -
\??\c:\ppdjv.exec:\ppdjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\lfflrrx.exec:\lfflrrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\bbhbbt.exec:\bbhbbt.exe17⤵
- Executes dropped EXE
PID:2796 -
\??\c:\7pvjv.exec:\7pvjv.exe18⤵
- Executes dropped EXE
PID:2596 -
\??\c:\flrxfll.exec:\flrxfll.exe19⤵
- Executes dropped EXE
PID:2968 -
\??\c:\3thhhn.exec:\3thhhn.exe20⤵
- Executes dropped EXE
PID:1876 -
\??\c:\jvppd.exec:\jvppd.exe21⤵
- Executes dropped EXE
PID:1244 -
\??\c:\xrlxflf.exec:\xrlxflf.exe22⤵
- Executes dropped EXE
PID:1844 -
\??\c:\ddvjd.exec:\ddvjd.exe23⤵
- Executes dropped EXE
PID:2484 -
\??\c:\xrrxlrf.exec:\xrrxlrf.exe24⤵
- Executes dropped EXE
PID:2540 -
\??\c:\rrrxlxl.exec:\rrrxlxl.exe25⤵
- Executes dropped EXE
PID:2108 -
\??\c:\lxlflll.exec:\lxlflll.exe26⤵
- Executes dropped EXE
PID:3064 -
\??\c:\lfxlxxl.exec:\lfxlxxl.exe27⤵
- Executes dropped EXE
PID:816 -
\??\c:\dppvd.exec:\dppvd.exe28⤵
- Executes dropped EXE
PID:340 -
\??\c:\bbhbnb.exec:\bbhbnb.exe29⤵
- Executes dropped EXE
PID:1696 -
\??\c:\tthbnt.exec:\tthbnt.exe30⤵
- Executes dropped EXE
PID:1052 -
\??\c:\ppjvd.exec:\ppjvd.exe31⤵
- Executes dropped EXE
PID:2196 -
\??\c:\ttthtn.exec:\ttthtn.exe32⤵
- Executes dropped EXE
PID:1648 -
\??\c:\3djdp.exec:\3djdp.exe33⤵
- Executes dropped EXE
PID:696 -
\??\c:\fxllxxf.exec:\fxllxxf.exe34⤵
- Executes dropped EXE
PID:2188 -
\??\c:\bthntb.exec:\bthntb.exe35⤵
- Executes dropped EXE
PID:768 -
\??\c:\7bbhtn.exec:\7bbhtn.exe36⤵
- Executes dropped EXE
PID:776 -
\??\c:\ddppv.exec:\ddppv.exe37⤵
- Executes dropped EXE
PID:3028 -
\??\c:\jdvdp.exec:\jdvdp.exe38⤵
- Executes dropped EXE
PID:2096 -
\??\c:\lxllxxr.exec:\lxllxxr.exe39⤵
- Executes dropped EXE
PID:2404 -
\??\c:\xfxxlff.exec:\xfxxlff.exe40⤵
- Executes dropped EXE
PID:2536 -
\??\c:\3htbhn.exec:\3htbhn.exe41⤵
- Executes dropped EXE
PID:2552 -
\??\c:\vpjjp.exec:\vpjjp.exe42⤵
- Executes dropped EXE
PID:2372 -
\??\c:\1vvvj.exec:\1vvvj.exe43⤵
- Executes dropped EXE
PID:2800 -
\??\c:\lxlfllr.exec:\lxlfllr.exe44⤵
- Executes dropped EXE
PID:2808 -
\??\c:\rlfflrl.exec:\rlfflrl.exe45⤵
- Executes dropped EXE
PID:2816 -
\??\c:\bbttbn.exec:\bbttbn.exe46⤵
- Executes dropped EXE
PID:2740 -
\??\c:\1dpvj.exec:\1dpvj.exe47⤵
- Executes dropped EXE
PID:2236 -
\??\c:\pppvj.exec:\pppvj.exe48⤵
- Executes dropped EXE
PID:2232 -
\??\c:\9lflxfl.exec:\9lflxfl.exe49⤵
- Executes dropped EXE
PID:2872 -
\??\c:\nnhnbh.exec:\nnhnbh.exe50⤵
- Executes dropped EXE
PID:3016 -
\??\c:\hbtthh.exec:\hbtthh.exe51⤵
- Executes dropped EXE
PID:2608 -
\??\c:\jjvjd.exec:\jjvjd.exe52⤵
- Executes dropped EXE
PID:2624 -
\??\c:\7lflrrr.exec:\7lflrrr.exe53⤵
- Executes dropped EXE
PID:2628 -
\??\c:\lffrxxl.exec:\lffrxxl.exe54⤵
- Executes dropped EXE
PID:2328 -
\??\c:\nnbbnb.exec:\nnbbnb.exe55⤵
- Executes dropped EXE
PID:1060 -
\??\c:\tnhnnt.exec:\tnhnnt.exe56⤵
- Executes dropped EXE
PID:676 -
\??\c:\vpjjp.exec:\vpjjp.exe57⤵
- Executes dropped EXE
PID:1936 -
\??\c:\vpjdp.exec:\vpjdp.exe58⤵
- Executes dropped EXE
PID:2368 -
\??\c:\7frxxfr.exec:\7frxxfr.exe59⤵
- Executes dropped EXE
PID:2952 -
\??\c:\thtnbb.exec:\thtnbb.exe60⤵
- Executes dropped EXE
PID:1700 -
\??\c:\dddvj.exec:\dddvj.exe61⤵
- Executes dropped EXE
PID:2920 -
\??\c:\3pjvj.exec:\3pjvj.exe62⤵
- Executes dropped EXE
PID:2680 -
\??\c:\rlxxxfr.exec:\rlxxxfr.exe63⤵
- Executes dropped EXE
PID:2984 -
\??\c:\flrfrxl.exec:\flrfrxl.exe64⤵
- Executes dropped EXE
PID:844 -
\??\c:\nthbhb.exec:\nthbhb.exe65⤵
- Executes dropped EXE
PID:1876 -
\??\c:\5dvdp.exec:\5dvdp.exe66⤵PID:1880
-
\??\c:\ddddv.exec:\ddddv.exe67⤵PID:2216
-
\??\c:\lxrfffl.exec:\lxrfffl.exe68⤵PID:1836
-
\??\c:\ttttnt.exec:\ttttnt.exe69⤵PID:788
-
\??\c:\hnhntb.exec:\hnhntb.exe70⤵PID:2544
-
\??\c:\jjvjd.exec:\jjvjd.exe71⤵PID:2240
-
\??\c:\rlffffl.exec:\rlffffl.exe72⤵PID:1116
-
\??\c:\1lxfflx.exec:\1lxfflx.exe73⤵PID:3060
-
\??\c:\hthbhh.exec:\hthbhh.exe74⤵PID:2788
-
\??\c:\ddvvv.exec:\ddvvv.exe75⤵PID:884
-
\??\c:\3jjjj.exec:\3jjjj.exe76⤵PID:340
-
\??\c:\9rrlxlr.exec:\9rrlxlr.exe77⤵PID:1692
-
\??\c:\hhbhbh.exec:\hhbhbh.exe78⤵PID:2480
-
\??\c:\3vjpp.exec:\3vjpp.exe79⤵PID:1240
-
\??\c:\ffxrflx.exec:\ffxrflx.exe80⤵PID:2196
-
\??\c:\hhtbtb.exec:\hhtbtb.exe81⤵PID:2008
-
\??\c:\tttbnt.exec:\tttbnt.exe82⤵PID:2192
-
\??\c:\pdvdd.exec:\pdvdd.exe83⤵PID:1264
-
\??\c:\rrrflxl.exec:\rrrflxl.exe84⤵PID:1848
-
\??\c:\hnntnn.exec:\hnntnn.exe85⤵PID:2696
-
\??\c:\ttthtt.exec:\ttthtt.exe86⤵PID:1732
-
\??\c:\3pdpj.exec:\3pdpj.exe87⤵PID:1512
-
\??\c:\7ffxfxf.exec:\7ffxfxf.exe88⤵PID:2404
-
\??\c:\bththt.exec:\bththt.exe89⤵PID:1612
-
\??\c:\bttnbh.exec:\bttnbh.exe90⤵PID:1484
-
\??\c:\ddjpd.exec:\ddjpd.exe91⤵PID:264
-
\??\c:\ffrrrfr.exec:\ffrrrfr.exe92⤵PID:2756
-
\??\c:\llfrflx.exec:\llfrflx.exe93⤵PID:2760
-
\??\c:\5bthnn.exec:\5bthnn.exe94⤵PID:2812
-
\??\c:\9dvjp.exec:\9dvjp.exe95⤵PID:2616
-
\??\c:\lffrffx.exec:\lffrffx.exe96⤵PID:2728
-
\??\c:\xlllfrf.exec:\xlllfrf.exe97⤵PID:1976
-
\??\c:\9nhntn.exec:\9nhntn.exe98⤵PID:2772
-
\??\c:\ddjdv.exec:\ddjdv.exe99⤵PID:2632
-
\??\c:\flflrrr.exec:\flflrrr.exe100⤵PID:2640
-
\??\c:\xrllxxl.exec:\xrllxxl.exe101⤵PID:276
-
\??\c:\bbbttb.exec:\bbbttb.exe102⤵PID:2660
-
\??\c:\pvpdp.exec:\pvpdp.exe103⤵PID:908
-
\??\c:\djvvv.exec:\djvvv.exe104⤵PID:268
-
\??\c:\xrflrff.exec:\xrflrff.exe105⤵PID:2956
-
\??\c:\ttthtb.exec:\ttthtb.exe106⤵PID:1904
-
\??\c:\vjvjp.exec:\vjvjp.exe107⤵PID:2572
-
\??\c:\9rrxxxx.exec:\9rrxxxx.exe108⤵PID:556
-
\??\c:\hbnbnt.exec:\hbnbnt.exe109⤵PID:2672
-
\??\c:\btbtbh.exec:\btbtbh.exe110⤵PID:2992
-
\??\c:\dddjd.exec:\dddjd.exe111⤵PID:2972
-
\??\c:\3rrxxlr.exec:\3rrxxlr.exe112⤵PID:1828
-
\??\c:\3nnbnt.exec:\3nnbnt.exe113⤵PID:1148
-
\??\c:\7bthnt.exec:\7bthnt.exe114⤵PID:1680
-
\??\c:\jjdjd.exec:\jjdjd.exe115⤵PID:1244
-
\??\c:\ffflxfr.exec:\ffflxfr.exe116⤵PID:2076
-
\??\c:\9lrfrff.exec:\9lrfrff.exe117⤵PID:1012
-
\??\c:\hhtbth.exec:\hhtbth.exe118⤵PID:2156
-
\??\c:\tbhhtn.exec:\tbhhtn.exe119⤵PID:2092
-
\??\c:\7fxxlfr.exec:\7fxxlfr.exe120⤵PID:2044
-
\??\c:\llxlxxl.exec:\llxlxxl.exe121⤵PID:2240
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-