Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21-11-2024 19:18
Static task
static1
Behavioral task
behavioral1
Sample
007444a860cb0c8cf3f21edfd5cf272ddc34f6beafc63ca3f81fb63528c0ceed.exe
Resource
win7-20240903-en
General
-
Target
007444a860cb0c8cf3f21edfd5cf272ddc34f6beafc63ca3f81fb63528c0ceed.exe
-
Size
347KB
-
MD5
b4e5c9ebabf727f2d7bab7cea1d15e69
-
SHA1
a7bccbd9363215628f854dbbfa0cadfd62ef32a4
-
SHA256
007444a860cb0c8cf3f21edfd5cf272ddc34f6beafc63ca3f81fb63528c0ceed
-
SHA512
164d56802d0b1935d5ba2d46a9a62c33e063f95e9ffe0eb66a611215e6b03ebf111a865c7e05177dce4acf66d97a050d94f083c3bc0ee7bfe50b715b38cffc7a
-
SSDEEP
6144:Xcm7ImGddXgYW5fNZWB5hFfci3Add4kGYA4:l7TcbWXZshJX2VGd4
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 43 IoCs
Processes:
resource yara_rule behavioral1/memory/2260-0-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2700-18-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2704-26-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2756-36-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2776-44-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2604-54-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/276-80-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2588-90-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2088-99-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2876-109-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2608-124-0x0000000000430000-0x0000000000458000-memory.dmp family_blackmoon behavioral1/memory/2608-126-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1688-139-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1240-136-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2032-173-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2460-183-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2344-188-0x00000000001B0000-0x00000000001D8000-memory.dmp family_blackmoon behavioral1/memory/444-201-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/840-221-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1864-231-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2200-242-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1120-275-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1000-292-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/3040-297-0x0000000077B30000-0x0000000077C2A000-memory.dmp family_blackmoon behavioral1/memory/3040-296-0x0000000077A10000-0x0000000077B2F000-memory.dmp family_blackmoon behavioral1/memory/2788-312-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2704-319-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2712-327-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/3000-360-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1096-368-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1096-367-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2216-374-0x0000000001B60000-0x0000000001B88000-memory.dmp family_blackmoon behavioral1/memory/2588-377-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2216-376-0x0000000001B60000-0x0000000001B88000-memory.dmp family_blackmoon behavioral1/memory/1304-415-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/3060-443-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1984-481-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2152-488-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2512-522-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2236-565-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2120-573-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1820-712-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/664-795-0x00000000001B0000-0x00000000001D8000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
xlrrlrx.exerrrrlfr.exennntnb.exevvddv.exelfrrfrx.exepdvvd.exerrrxrrx.exedvjpj.exerlflrfl.exehbhhhh.exe9ppdp.exehhtntb.exeddvjv.exexxrxlrx.exe9nhhtb.exepjjpd.exerllflxl.exevvvjd.exellxlxfl.exe3pjpp.exe1lxlfrl.exehhbbnb.exedvpvd.exettnnbh.exepjjvd.exe1fflxfr.exe3bthtb.exe9rflrxf.exebthtbb.exefxxfrxr.exefflrlxr.exe7vvvj.exexrrfrxf.exefxllrxf.exebtbbhh.exepjpdd.exe3lxrflx.exe5thnth.exejdvdv.exedjjdd.exelflfllr.exenhbnbn.exejpvdj.exevvdpj.exexrffrrf.exe1bbhbh.exejdvvd.exefxxfffr.exerfrxlll.exehhnttb.exejdvjj.exelfrxxrf.exettnbtb.exehbbhtt.exevdjvp.exelrrfrxf.exelrlxllx.exe3bthnb.exejjjpv.exerlfflrf.exexxrlrxx.exebtntnn.exejjdpv.exe5ddpv.exepid Process 2700 xlrrlrx.exe 2704 rrrrlfr.exe 2756 nnntnb.exe 2776 vvddv.exe 2604 lfrrfrx.exe 1204 pdvvd.exe 3056 rrrxrrx.exe 276 dvjpj.exe 2588 rlflrfl.exe 2088 hbhhhh.exe 2876 9ppdp.exe 2312 hhtntb.exe 2608 ddvjv.exe 1240 xxrxlrx.exe 1688 9nhhtb.exe 1820 pjjpd.exe 588 rllflxl.exe 2032 vvvjd.exe 2460 llxlxfl.exe 2344 3pjpp.exe 444 1lxlfrl.exe 1920 hhbbnb.exe 840 dvpvd.exe 1864 ttnnbh.exe 2200 pjjvd.exe 2224 1fflxfr.exe 1048 3bthtb.exe 2072 9rflrxf.exe 1120 bthtbb.exe 1748 fxxfrxr.exe 1000 fflrlxr.exe 3040 7vvvj.exe 2788 xrrfrxf.exe 2704 fxllrxf.exe 2712 btbbhh.exe 888 pjpdd.exe 2548 3lxrflx.exe 2604 5thnth.exe 1856 jdvdv.exe 3000 djjdd.exe 1096 lflfllr.exe 2216 nhbnbn.exe 2588 jpvdj.exe 236 vvdpj.exe 2044 xrffrrf.exe 2440 1bbhbh.exe 1700 jdvvd.exe 1304 fxxfffr.exe 2760 rfrxlll.exe 2640 hhnttb.exe 536 jdvjj.exe 1936 lfrxxrf.exe 3060 ttnbtb.exe 2084 hbbhtt.exe 1444 vdjvp.exe 2460 lrrfrxf.exe 1076 lrlxllx.exe 1984 3bthnb.exe 2152 jjjpv.exe 956 rlfflrf.exe 2512 xxrlrxx.exe 1292 btntnn.exe 2956 jjdpv.exe 2200 5ddpv.exe -
Processes:
resource yara_rule behavioral1/memory/2260-0-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2700-9-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2700-18-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2704-26-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2756-36-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2776-44-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2604-54-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/276-72-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/276-80-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2588-90-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2088-92-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2088-99-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2876-109-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2608-126-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1240-128-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1688-139-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1240-136-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2032-165-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2032-173-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2344-184-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2460-183-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/444-201-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/840-221-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1864-231-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2200-242-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1120-275-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1000-292-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2072-293-0x0000000000220000-0x0000000000248000-memory.dmp upx behavioral1/memory/2788-312-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2712-320-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2712-327-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/3000-360-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1096-368-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2588-377-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2216-376-0x0000000001B60000-0x0000000001B88000-memory.dmp upx behavioral1/memory/2044-390-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1304-415-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/536-429-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/3060-443-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1444-456-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2152-488-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2512-495-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2152-508-0x0000000000220000-0x0000000000248000-memory.dmp upx behavioral1/memory/2236-535-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2120-573-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2780-592-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/3056-631-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1732-686-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1820-712-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/3060-725-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/760-770-0x0000000000400000-0x0000000000428000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
fxlfrxf.exejddpp.exejdpvv.exelfrrxff.exettbbnt.exehhbnhb.exerxrfxll.exe3rlfrrl.exexrlxffx.exejddpj.exexrrxrxr.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlfrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrfxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rlfrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlxffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrxrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
007444a860cb0c8cf3f21edfd5cf272ddc34f6beafc63ca3f81fb63528c0ceed.exexlrrlrx.exerrrrlfr.exennntnb.exevvddv.exelfrrfrx.exepdvvd.exerrrxrrx.exedvjpj.exerlflrfl.exehbhhhh.exe9ppdp.exehhtntb.exeddvjv.exexxrxlrx.exe9nhhtb.exedescription pid Process procid_target PID 2260 wrote to memory of 2700 2260 007444a860cb0c8cf3f21edfd5cf272ddc34f6beafc63ca3f81fb63528c0ceed.exe 30 PID 2260 wrote to memory of 2700 2260 007444a860cb0c8cf3f21edfd5cf272ddc34f6beafc63ca3f81fb63528c0ceed.exe 30 PID 2260 wrote to memory of 2700 2260 007444a860cb0c8cf3f21edfd5cf272ddc34f6beafc63ca3f81fb63528c0ceed.exe 30 PID 2260 wrote to memory of 2700 2260 007444a860cb0c8cf3f21edfd5cf272ddc34f6beafc63ca3f81fb63528c0ceed.exe 30 PID 2700 wrote to memory of 2704 2700 xlrrlrx.exe 31 PID 2700 wrote to memory of 2704 2700 xlrrlrx.exe 31 PID 2700 wrote to memory of 2704 2700 xlrrlrx.exe 31 PID 2700 wrote to memory of 2704 2700 xlrrlrx.exe 31 PID 2704 wrote to memory of 2756 2704 rrrrlfr.exe 32 PID 2704 wrote to memory of 2756 2704 rrrrlfr.exe 32 PID 2704 wrote to memory of 2756 2704 rrrrlfr.exe 32 PID 2704 wrote to memory of 2756 2704 rrrrlfr.exe 32 PID 2756 wrote to memory of 2776 2756 nnntnb.exe 33 PID 2756 wrote to memory of 2776 2756 nnntnb.exe 33 PID 2756 wrote to memory of 2776 2756 nnntnb.exe 33 PID 2756 wrote to memory of 2776 2756 nnntnb.exe 33 PID 2776 wrote to memory of 2604 2776 vvddv.exe 34 PID 2776 wrote to memory of 2604 2776 vvddv.exe 34 PID 2776 wrote to memory of 2604 2776 vvddv.exe 34 PID 2776 wrote to memory of 2604 2776 vvddv.exe 34 PID 2604 wrote to memory of 1204 2604 lfrrfrx.exe 35 PID 2604 wrote to memory of 1204 2604 lfrrfrx.exe 35 PID 2604 wrote to memory of 1204 2604 lfrrfrx.exe 35 PID 2604 wrote to memory of 1204 2604 lfrrfrx.exe 35 PID 1204 wrote to memory of 3056 1204 pdvvd.exe 36 PID 1204 wrote to memory of 3056 1204 pdvvd.exe 36 PID 1204 wrote to memory of 3056 1204 pdvvd.exe 36 PID 1204 wrote to memory of 3056 1204 pdvvd.exe 36 PID 3056 wrote to memory of 276 3056 rrrxrrx.exe 37 PID 3056 wrote to memory of 276 3056 rrrxrrx.exe 37 PID 3056 wrote to memory of 276 3056 rrrxrrx.exe 37 PID 3056 wrote to memory of 276 3056 rrrxrrx.exe 37 PID 276 wrote to memory of 2588 276 dvjpj.exe 38 PID 276 wrote to memory of 2588 276 dvjpj.exe 38 PID 276 wrote to memory of 2588 276 dvjpj.exe 38 PID 276 wrote to memory of 2588 276 dvjpj.exe 38 PID 2588 wrote to memory of 2088 2588 rlflrfl.exe 39 PID 2588 wrote to memory of 2088 2588 rlflrfl.exe 39 PID 2588 wrote to memory of 2088 2588 rlflrfl.exe 39 PID 2588 wrote to memory of 2088 2588 rlflrfl.exe 39 PID 2088 wrote to memory of 2876 2088 hbhhhh.exe 40 PID 2088 wrote to memory of 2876 2088 hbhhhh.exe 40 PID 2088 wrote to memory of 2876 2088 hbhhhh.exe 40 PID 2088 wrote to memory of 2876 2088 hbhhhh.exe 40 PID 2876 wrote to memory of 2312 2876 9ppdp.exe 41 PID 2876 wrote to memory of 2312 2876 9ppdp.exe 41 PID 2876 wrote to memory of 2312 2876 9ppdp.exe 41 PID 2876 wrote to memory of 2312 2876 9ppdp.exe 41 PID 2312 wrote to memory of 2608 2312 hhtntb.exe 42 PID 2312 wrote to memory of 2608 2312 hhtntb.exe 42 PID 2312 wrote to memory of 2608 2312 hhtntb.exe 42 PID 2312 wrote to memory of 2608 2312 hhtntb.exe 42 PID 2608 wrote to memory of 1240 2608 ddvjv.exe 43 PID 2608 wrote to memory of 1240 2608 ddvjv.exe 43 PID 2608 wrote to memory of 1240 2608 ddvjv.exe 43 PID 2608 wrote to memory of 1240 2608 ddvjv.exe 43 PID 1240 wrote to memory of 1688 1240 xxrxlrx.exe 44 PID 1240 wrote to memory of 1688 1240 xxrxlrx.exe 44 PID 1240 wrote to memory of 1688 1240 xxrxlrx.exe 44 PID 1240 wrote to memory of 1688 1240 xxrxlrx.exe 44 PID 1688 wrote to memory of 1820 1688 9nhhtb.exe 45 PID 1688 wrote to memory of 1820 1688 9nhhtb.exe 45 PID 1688 wrote to memory of 1820 1688 9nhhtb.exe 45 PID 1688 wrote to memory of 1820 1688 9nhhtb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\007444a860cb0c8cf3f21edfd5cf272ddc34f6beafc63ca3f81fb63528c0ceed.exe"C:\Users\Admin\AppData\Local\Temp\007444a860cb0c8cf3f21edfd5cf272ddc34f6beafc63ca3f81fb63528c0ceed.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\xlrrlrx.exec:\xlrrlrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\rrrrlfr.exec:\rrrrlfr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\nnntnb.exec:\nnntnb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\vvddv.exec:\vvddv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\lfrrfrx.exec:\lfrrfrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\pdvvd.exec:\pdvvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
\??\c:\rrrxrrx.exec:\rrrxrrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\dvjpj.exec:\dvjpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:276 -
\??\c:\rlflrfl.exec:\rlflrfl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\hbhhhh.exec:\hbhhhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\9ppdp.exec:\9ppdp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\hhtntb.exec:\hhtntb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\ddvjv.exec:\ddvjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\xxrxlrx.exec:\xxrxlrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\9nhhtb.exec:\9nhhtb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\pjjpd.exec:\pjjpd.exe17⤵
- Executes dropped EXE
PID:1820 -
\??\c:\rllflxl.exec:\rllflxl.exe18⤵
- Executes dropped EXE
PID:588 -
\??\c:\vvvjd.exec:\vvvjd.exe19⤵
- Executes dropped EXE
PID:2032 -
\??\c:\llxlxfl.exec:\llxlxfl.exe20⤵
- Executes dropped EXE
PID:2460 -
\??\c:\3pjpp.exec:\3pjpp.exe21⤵
- Executes dropped EXE
PID:2344 -
\??\c:\1lxlfrl.exec:\1lxlfrl.exe22⤵
- Executes dropped EXE
PID:444 -
\??\c:\hhbbnb.exec:\hhbbnb.exe23⤵
- Executes dropped EXE
PID:1920 -
\??\c:\dvpvd.exec:\dvpvd.exe24⤵
- Executes dropped EXE
PID:840 -
\??\c:\ttnnbh.exec:\ttnnbh.exe25⤵
- Executes dropped EXE
PID:1864 -
\??\c:\pjjvd.exec:\pjjvd.exe26⤵
- Executes dropped EXE
PID:2200 -
\??\c:\1fflxfr.exec:\1fflxfr.exe27⤵
- Executes dropped EXE
PID:2224 -
\??\c:\3bthtb.exec:\3bthtb.exe28⤵
- Executes dropped EXE
PID:1048 -
\??\c:\9rflrxf.exec:\9rflrxf.exe29⤵
- Executes dropped EXE
PID:2072 -
\??\c:\bthtbb.exec:\bthtbb.exe30⤵
- Executes dropped EXE
PID:1120 -
\??\c:\fxxfrxr.exec:\fxxfrxr.exe31⤵
- Executes dropped EXE
PID:1748 -
\??\c:\fflrlxr.exec:\fflrlxr.exe32⤵
- Executes dropped EXE
PID:1000 -
\??\c:\7vvvj.exec:\7vvvj.exe33⤵
- Executes dropped EXE
PID:3040 -
\??\c:\xrfrrrr.exec:\xrfrrrr.exe34⤵PID:1592
-
\??\c:\xrrfrxf.exec:\xrrfrxf.exe35⤵
- Executes dropped EXE
PID:2788 -
\??\c:\fxllrxf.exec:\fxllrxf.exe36⤵
- Executes dropped EXE
PID:2704 -
\??\c:\btbbhh.exec:\btbbhh.exe37⤵
- Executes dropped EXE
PID:2712 -
\??\c:\pjpdd.exec:\pjpdd.exe38⤵
- Executes dropped EXE
PID:888 -
\??\c:\3lxrflx.exec:\3lxrflx.exe39⤵
- Executes dropped EXE
PID:2548 -
\??\c:\5thnth.exec:\5thnth.exe40⤵
- Executes dropped EXE
PID:2604 -
\??\c:\jdvdv.exec:\jdvdv.exe41⤵
- Executes dropped EXE
PID:1856 -
\??\c:\djjdd.exec:\djjdd.exe42⤵
- Executes dropped EXE
PID:3000 -
\??\c:\lflfllr.exec:\lflfllr.exe43⤵
- Executes dropped EXE
PID:1096 -
\??\c:\nhbnbn.exec:\nhbnbn.exe44⤵
- Executes dropped EXE
PID:2216 -
\??\c:\jpvdj.exec:\jpvdj.exe45⤵
- Executes dropped EXE
PID:2588 -
\??\c:\vvdpj.exec:\vvdpj.exe46⤵
- Executes dropped EXE
PID:236 -
\??\c:\xrffrrf.exec:\xrffrrf.exe47⤵
- Executes dropped EXE
PID:2044 -
\??\c:\1bbhbh.exec:\1bbhbh.exe48⤵
- Executes dropped EXE
PID:2440 -
\??\c:\jdvvd.exec:\jdvvd.exe49⤵
- Executes dropped EXE
PID:1700 -
\??\c:\fxxfffr.exec:\fxxfffr.exe50⤵
- Executes dropped EXE
PID:1304 -
\??\c:\rfrxlll.exec:\rfrxlll.exe51⤵
- Executes dropped EXE
PID:2760 -
\??\c:\hhnttb.exec:\hhnttb.exe52⤵
- Executes dropped EXE
PID:2640 -
\??\c:\jdvjj.exec:\jdvjj.exe53⤵
- Executes dropped EXE
PID:536 -
\??\c:\lfrxxrf.exec:\lfrxxrf.exe54⤵
- Executes dropped EXE
PID:1936 -
\??\c:\ttnbtb.exec:\ttnbtb.exe55⤵
- Executes dropped EXE
PID:3060 -
\??\c:\hbbhtt.exec:\hbbhtt.exe56⤵
- Executes dropped EXE
PID:2084 -
\??\c:\vdjvp.exec:\vdjvp.exe57⤵
- Executes dropped EXE
PID:1444 -
\??\c:\lrrfrxf.exec:\lrrfrxf.exe58⤵
- Executes dropped EXE
PID:2460 -
\??\c:\lrlxllx.exec:\lrlxllx.exe59⤵
- Executes dropped EXE
PID:1076 -
\??\c:\3bthnb.exec:\3bthnb.exe60⤵
- Executes dropped EXE
PID:1984 -
\??\c:\jjjpv.exec:\jjjpv.exe61⤵
- Executes dropped EXE
PID:2152 -
\??\c:\rlfflrf.exec:\rlfflrf.exe62⤵
- Executes dropped EXE
PID:956 -
\??\c:\xxrlrxx.exec:\xxrlrxx.exe63⤵
- Executes dropped EXE
PID:2512 -
\??\c:\btntnn.exec:\btntnn.exe64⤵
- Executes dropped EXE
PID:1292 -
\??\c:\jjdpv.exec:\jjdpv.exe65⤵
- Executes dropped EXE
PID:2956 -
\??\c:\5ddpv.exec:\5ddpv.exe66⤵
- Executes dropped EXE
PID:2200 -
\??\c:\lxrrxff.exec:\lxrrxff.exe67⤵PID:1360
-
\??\c:\3nnhnt.exec:\3nnhnt.exe68⤵PID:1784
-
\??\c:\jdppd.exec:\jdppd.exe69⤵PID:2236
-
\??\c:\jjjvv.exec:\jjjvv.exe70⤵PID:2072
-
\??\c:\xrlfrfl.exec:\xrlfrfl.exe71⤵PID:2980
-
\??\c:\nhtbnt.exec:\nhtbnt.exe72⤵PID:2376
-
\??\c:\jjvdd.exec:\jjvdd.exe73⤵PID:2120
-
\??\c:\7lllrxf.exec:\7lllrxf.exe74⤵PID:1588
-
\??\c:\nbbbhn.exec:\nbbbhn.exe75⤵PID:2812
-
\??\c:\7thhhb.exec:\7thhhb.exe76⤵PID:2008
-
\??\c:\7vvdd.exec:\7vvdd.exe77⤵PID:2780
-
\??\c:\fxfrflf.exec:\fxfrflf.exe78⤵PID:2872
-
\??\c:\nttbnb.exec:\nttbnb.exe79⤵PID:2808
-
\??\c:\nhbbtb.exec:\nhbbtb.exe80⤵PID:2544
-
\??\c:\dpdjv.exec:\dpdjv.exe81⤵PID:1204
-
\??\c:\rxlxlrx.exec:\rxlxlrx.exe82⤵PID:2720
-
\??\c:\5lxxffl.exec:\5lxxffl.exe83⤵PID:3056
-
\??\c:\jjvdj.exec:\jjvdj.exe84⤵PID:3052
-
\??\c:\1pjjj.exec:\1pjjj.exe85⤵PID:2096
-
\??\c:\llflxll.exec:\llflxll.exe86⤵PID:2356
-
\??\c:\tththb.exec:\tththb.exe87⤵PID:2772
-
\??\c:\1pjpv.exec:\1pjpv.exe88⤵PID:236
-
\??\c:\9frrxxf.exec:\9frrxxf.exe89⤵PID:2044
-
\??\c:\lllfxlf.exec:\lllfxlf.exe90⤵PID:2440
-
\??\c:\hbhtbb.exec:\hbhtbb.exe91⤵PID:1732
-
\??\c:\jjdjp.exec:\jjdjp.exe92⤵PID:2888
-
\??\c:\llllrff.exec:\llllrff.exe93⤵PID:1760
-
\??\c:\5nnnbn.exec:\5nnnbn.exe94⤵PID:1820
-
\??\c:\nnbhnt.exec:\nnbhnt.exe95⤵PID:1932
-
\??\c:\jjjvp.exec:\jjjvp.exe96⤵PID:2028
-
\??\c:\rlfrxfx.exec:\rlfrxfx.exe97⤵PID:3060
-
\??\c:\lfxlxxl.exec:\lfxlxxl.exe98⤵PID:1156
-
\??\c:\tnntbh.exec:\tnntbh.exe99⤵PID:1444
-
\??\c:\ppppv.exec:\ppppv.exe100⤵PID:2460
-
\??\c:\xrxflxr.exec:\xrxflxr.exe101⤵PID:2364
-
\??\c:\9xxfrxl.exec:\9xxfrxl.exe102⤵PID:1984
-
\??\c:\1bhnbn.exec:\1bhnbn.exe103⤵PID:1092
-
\??\c:\jddpj.exec:\jddpj.exe104⤵
- System Location Discovery: System Language Discovery
PID:760 -
\??\c:\1rlllrx.exec:\1rlllrx.exe105⤵PID:1864
-
\??\c:\hbnbnn.exec:\hbnbnn.exe106⤵PID:640
-
\??\c:\bnhnnt.exec:\bnhnnt.exe107⤵PID:664
-
\??\c:\jpvvd.exec:\jpvvd.exe108⤵PID:2268
-
\??\c:\1lxxxfr.exec:\1lxxxfr.exe109⤵PID:1360
-
\??\c:\9hnnbt.exec:\9hnnbt.exe110⤵PID:992
-
\??\c:\ppvvj.exec:\ppvvj.exe111⤵PID:1940
-
\??\c:\pjdvj.exec:\pjdvj.exe112⤵PID:892
-
\??\c:\lrlxxxr.exec:\lrlxxxr.exe113⤵PID:2144
-
\??\c:\bbbbth.exec:\bbbbth.exe114⤵PID:1596
-
\??\c:\bhbhtb.exec:\bhbhtb.exe115⤵PID:2804
-
\??\c:\jvvpj.exec:\jvvpj.exe116⤵PID:2920
-
\??\c:\rxrxxlx.exec:\rxrxxlx.exe117⤵PID:1592
-
\??\c:\lllxrrx.exec:\lllxrrx.exe118⤵PID:2788
-
\??\c:\nthbnb.exec:\nthbnb.exe119⤵PID:2832
-
\??\c:\fxlxxlx.exec:\fxlxxlx.exe120⤵PID:2748
-
\??\c:\7hnbhb.exec:\7hnbhb.exe121⤵PID:2664
-
\??\c:\bbbthn.exec:\bbbthn.exe122⤵PID:2560
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-