Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04-11-2024 03:19
Behavioral task
behavioral1
Sample
ae2c769cd1db718e8d4cd488d517941b1a8e3a3926d504bcd1841cf946f94dc4.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
General
-
Target
ae2c769cd1db718e8d4cd488d517941b1a8e3a3926d504bcd1841cf946f94dc4.exe
-
Size
3.7MB
-
MD5
ae0fc95b71170c92dc1df2f92664a50f
-
SHA1
3cfe597bf7564404a7a67c987cd1d70416d6a4c4
-
SHA256
ae2c769cd1db718e8d4cd488d517941b1a8e3a3926d504bcd1841cf946f94dc4
-
SHA512
02cad3cd87ce608c941149542bff752e99030c33f032278e91c43ee013d0fd1ea36f3a96e1a4d6860378d9cc6e2f7eadc41b1a09a5ad87751ec4d8b4d29ab40f
-
SSDEEP
49152:gCOfN6X5tLLQTg20ITS/PPs/1kS4eKRL/SRsj0Zuur1T75YqVUrmNF981:U6XLq/qPPslzKx/dJg1ErmNo
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 57 IoCs
resource yara_rule behavioral1/memory/2572-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2084-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3016-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2952-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2764-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2964-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2964-64-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/2964-61-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/2916-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2916-75-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2720-81-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2720-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2684-95-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3052-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3052-105-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3052-104-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1512-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1856-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2384-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1620-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2676-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2196-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2200-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1292-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2176-267-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2216-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1580-308-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/2248-315-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2952-328-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2876-343-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2916-366-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2600-391-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1728-412-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2008-425-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1332-444-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2852-465-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2292-476-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2076-483-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2904-490-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2292-497-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2104-504-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1632-525-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2476-537-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2180-574-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2612-625-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2768-632-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1392-693-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/1728-706-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2208-763-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1724-782-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2360-853-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/3016-886-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2376-893-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2680-950-0x00000000003D0000-0x00000000003F7000-memory.dmp family_blackmoon behavioral1/memory/1436-965-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1884-1010-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/620-1037-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Njrat family
-
Executes dropped EXE 64 IoCs
pid Process 2084 lrrrlxl.exe 3016 rrfxffx.exe 2952 pjjdj.exe 1444 jjpjj.exe 2764 frlfrll.exe 2964 bthhtt.exe 2916 xflflxr.exe 2720 xlflfrf.exe 2684 xfrlfxf.exe 3052 xxlrrll.exe 1512 rxflrrf.exe 840 jpppp.exe 1856 pdvpv.exe 1812 3frfrrl.exe 2384 rflfrrr.exe 1620 vvpjv.exe 1932 pjjjp.exe 2676 tbbhth.exe 584 rfxxxfx.exe 2312 nhnnth.exe 2196 djppp.exe 1724 pvppd.exe 1196 lrrflff.exe 1592 nthttb.exe 2200 vvjpd.exe 1292 ffrlrlr.exe 2448 lxlrfrf.exe 2176 1frrrfx.exe 328 bbhthh.exe 2440 nntbhn.exe 804 lrxxlxx.exe 2216 xxrrfrr.exe 1580 bhhnth.exe 2248 lrrlrfl.exe 3064 xrlllfx.exe 2112 fxlrxrx.exe 2952 nnnnnt.exe 3020 hhbhbh.exe 2876 nbbhht.exe 2888 jdddj.exe 2804 dpvpd.exe 2856 dpjpd.exe 2916 rxrfxlr.exe 2540 rlflxrl.exe 2728 9xfrxrf.exe 2600 lxxfxxr.exe 592 fllffxx.exe 1988 9nbnnt.exe 1288 1hntnb.exe 1728 ntbbbt.exe 2008 1thbtb.exe 2392 pjdvj.exe 1712 dpppv.exe 1332 pdvvd.exe 296 5vpvp.exe 1640 lrffxfx.exe 2784 llrxflx.exe 2852 9ntbth.exe 2292 tnnttn.exe 2076 thnhhb.exe 1132 bhbhhh.exe 2904 ttnhtn.exe 2104 vdjdj.exe 2320 vdddp.exe -
resource yara_rule behavioral1/memory/2572-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2572-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000d00000001227f-8.dat upx behavioral1/files/0x0008000000016d68-18.dat upx behavioral1/memory/2084-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2952-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d6d-28.dat upx behavioral1/memory/3016-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000016d4a-38.dat upx behavioral1/memory/2952-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d89-46.dat upx behavioral1/memory/2764-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000171a8-55.dat upx behavioral1/memory/2964-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000173a7-65.dat upx behavioral1/memory/2916-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000017488-73.dat upx behavioral1/files/0x0007000000019023-87.dat upx behavioral1/memory/2720-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2684-95-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3052-97-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001925e-96.dat upx behavioral1/files/0x0005000000019261-108.dat upx behavioral1/memory/3052-107-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1512-116-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019282-118.dat upx behavioral1/files/0x0005000000019334-124.dat upx behavioral1/memory/1856-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019350-132.dat upx behavioral1/files/0x00050000000193b4-144.dat upx behavioral1/files/0x00050000000193c2-153.dat upx behavioral1/memory/2384-152-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193e1-162.dat upx behavioral1/memory/1620-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001941e-170.dat upx behavioral1/files/0x0005000000019427-180.dat upx behavioral1/memory/2676-178-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019431-188.dat upx behavioral1/files/0x0005000000019441-196.dat upx behavioral1/memory/2196-197-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001944f-206.dat upx behavioral1/memory/2196-205-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019461-215.dat upx behavioral1/files/0x000500000001950c-224.dat upx behavioral1/files/0x0005000000019582-232.dat upx behavioral1/memory/2200-233-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195c5-239.dat upx behavioral1/files/0x0005000000019609-250.dat upx behavioral1/memory/1292-249-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001960b-259.dat upx behavioral1/memory/2176-267-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001960d-268.dat upx behavioral1/files/0x000500000001960f-277.dat upx behavioral1/files/0x0005000000019611-286.dat upx behavioral1/files/0x0005000000019613-293.dat upx behavioral1/memory/2216-301-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2248-315-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2952-328-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2916-366-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2728-379-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1728-412-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2008-425-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1332-444-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2904-490-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxfrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrlrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlxfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfxxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflxfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frllxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrxxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfrflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttthbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7flxrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nbtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhtht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfrrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlfxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxlrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbhbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfxxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vppv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2572 wrote to memory of 2084 2572 ae2c769cd1db718e8d4cd488d517941b1a8e3a3926d504bcd1841cf946f94dc4.exe 31 PID 2572 wrote to memory of 2084 2572 ae2c769cd1db718e8d4cd488d517941b1a8e3a3926d504bcd1841cf946f94dc4.exe 31 PID 2572 wrote to memory of 2084 2572 ae2c769cd1db718e8d4cd488d517941b1a8e3a3926d504bcd1841cf946f94dc4.exe 31 PID 2572 wrote to memory of 2084 2572 ae2c769cd1db718e8d4cd488d517941b1a8e3a3926d504bcd1841cf946f94dc4.exe 31 PID 2084 wrote to memory of 3016 2084 lrrrlxl.exe 32 PID 2084 wrote to memory of 3016 2084 lrrrlxl.exe 32 PID 2084 wrote to memory of 3016 2084 lrrrlxl.exe 32 PID 2084 wrote to memory of 3016 2084 lrrrlxl.exe 32 PID 3016 wrote to memory of 2952 3016 rrfxffx.exe 33 PID 3016 wrote to memory of 2952 3016 rrfxffx.exe 33 PID 3016 wrote to memory of 2952 3016 rrfxffx.exe 33 PID 3016 wrote to memory of 2952 3016 rrfxffx.exe 33 PID 2952 wrote to memory of 1444 2952 pjjdj.exe 34 PID 2952 wrote to memory of 1444 2952 pjjdj.exe 34 PID 2952 wrote to memory of 1444 2952 pjjdj.exe 34 PID 2952 wrote to memory of 1444 2952 pjjdj.exe 34 PID 1444 wrote to memory of 2764 1444 jjpjj.exe 35 PID 1444 wrote to memory of 2764 1444 jjpjj.exe 35 PID 1444 wrote to memory of 2764 1444 jjpjj.exe 35 PID 1444 wrote to memory of 2764 1444 jjpjj.exe 35 PID 2764 wrote to memory of 2964 2764 frlfrll.exe 36 PID 2764 wrote to memory of 2964 2764 frlfrll.exe 36 PID 2764 wrote to memory of 2964 2764 frlfrll.exe 36 PID 2764 wrote to memory of 2964 2764 frlfrll.exe 36 PID 2964 wrote to memory of 2916 2964 bthhtt.exe 37 PID 2964 wrote to memory of 2916 2964 bthhtt.exe 37 PID 2964 wrote to memory of 2916 2964 bthhtt.exe 37 PID 2964 wrote to memory of 2916 2964 bthhtt.exe 37 PID 2916 wrote to memory of 2720 2916 xflflxr.exe 38 PID 2916 wrote to memory of 2720 2916 xflflxr.exe 38 PID 2916 wrote to memory of 2720 2916 xflflxr.exe 38 PID 2916 wrote to memory of 2720 2916 xflflxr.exe 38 PID 2720 wrote to memory of 2684 2720 xlflfrf.exe 39 PID 2720 wrote to memory of 2684 2720 xlflfrf.exe 39 PID 2720 wrote to memory of 2684 2720 xlflfrf.exe 39 PID 2720 wrote to memory of 2684 2720 xlflfrf.exe 39 PID 2684 wrote to memory of 3052 2684 xfrlfxf.exe 40 PID 2684 wrote to memory of 3052 2684 xfrlfxf.exe 40 PID 2684 wrote to memory of 3052 2684 xfrlfxf.exe 40 PID 2684 wrote to memory of 3052 2684 xfrlfxf.exe 40 PID 3052 wrote to memory of 1512 3052 xxlrrll.exe 41 PID 3052 wrote to memory of 1512 3052 xxlrrll.exe 41 PID 3052 wrote to memory of 1512 3052 xxlrrll.exe 41 PID 3052 wrote to memory of 1512 3052 xxlrrll.exe 41 PID 1512 wrote to memory of 840 1512 rxflrrf.exe 42 PID 1512 wrote to memory of 840 1512 rxflrrf.exe 42 PID 1512 wrote to memory of 840 1512 rxflrrf.exe 42 PID 1512 wrote to memory of 840 1512 rxflrrf.exe 42 PID 840 wrote to memory of 1856 840 jpppp.exe 43 PID 840 wrote to memory of 1856 840 jpppp.exe 43 PID 840 wrote to memory of 1856 840 jpppp.exe 43 PID 840 wrote to memory of 1856 840 jpppp.exe 43 PID 1856 wrote to memory of 1812 1856 pdvpv.exe 44 PID 1856 wrote to memory of 1812 1856 pdvpv.exe 44 PID 1856 wrote to memory of 1812 1856 pdvpv.exe 44 PID 1856 wrote to memory of 1812 1856 pdvpv.exe 44 PID 1812 wrote to memory of 2384 1812 3frfrrl.exe 45 PID 1812 wrote to memory of 2384 1812 3frfrrl.exe 45 PID 1812 wrote to memory of 2384 1812 3frfrrl.exe 45 PID 1812 wrote to memory of 2384 1812 3frfrrl.exe 45 PID 2384 wrote to memory of 1620 2384 rflfrrr.exe 46 PID 2384 wrote to memory of 1620 2384 rflfrrr.exe 46 PID 2384 wrote to memory of 1620 2384 rflfrrr.exe 46 PID 2384 wrote to memory of 1620 2384 rflfrrr.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae2c769cd1db718e8d4cd488d517941b1a8e3a3926d504bcd1841cf946f94dc4.exe"C:\Users\Admin\AppData\Local\Temp\ae2c769cd1db718e8d4cd488d517941b1a8e3a3926d504bcd1841cf946f94dc4.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\lrrrlxl.exec:\lrrrlxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\rrfxffx.exec:\rrfxffx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\pjjdj.exec:\pjjdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\jjpjj.exec:\jjpjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\frlfrll.exec:\frlfrll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\bthhtt.exec:\bthhtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\xflflxr.exec:\xflflxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\xlflfrf.exec:\xlflfrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\xfrlfxf.exec:\xfrlfxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\xxlrrll.exec:\xxlrrll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\rxflrrf.exec:\rxflrrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\jpppp.exec:\jpppp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
\??\c:\pdvpv.exec:\pdvpv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
\??\c:\3frfrrl.exec:\3frfrrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\rflfrrr.exec:\rflfrrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\vvpjv.exec:\vvpjv.exe17⤵
- Executes dropped EXE
PID:1620 -
\??\c:\pjjjp.exec:\pjjjp.exe18⤵
- Executes dropped EXE
PID:1932 -
\??\c:\tbbhth.exec:\tbbhth.exe19⤵
- Executes dropped EXE
PID:2676 -
\??\c:\rfxxxfx.exec:\rfxxxfx.exe20⤵
- Executes dropped EXE
PID:584 -
\??\c:\nhnnth.exec:\nhnnth.exe21⤵
- Executes dropped EXE
PID:2312 -
\??\c:\djppp.exec:\djppp.exe22⤵
- Executes dropped EXE
PID:2196 -
\??\c:\pvppd.exec:\pvppd.exe23⤵
- Executes dropped EXE
PID:1724 -
\??\c:\lrrflff.exec:\lrrflff.exe24⤵
- Executes dropped EXE
PID:1196 -
\??\c:\nthttb.exec:\nthttb.exe25⤵
- Executes dropped EXE
PID:1592 -
\??\c:\vvjpd.exec:\vvjpd.exe26⤵
- Executes dropped EXE
PID:2200 -
\??\c:\ffrlrlr.exec:\ffrlrlr.exe27⤵
- Executes dropped EXE
PID:1292 -
\??\c:\lxlrfrf.exec:\lxlrfrf.exe28⤵
- Executes dropped EXE
PID:2448 -
\??\c:\1frrrfx.exec:\1frrrfx.exe29⤵
- Executes dropped EXE
PID:2176 -
\??\c:\bbhthh.exec:\bbhthh.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:328 -
\??\c:\nntbhn.exec:\nntbhn.exe31⤵
- Executes dropped EXE
PID:2440 -
\??\c:\lrxxlxx.exec:\lrxxlxx.exe32⤵
- Executes dropped EXE
PID:804 -
\??\c:\xxrrfrr.exec:\xxrrfrr.exe33⤵
- Executes dropped EXE
PID:2216 -
\??\c:\bhhnth.exec:\bhhnth.exe34⤵
- Executes dropped EXE
PID:1580 -
\??\c:\lrrlrfl.exec:\lrrlrfl.exe35⤵
- Executes dropped EXE
PID:2248 -
\??\c:\xrlllfx.exec:\xrlllfx.exe36⤵
- Executes dropped EXE
PID:3064 -
\??\c:\fxlrxrx.exec:\fxlrxrx.exe37⤵
- Executes dropped EXE
PID:2112 -
\??\c:\nnnnnt.exec:\nnnnnt.exe38⤵
- Executes dropped EXE
PID:2952 -
\??\c:\hhbhbh.exec:\hhbhbh.exe39⤵
- Executes dropped EXE
PID:3020 -
\??\c:\nbbhht.exec:\nbbhht.exe40⤵
- Executes dropped EXE
PID:2876 -
\??\c:\jdddj.exec:\jdddj.exe41⤵
- Executes dropped EXE
PID:2888 -
\??\c:\dpvpd.exec:\dpvpd.exe42⤵
- Executes dropped EXE
PID:2804 -
\??\c:\dpjpd.exec:\dpjpd.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2856 -
\??\c:\rxrfxlr.exec:\rxrfxlr.exe44⤵
- Executes dropped EXE
PID:2916 -
\??\c:\rlflxrl.exec:\rlflxrl.exe45⤵
- Executes dropped EXE
PID:2540 -
\??\c:\9xfrxrf.exec:\9xfrxrf.exe46⤵
- Executes dropped EXE
PID:2728 -
\??\c:\lxxfxxr.exec:\lxxfxxr.exe47⤵
- Executes dropped EXE
PID:2600 -
\??\c:\fllffxx.exec:\fllffxx.exe48⤵
- Executes dropped EXE
PID:592 -
\??\c:\9nbnnt.exec:\9nbnnt.exe49⤵
- Executes dropped EXE
PID:1988 -
\??\c:\1hntnb.exec:\1hntnb.exe50⤵
- Executes dropped EXE
PID:1288 -
\??\c:\ntbbbt.exec:\ntbbbt.exe51⤵
- Executes dropped EXE
PID:1728 -
\??\c:\1thbtb.exec:\1thbtb.exe52⤵
- Executes dropped EXE
PID:2008 -
\??\c:\pjdvj.exec:\pjdvj.exe53⤵
- Executes dropped EXE
PID:2392 -
\??\c:\dpppv.exec:\dpppv.exe54⤵
- Executes dropped EXE
PID:1712 -
\??\c:\pdvvd.exec:\pdvvd.exe55⤵
- Executes dropped EXE
PID:1332 -
\??\c:\5vpvp.exec:\5vpvp.exe56⤵
- Executes dropped EXE
PID:296 -
\??\c:\lrffxfx.exec:\lrffxfx.exe57⤵
- Executes dropped EXE
PID:1640 -
\??\c:\llrxflx.exec:\llrxflx.exe58⤵
- Executes dropped EXE
PID:2784 -
\??\c:\9ntbth.exec:\9ntbth.exe59⤵
- Executes dropped EXE
PID:2852 -
\??\c:\tnnttn.exec:\tnnttn.exe60⤵
- Executes dropped EXE
PID:2292 -
\??\c:\thnhhb.exec:\thnhhb.exe61⤵
- Executes dropped EXE
PID:2076 -
\??\c:\bhbhhh.exec:\bhbhhh.exe62⤵
- Executes dropped EXE
PID:1132 -
\??\c:\ttnhtn.exec:\ttnhtn.exe63⤵
- Executes dropped EXE
PID:2904 -
\??\c:\vdjdj.exec:\vdjdj.exe64⤵
- Executes dropped EXE
PID:2104 -
\??\c:\vdddp.exec:\vdddp.exe65⤵
- Executes dropped EXE
PID:2320 -
\??\c:\fxxrlrf.exec:\fxxrlrf.exe66⤵PID:2848
-
\??\c:\xxxffrx.exec:\xxxffrx.exe67⤵PID:904
-
\??\c:\xfrfrrf.exec:\xfrfrrf.exe68⤵PID:1632
-
\??\c:\bthnht.exec:\bthnht.exe69⤵PID:2436
-
\??\c:\hthhnt.exec:\hthhnt.exe70⤵
- System Location Discovery: System Language Discovery
PID:2476 -
\??\c:\bttnbb.exec:\bttnbb.exe71⤵PID:2064
-
\??\c:\dvjvd.exec:\dvjvd.exe72⤵
- System Location Discovery: System Language Discovery
PID:2176 -
\??\c:\jpdvj.exec:\jpdvj.exe73⤵PID:768
-
\??\c:\9bhthb.exec:\9bhthb.exe74⤵PID:600
-
\??\c:\hbhhnt.exec:\hbhhnt.exe75⤵PID:2180
-
\??\c:\pdjjd.exec:\pdjjd.exe76⤵
- System Location Discovery: System Language Discovery
PID:2060 -
\??\c:\vjvdp.exec:\vjvdp.exe77⤵PID:1556
-
\??\c:\jpddd.exec:\jpddd.exe78⤵PID:1584
-
\??\c:\rxxxfxx.exec:\rxxxfxx.exe79⤵PID:3012
-
\??\c:\xrflfxl.exec:\xrflfxl.exe80⤵PID:2268
-
\??\c:\llflxfr.exec:\llflxfr.exe81⤵PID:1644
-
\??\c:\nbhtth.exec:\nbhtth.exe82⤵PID:344
-
\??\c:\3hnbth.exec:\3hnbth.exe83⤵PID:2952
-
\??\c:\hhnhbh.exec:\hhnhbh.exe84⤵PID:2612
-
\??\c:\vdjvp.exec:\vdjvp.exe85⤵PID:2768
-
\??\c:\dddvj.exec:\dddvj.exe86⤵PID:2800
-
\??\c:\rllrllr.exec:\rllrllr.exe87⤵PID:2776
-
\??\c:\xlrrfff.exec:\xlrrfff.exe88⤵PID:2608
-
\??\c:\lxflrxf.exec:\lxflrxf.exe89⤵PID:2916
-
\??\c:\flllxrr.exec:\flllxrr.exe90⤵PID:2532
-
\??\c:\bnnttb.exec:\bnnttb.exe91⤵
- System Location Discovery: System Language Discovery
PID:1436 -
\??\c:\tnttbb.exec:\tnttbb.exe92⤵PID:1116
-
\??\c:\bnbbhb.exec:\bnbbhb.exe93⤵PID:592
-
\??\c:\jvpjj.exec:\jvpjj.exe94⤵PID:1392
-
\??\c:\jvjvv.exec:\jvjvv.exe95⤵PID:1288
-
\??\c:\dvjdp.exec:\dvjdp.exe96⤵PID:1728
-
\??\c:\jpdjj.exec:\jpdjj.exe97⤵PID:2008
-
\??\c:\vvvvp.exec:\vvvvp.exe98⤵PID:2392
-
\??\c:\jvpdp.exec:\jvpdp.exe99⤵PID:1712
-
\??\c:\llrffll.exec:\llrffll.exe100⤵PID:1332
-
\??\c:\rflflll.exec:\rflflll.exe101⤵PID:1960
-
\??\c:\5rrrfxl.exec:\5rrrfxl.exe102⤵PID:2844
-
\??\c:\jvvdd.exec:\jvvdd.exe103⤵PID:2784
-
\??\c:\rxrxlrl.exec:\rxrxlrl.exe104⤵PID:2852
-
\??\c:\vddpd.exec:\vddpd.exe105⤵
- System Location Discovery: System Language Discovery
PID:2948 -
\??\c:\9rrlxlf.exec:\9rrlxlf.exe106⤵PID:2208
-
\??\c:\rrlfflf.exec:\rrlfflf.exe107⤵PID:848
-
\??\c:\nbttbh.exec:\nbttbh.exe108⤵PID:1724
-
\??\c:\tnbbth.exec:\tnbbth.exe109⤵PID:1344
-
\??\c:\jjjpp.exec:\jjjpp.exe110⤵PID:1996
-
\??\c:\pjddj.exec:\pjddj.exe111⤵PID:1592
-
\??\c:\jvppj.exec:\jvppj.exe112⤵PID:1536
-
\??\c:\9vpvp.exec:\9vpvp.exe113⤵PID:2464
-
\??\c:\jjjvj.exec:\jjjvj.exe114⤵PID:2652
-
\??\c:\ddjdv.exec:\ddjdv.exe115⤵PID:2556
-
\??\c:\ppvvj.exec:\ppvvj.exe116⤵PID:2360
-
\??\c:\djddv.exec:\djddv.exe117⤵PID:1672
-
\??\c:\tbnhnh.exec:\tbnhnh.exe118⤵PID:332
-
\??\c:\ntnttn.exec:\ntnttn.exe119⤵
- System Location Discovery: System Language Discovery
PID:1748 -
\??\c:\nhhbbt.exec:\nhhbbt.exe120⤵PID:804
-
\??\c:\dvjvv.exec:\dvjvv.exe121⤵
- System Location Discovery: System Language Discovery
PID:2372 -
\??\c:\rxxffrx.exec:\rxxffrx.exe122⤵PID:1936
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-