Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21-11-2024 20:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1e4e25346db4f4c49c12ef220d57c6d5fce5c4164d396106a2f0cbd44edcd3d7.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
1e4e25346db4f4c49c12ef220d57c6d5fce5c4164d396106a2f0cbd44edcd3d7.exe
-
Size
455KB
-
MD5
665c6c57bec5443dd19c09bf26229498
-
SHA1
2efbb80fd11f945211b97a2dc9e4fe147e0d8bf0
-
SHA256
1e4e25346db4f4c49c12ef220d57c6d5fce5c4164d396106a2f0cbd44edcd3d7
-
SHA512
c6337aa319c85ee894bdfa343034236749f55016c9c56a41065b206009c19f657878625bbe37217ef5199479e5190acca199d6a81cebfdfcababf54f78092930
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeR4:q7Tc2NYHUrAwfMp3CDR4
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/2708-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-39-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2372-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-128-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/576-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/908-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-166-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1500-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1504-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-466-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1628-473-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-492-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2464-1036-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-1067-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1180-794-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-679-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1840-524-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/700-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1424-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1500-223-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/2012-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1176-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/492-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/492-184-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3004-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1744-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2024-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1520-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3060-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2824 rrrxlrf.exe 2672 rxrflxr.exe 2724 tbhntt.exe 2372 llrffrl.exe 796 btbhth.exe 2640 pdvvp.exe 3060 lxrlrrl.exe 2940 bbthnh.exe 1520 ttnnbh.exe 2024 vpdvj.exe 1744 rfxrxfr.exe 2784 bttbtt.exe 576 pjjpv.exe 2928 5xrlrxl.exe 908 hhbbhn.exe 1920 vvjvp.exe 3004 jvjjp.exe 492 rrxxlrl.exe 1176 bbtbbb.exe 448 lxllxxf.exe 2012 btntnt.exe 1500 5dppd.exe 1504 xxrrxxl.exe 2464 btnttt.exe 1424 3vjdd.exe 1840 lrfrxfx.exe 2116 nhhthn.exe 700 3djjp.exe 2072 fffxrxx.exe 2644 bthnnn.exe 1488 vpjvv.exe 2980 dvpvd.exe 2696 7xllxfr.exe 2908 thnbnn.exe 2700 hnhthn.exe 2924 vpddp.exe 2580 9llxllx.exe 796 9tbhhh.exe 2056 pjdpp.exe 2596 rfrfrrf.exe 2616 hbbtbb.exe 2172 pvvdd.exe 2912 jvjjp.exe 1856 3lffxxl.exe 1968 tnbhnn.exe 3068 jjddd.exe 1412 lfxlflx.exe 2776 lxlrflx.exe 340 3thhnn.exe 476 dvjjp.exe 2544 1dvdd.exe 1920 xrxxffl.exe 3004 hhhbhn.exe 1884 vvvdv.exe 300 fxfflrx.exe 2896 xlfflrf.exe 1628 bbnthn.exe 2340 hbbhhn.exe 992 ddpjd.exe 2920 3rxxxfx.exe 2460 5rfflrr.exe 1512 5tnnnn.exe 760 ppdpd.exe 856 5vjjp.exe -
resource yara_rule behavioral1/memory/2708-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/576-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/908-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1500-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1504-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-466-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-473-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1356-756-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-907-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/776-956-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-1036-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-1067-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-1149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-1142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-1093-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1872-845-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1180-794-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-725-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-679-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/468-647-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1840-524-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/700-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1424-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1500-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1176-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/492-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1520-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-80-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrxffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7fxxfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxxrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxrlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xrxfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2708 wrote to memory of 2824 2708 1e4e25346db4f4c49c12ef220d57c6d5fce5c4164d396106a2f0cbd44edcd3d7.exe 30 PID 2708 wrote to memory of 2824 2708 1e4e25346db4f4c49c12ef220d57c6d5fce5c4164d396106a2f0cbd44edcd3d7.exe 30 PID 2708 wrote to memory of 2824 2708 1e4e25346db4f4c49c12ef220d57c6d5fce5c4164d396106a2f0cbd44edcd3d7.exe 30 PID 2708 wrote to memory of 2824 2708 1e4e25346db4f4c49c12ef220d57c6d5fce5c4164d396106a2f0cbd44edcd3d7.exe 30 PID 2824 wrote to memory of 2672 2824 rrrxlrf.exe 31 PID 2824 wrote to memory of 2672 2824 rrrxlrf.exe 31 PID 2824 wrote to memory of 2672 2824 rrrxlrf.exe 31 PID 2824 wrote to memory of 2672 2824 rrrxlrf.exe 31 PID 2672 wrote to memory of 2724 2672 rxrflxr.exe 144 PID 2672 wrote to memory of 2724 2672 rxrflxr.exe 144 PID 2672 wrote to memory of 2724 2672 rxrflxr.exe 144 PID 2672 wrote to memory of 2724 2672 rxrflxr.exe 144 PID 2724 wrote to memory of 2372 2724 tbhntt.exe 33 PID 2724 wrote to memory of 2372 2724 tbhntt.exe 33 PID 2724 wrote to memory of 2372 2724 tbhntt.exe 33 PID 2724 wrote to memory of 2372 2724 tbhntt.exe 33 PID 2372 wrote to memory of 796 2372 llrffrl.exe 193 PID 2372 wrote to memory of 796 2372 llrffrl.exe 193 PID 2372 wrote to memory of 796 2372 llrffrl.exe 193 PID 2372 wrote to memory of 796 2372 llrffrl.exe 193 PID 796 wrote to memory of 2640 796 btbhth.exe 192 PID 796 wrote to memory of 2640 796 btbhth.exe 192 PID 796 wrote to memory of 2640 796 btbhth.exe 192 PID 796 wrote to memory of 2640 796 btbhth.exe 192 PID 2640 wrote to memory of 3060 2640 pdvvp.exe 36 PID 2640 wrote to memory of 3060 2640 pdvvp.exe 36 PID 2640 wrote to memory of 3060 2640 pdvvp.exe 36 PID 2640 wrote to memory of 3060 2640 pdvvp.exe 36 PID 3060 wrote to memory of 2940 3060 lxrlrrl.exe 37 PID 3060 wrote to memory of 2940 3060 lxrlrrl.exe 37 PID 3060 wrote to memory of 2940 3060 lxrlrrl.exe 37 PID 3060 wrote to memory of 2940 3060 lxrlrrl.exe 37 PID 2940 wrote to memory of 1520 2940 bbthnh.exe 38 PID 2940 wrote to memory of 1520 2940 bbthnh.exe 38 PID 2940 wrote to memory of 1520 2940 bbthnh.exe 38 PID 2940 wrote to memory of 1520 2940 bbthnh.exe 38 PID 1520 wrote to memory of 2024 1520 ttnnbh.exe 113 PID 1520 wrote to memory of 2024 1520 ttnnbh.exe 113 PID 1520 wrote to memory of 2024 1520 ttnnbh.exe 113 PID 1520 wrote to memory of 2024 1520 ttnnbh.exe 113 PID 2024 wrote to memory of 1744 2024 vpdvj.exe 40 PID 2024 wrote to memory of 1744 2024 vpdvj.exe 40 PID 2024 wrote to memory of 1744 2024 vpdvj.exe 40 PID 2024 wrote to memory of 1744 2024 vpdvj.exe 40 PID 1744 wrote to memory of 2784 1744 rfxrxfr.exe 41 PID 1744 wrote to memory of 2784 1744 rfxrxfr.exe 41 PID 1744 wrote to memory of 2784 1744 rfxrxfr.exe 41 PID 1744 wrote to memory of 2784 1744 rfxrxfr.exe 41 PID 2784 wrote to memory of 576 2784 bttbtt.exe 42 PID 2784 wrote to memory of 576 2784 bttbtt.exe 42 PID 2784 wrote to memory of 576 2784 bttbtt.exe 42 PID 2784 wrote to memory of 576 2784 bttbtt.exe 42 PID 576 wrote to memory of 2928 576 pjjpv.exe 43 PID 576 wrote to memory of 2928 576 pjjpv.exe 43 PID 576 wrote to memory of 2928 576 pjjpv.exe 43 PID 576 wrote to memory of 2928 576 pjjpv.exe 43 PID 2928 wrote to memory of 908 2928 5xrlrxl.exe 44 PID 2928 wrote to memory of 908 2928 5xrlrxl.exe 44 PID 2928 wrote to memory of 908 2928 5xrlrxl.exe 44 PID 2928 wrote to memory of 908 2928 5xrlrxl.exe 44 PID 908 wrote to memory of 1920 908 hhbbhn.exe 45 PID 908 wrote to memory of 1920 908 hhbbhn.exe 45 PID 908 wrote to memory of 1920 908 hhbbhn.exe 45 PID 908 wrote to memory of 1920 908 hhbbhn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e4e25346db4f4c49c12ef220d57c6d5fce5c4164d396106a2f0cbd44edcd3d7.exe"C:\Users\Admin\AppData\Local\Temp\1e4e25346db4f4c49c12ef220d57c6d5fce5c4164d396106a2f0cbd44edcd3d7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\rrrxlrf.exec:\rrrxlrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\rxrflxr.exec:\rxrflxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\tbhntt.exec:\tbhntt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\llrffrl.exec:\llrffrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\btbhth.exec:\btbhth.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:796 -
\??\c:\pdvvp.exec:\pdvvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\lxrlrrl.exec:\lxrlrrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\bbthnh.exec:\bbthnh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\ttnnbh.exec:\ttnnbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\vpdvj.exec:\vpdvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\rfxrxfr.exec:\rfxrxfr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
\??\c:\bttbtt.exec:\bttbtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\pjjpv.exec:\pjjpv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:576 -
\??\c:\5xrlrxl.exec:\5xrlrxl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\hhbbhn.exec:\hhbbhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:908 -
\??\c:\vvjvp.exec:\vvjvp.exe17⤵
- Executes dropped EXE
PID:1920 -
\??\c:\jvjjp.exec:\jvjjp.exe18⤵
- Executes dropped EXE
PID:3004 -
\??\c:\rrxxlrl.exec:\rrxxlrl.exe19⤵
- Executes dropped EXE
PID:492 -
\??\c:\bbtbbb.exec:\bbtbbb.exe20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1176 -
\??\c:\lxllxxf.exec:\lxllxxf.exe21⤵
- Executes dropped EXE
PID:448 -
\??\c:\btntnt.exec:\btntnt.exe22⤵
- Executes dropped EXE
PID:2012 -
\??\c:\5dppd.exec:\5dppd.exe23⤵
- Executes dropped EXE
PID:1500 -
\??\c:\xxrrxxl.exec:\xxrrxxl.exe24⤵
- Executes dropped EXE
PID:1504 -
\??\c:\btnttt.exec:\btnttt.exe25⤵
- Executes dropped EXE
PID:2464 -
\??\c:\3vjdd.exec:\3vjdd.exe26⤵
- Executes dropped EXE
PID:1424 -
\??\c:\lrfrxfx.exec:\lrfrxfx.exe27⤵
- Executes dropped EXE
PID:1840 -
\??\c:\nhhthn.exec:\nhhthn.exe28⤵
- Executes dropped EXE
PID:2116 -
\??\c:\3djjp.exec:\3djjp.exe29⤵
- Executes dropped EXE
PID:700 -
\??\c:\fffxrxx.exec:\fffxrxx.exe30⤵
- Executes dropped EXE
PID:2072 -
\??\c:\bthnnn.exec:\bthnnn.exe31⤵
- Executes dropped EXE
PID:2644 -
\??\c:\vpjvv.exec:\vpjvv.exe32⤵
- Executes dropped EXE
PID:1488 -
\??\c:\dvpvd.exec:\dvpvd.exe33⤵
- Executes dropped EXE
PID:2980 -
\??\c:\7xllxfr.exec:\7xllxfr.exe34⤵
- Executes dropped EXE
PID:2696 -
\??\c:\thnbnn.exec:\thnbnn.exe35⤵
- Executes dropped EXE
PID:2908 -
\??\c:\hnhthn.exec:\hnhthn.exe36⤵
- Executes dropped EXE
PID:2700 -
\??\c:\vpddp.exec:\vpddp.exe37⤵
- Executes dropped EXE
PID:2924 -
\??\c:\9llxllx.exec:\9llxllx.exe38⤵
- Executes dropped EXE
PID:2580 -
\??\c:\9tbhhh.exec:\9tbhhh.exe39⤵
- Executes dropped EXE
PID:796 -
\??\c:\pjdpp.exec:\pjdpp.exe40⤵
- Executes dropped EXE
PID:2056 -
\??\c:\rfrfrrf.exec:\rfrfrrf.exe41⤵
- Executes dropped EXE
PID:2596 -
\??\c:\hbbtbb.exec:\hbbtbb.exe42⤵
- Executes dropped EXE
PID:2616 -
\??\c:\pvvdd.exec:\pvvdd.exe43⤵
- Executes dropped EXE
PID:2172 -
\??\c:\jvjjp.exec:\jvjjp.exe44⤵
- Executes dropped EXE
PID:2912 -
\??\c:\3lffxxl.exec:\3lffxxl.exe45⤵
- Executes dropped EXE
PID:1856 -
\??\c:\tnbhnn.exec:\tnbhnn.exe46⤵
- Executes dropped EXE
PID:1968 -
\??\c:\jjddd.exec:\jjddd.exe47⤵
- Executes dropped EXE
PID:3068 -
\??\c:\lfxlflx.exec:\lfxlflx.exe48⤵
- Executes dropped EXE
PID:1412 -
\??\c:\lxlrflx.exec:\lxlrflx.exe49⤵
- Executes dropped EXE
PID:2776 -
\??\c:\3thhnn.exec:\3thhnn.exe50⤵
- Executes dropped EXE
PID:340 -
\??\c:\dvjjp.exec:\dvjjp.exe51⤵
- Executes dropped EXE
PID:476 -
\??\c:\1dvdd.exec:\1dvdd.exe52⤵
- Executes dropped EXE
PID:2544 -
\??\c:\xrxxffl.exec:\xrxxffl.exe53⤵
- Executes dropped EXE
PID:1920 -
\??\c:\hhhbhn.exec:\hhhbhn.exe54⤵
- Executes dropped EXE
PID:3004 -
\??\c:\vvvdv.exec:\vvvdv.exe55⤵
- Executes dropped EXE
PID:1884 -
\??\c:\fxfflrx.exec:\fxfflrx.exe56⤵
- Executes dropped EXE
PID:300 -
\??\c:\xlfflrf.exec:\xlfflrf.exe57⤵
- Executes dropped EXE
PID:2896 -
\??\c:\bbnthn.exec:\bbnthn.exe58⤵
- Executes dropped EXE
PID:1628 -
\??\c:\hbbhhn.exec:\hbbhhn.exe59⤵
- Executes dropped EXE
PID:2340 -
\??\c:\ddpjd.exec:\ddpjd.exe60⤵
- Executes dropped EXE
PID:992 -
\??\c:\3rxxxfx.exec:\3rxxxfx.exe61⤵
- Executes dropped EXE
PID:2920 -
\??\c:\5rfflrr.exec:\5rfflrr.exe62⤵
- Executes dropped EXE
PID:2460 -
\??\c:\5tnnnn.exec:\5tnnnn.exe63⤵
- Executes dropped EXE
PID:1512 -
\??\c:\ppdpd.exec:\ppdpd.exe64⤵
- Executes dropped EXE
PID:760 -
\??\c:\5vjjp.exec:\5vjjp.exe65⤵
- Executes dropped EXE
PID:856 -
\??\c:\lxllflr.exec:\lxllflr.exe66⤵PID:1840
-
\??\c:\htbbnh.exec:\htbbnh.exe67⤵PID:2164
-
\??\c:\7hbtnt.exec:\7hbtnt.exe68⤵PID:1648
-
\??\c:\pjddv.exec:\pjddv.exe69⤵PID:1760
-
\??\c:\ddpvd.exec:\ddpvd.exe70⤵PID:2144
-
\??\c:\5xlrflf.exec:\5xlrflf.exe71⤵PID:2828
-
\??\c:\tnnnhn.exec:\tnnnhn.exe72⤵PID:1488
-
\??\c:\bnhhtt.exec:\bnhhtt.exe73⤵PID:2936
-
\??\c:\pjdpv.exec:\pjdpv.exe74⤵PID:2972
-
\??\c:\lllrxxr.exec:\lllrxxr.exe75⤵PID:2728
-
\??\c:\3nhnhh.exec:\3nhnhh.exe76⤵PID:2700
-
\??\c:\hnbhbt.exec:\hnbhbt.exe77⤵PID:2592
-
\??\c:\vvppv.exec:\vvppv.exe78⤵PID:2520
-
\??\c:\jdvvj.exec:\jdvvj.exe79⤵PID:2612
-
\??\c:\llflxfx.exec:\llflxfx.exe80⤵PID:1708
-
\??\c:\xxllxrf.exec:\xxllxrf.exe81⤵PID:2836
-
\??\c:\ntttbb.exec:\ntttbb.exe82⤵PID:2596
-
\??\c:\bbbhht.exec:\bbbhht.exe83⤵PID:1044
-
\??\c:\3jvdj.exec:\3jvdj.exe84⤵PID:1604
-
\??\c:\xrlrllr.exec:\xrlrllr.exe85⤵PID:2024
-
\??\c:\lxlrfxl.exec:\lxlrfxl.exe86⤵PID:1540
-
\??\c:\hbnhhn.exec:\hbnhhn.exe87⤵PID:468
-
\??\c:\tnbhnn.exec:\tnbhnn.exe88⤵PID:2792
-
\??\c:\ppddd.exec:\ppddd.exe89⤵PID:1248
-
\??\c:\lrllxlf.exec:\lrllxlf.exe90⤵PID:2760
-
\??\c:\flllrrl.exec:\flllrrl.exe91⤵PID:2900
-
\??\c:\ttbtnb.exec:\ttbtnb.exe92⤵PID:340
-
\??\c:\ppjjp.exec:\ppjjp.exe93⤵PID:476
-
\??\c:\jjvvd.exec:\jjvvd.exe94⤵PID:2136
-
\??\c:\9frrxfr.exec:\9frrxfr.exe95⤵PID:1920
-
\??\c:\frfrffl.exec:\frfrffl.exe96⤵PID:2436
-
\??\c:\nnnbnt.exec:\nnnbnt.exe97⤵PID:1176
-
\??\c:\3ppjj.exec:\3ppjj.exe98⤵PID:1684
-
\??\c:\jdvdp.exec:\jdvdp.exe99⤵PID:2896
-
\??\c:\fxlrxfr.exec:\fxlrxfr.exe100⤵PID:612
-
\??\c:\ffflffx.exec:\ffflffx.exe101⤵PID:2340
-
\??\c:\1hnhhb.exec:\1hnhhb.exe102⤵PID:992
-
\??\c:\djvvj.exec:\djvvj.exe103⤵PID:2224
-
\??\c:\5jpvd.exec:\5jpvd.exe104⤵PID:1356
-
\??\c:\fxlllfx.exec:\fxlllfx.exe105⤵PID:1716
-
\??\c:\ntnttn.exec:\ntnttn.exe106⤵PID:1124
-
\??\c:\pjvdp.exec:\pjvdp.exe107⤵PID:2192
-
\??\c:\ddppv.exec:\ddppv.exe108⤵PID:2304
-
\??\c:\3llxffx.exec:\3llxffx.exe109⤵PID:1180
-
\??\c:\9frxxxx.exec:\9frxxxx.exe110⤵PID:884
-
\??\c:\9nhhth.exec:\9nhhth.exe111⤵PID:2484
-
\??\c:\ppjpj.exec:\ppjpj.exe112⤵PID:1492
-
\??\c:\vjvvj.exec:\vjvvj.exe113⤵PID:2816
-
\??\c:\5rlxlxl.exec:\5rlxlxl.exe114⤵PID:2668
-
\??\c:\fxfxfxf.exec:\fxfxfxf.exe115⤵PID:2696
-
\??\c:\7btnhh.exec:\7btnhh.exe116⤵PID:2724
-
\??\c:\jvdpp.exec:\jvdpp.exe117⤵PID:2708
-
\??\c:\9pdpd.exec:\9pdpd.exe118⤵PID:1872
-
\??\c:\fxxrxrx.exec:\fxxrxrx.exe119⤵PID:3052
-
\??\c:\rlffllf.exec:\rlffllf.exe120⤵PID:2580
-
\??\c:\frfffff.exec:\frfffff.exe121⤵PID:3044
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-