Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 23:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6242ed4789f0af8d67b4dc4e555bd9ff2d0d4a5bb46536379f4ee74b12e88f6c.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
6242ed4789f0af8d67b4dc4e555bd9ff2d0d4a5bb46536379f4ee74b12e88f6c.exe
-
Size
455KB
-
MD5
e5a3a06ee07398694aeb8dbff135a276
-
SHA1
ee6fe4fd543dc2a5487ce91b48da9b9a8af27cfe
-
SHA256
6242ed4789f0af8d67b4dc4e555bd9ff2d0d4a5bb46536379f4ee74b12e88f6c
-
SHA512
be3e95a803497ea2670592e1a97f82b377e7d55b8f89c08885d63d9de2e2348a0fd2df808eec1fe0bdfe913c4412673ffbdeaf6ef051283bbf4f3891525a3a54
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRK:q7Tc2NYHUrAwfMp3CDRK
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/2852-0-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3060-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/580-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2340-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2412-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1076-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/296-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2428-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2196-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/468-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1480-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-219-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1984-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1908-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1744-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1300-277-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2696-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2176-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-390-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2328-454-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/268-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-722-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1808-748-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2468-769-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1220-783-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2228-800-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2080-1022-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3000 llflxrf.exe 2700 btbtbb.exe 2812 lllfffx.exe 2752 xfxlflx.exe 2604 hnntnt.exe 3060 5xrxrxl.exe 320 rrfrlrl.exe 580 5ttbnb.exe 2964 ntthhn.exe 2272 ppvpv.exe 2344 lxllrxf.exe 2340 dvvpj.exe 2804 frrfxlf.exe 2412 ddvvj.exe 2960 rlxrrfx.exe 1076 tbbhtb.exe 296 9lfxfrl.exe 2996 3ddvj.exe 2324 xxxrrxl.exe 2428 pjjpd.exe 2196 rlflflx.exe 468 5dpvj.exe 2360 7rfrfrx.exe 1480 9thbht.exe 1300 xxlxlrx.exe 1984 hbnbbn.exe 1908 xxfxlfx.exe 2368 xfxlffx.exe 1744 ttthtb.exe 2520 djdpj.exe 1560 3fflxll.exe 2184 ntnbth.exe 2920 djjdp.exe 2916 fxrfrxr.exe 2696 httnht.exe 2596 7vjdp.exe 2704 5rfxrxl.exe 2116 bbbbnt.exe 2176 bbtbnt.exe 764 djpdp.exe 2624 lrrlxfl.exe 1308 7hhbbt.exe 1928 jjddp.exe 2272 vppvj.exe 2940 fllxlrf.exe 2144 hnnhht.exe 2880 7dvpj.exe 1940 xfxlrrf.exe 2820 hnnhhn.exe 2416 bbhnhb.exe 1604 vppvp.exe 1148 rffrflf.exe 2436 ttthbh.exe 2452 jpjvj.exe 2328 lfrlflf.exe 2324 nbtnbh.exe 1756 ppdjv.exe 268 rrfrfrx.exe 1684 tttbht.exe 1784 jjdjj.exe 2080 pppdv.exe 684 ffrfrxr.exe 1688 7nhthh.exe 1440 dddvv.exe -
resource yara_rule behavioral1/memory/2852-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-52-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/580-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/580-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1076-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/296-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/468-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/468-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1480-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-275-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1744-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1928-375-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2940-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/268-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-489-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-572-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-597-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-722-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-749-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1220-783-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-818-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-840-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/400-901-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-963-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-1003-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-1022-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2404-1041-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-1060-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrxlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxfxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlfrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrxxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rrfrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1fxlfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhthnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flflxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbtht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllxxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9thbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2852 wrote to memory of 3000 2852 6242ed4789f0af8d67b4dc4e555bd9ff2d0d4a5bb46536379f4ee74b12e88f6c.exe 30 PID 2852 wrote to memory of 3000 2852 6242ed4789f0af8d67b4dc4e555bd9ff2d0d4a5bb46536379f4ee74b12e88f6c.exe 30 PID 2852 wrote to memory of 3000 2852 6242ed4789f0af8d67b4dc4e555bd9ff2d0d4a5bb46536379f4ee74b12e88f6c.exe 30 PID 2852 wrote to memory of 3000 2852 6242ed4789f0af8d67b4dc4e555bd9ff2d0d4a5bb46536379f4ee74b12e88f6c.exe 30 PID 3000 wrote to memory of 2700 3000 llflxrf.exe 31 PID 3000 wrote to memory of 2700 3000 llflxrf.exe 31 PID 3000 wrote to memory of 2700 3000 llflxrf.exe 31 PID 3000 wrote to memory of 2700 3000 llflxrf.exe 31 PID 2700 wrote to memory of 2812 2700 btbtbb.exe 32 PID 2700 wrote to memory of 2812 2700 btbtbb.exe 32 PID 2700 wrote to memory of 2812 2700 btbtbb.exe 32 PID 2700 wrote to memory of 2812 2700 btbtbb.exe 32 PID 2812 wrote to memory of 2752 2812 lllfffx.exe 33 PID 2812 wrote to memory of 2752 2812 lllfffx.exe 33 PID 2812 wrote to memory of 2752 2812 lllfffx.exe 33 PID 2812 wrote to memory of 2752 2812 lllfffx.exe 33 PID 2752 wrote to memory of 2604 2752 xfxlflx.exe 34 PID 2752 wrote to memory of 2604 2752 xfxlflx.exe 34 PID 2752 wrote to memory of 2604 2752 xfxlflx.exe 34 PID 2752 wrote to memory of 2604 2752 xfxlflx.exe 34 PID 2604 wrote to memory of 3060 2604 hnntnt.exe 35 PID 2604 wrote to memory of 3060 2604 hnntnt.exe 35 PID 2604 wrote to memory of 3060 2604 hnntnt.exe 35 PID 2604 wrote to memory of 3060 2604 hnntnt.exe 35 PID 3060 wrote to memory of 320 3060 5xrxrxl.exe 36 PID 3060 wrote to memory of 320 3060 5xrxrxl.exe 36 PID 3060 wrote to memory of 320 3060 5xrxrxl.exe 36 PID 3060 wrote to memory of 320 3060 5xrxrxl.exe 36 PID 320 wrote to memory of 580 320 rrfrlrl.exe 37 PID 320 wrote to memory of 580 320 rrfrlrl.exe 37 PID 320 wrote to memory of 580 320 rrfrlrl.exe 37 PID 320 wrote to memory of 580 320 rrfrlrl.exe 37 PID 580 wrote to memory of 2964 580 5ttbnb.exe 38 PID 580 wrote to memory of 2964 580 5ttbnb.exe 38 PID 580 wrote to memory of 2964 580 5ttbnb.exe 38 PID 580 wrote to memory of 2964 580 5ttbnb.exe 38 PID 2964 wrote to memory of 2272 2964 ntthhn.exe 39 PID 2964 wrote to memory of 2272 2964 ntthhn.exe 39 PID 2964 wrote to memory of 2272 2964 ntthhn.exe 39 PID 2964 wrote to memory of 2272 2964 ntthhn.exe 39 PID 2272 wrote to memory of 2344 2272 ppvpv.exe 40 PID 2272 wrote to memory of 2344 2272 ppvpv.exe 40 PID 2272 wrote to memory of 2344 2272 ppvpv.exe 40 PID 2272 wrote to memory of 2344 2272 ppvpv.exe 40 PID 2344 wrote to memory of 2340 2344 lxllrxf.exe 41 PID 2344 wrote to memory of 2340 2344 lxllrxf.exe 41 PID 2344 wrote to memory of 2340 2344 lxllrxf.exe 41 PID 2344 wrote to memory of 2340 2344 lxllrxf.exe 41 PID 2340 wrote to memory of 2804 2340 dvvpj.exe 42 PID 2340 wrote to memory of 2804 2340 dvvpj.exe 42 PID 2340 wrote to memory of 2804 2340 dvvpj.exe 42 PID 2340 wrote to memory of 2804 2340 dvvpj.exe 42 PID 2804 wrote to memory of 2412 2804 frrfxlf.exe 43 PID 2804 wrote to memory of 2412 2804 frrfxlf.exe 43 PID 2804 wrote to memory of 2412 2804 frrfxlf.exe 43 PID 2804 wrote to memory of 2412 2804 frrfxlf.exe 43 PID 2412 wrote to memory of 2960 2412 ddvvj.exe 44 PID 2412 wrote to memory of 2960 2412 ddvvj.exe 44 PID 2412 wrote to memory of 2960 2412 ddvvj.exe 44 PID 2412 wrote to memory of 2960 2412 ddvvj.exe 44 PID 2960 wrote to memory of 1076 2960 rlxrrfx.exe 45 PID 2960 wrote to memory of 1076 2960 rlxrrfx.exe 45 PID 2960 wrote to memory of 1076 2960 rlxrrfx.exe 45 PID 2960 wrote to memory of 1076 2960 rlxrrfx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\6242ed4789f0af8d67b4dc4e555bd9ff2d0d4a5bb46536379f4ee74b12e88f6c.exe"C:\Users\Admin\AppData\Local\Temp\6242ed4789f0af8d67b4dc4e555bd9ff2d0d4a5bb46536379f4ee74b12e88f6c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\llflxrf.exec:\llflxrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\btbtbb.exec:\btbtbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\lllfffx.exec:\lllfffx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\xfxlflx.exec:\xfxlflx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\hnntnt.exec:\hnntnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\5xrxrxl.exec:\5xrxrxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\rrfrlrl.exec:\rrfrlrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\5ttbnb.exec:\5ttbnb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:580 -
\??\c:\ntthhn.exec:\ntthhn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\ppvpv.exec:\ppvpv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\lxllrxf.exec:\lxllrxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\dvvpj.exec:\dvvpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\frrfxlf.exec:\frrfxlf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\ddvvj.exec:\ddvvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\rlxrrfx.exec:\rlxrrfx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\tbbhtb.exec:\tbbhtb.exe17⤵
- Executes dropped EXE
PID:1076 -
\??\c:\9lfxfrl.exec:\9lfxfrl.exe18⤵
- Executes dropped EXE
PID:296 -
\??\c:\3ddvj.exec:\3ddvj.exe19⤵
- Executes dropped EXE
PID:2996 -
\??\c:\xxxrrxl.exec:\xxxrrxl.exe20⤵
- Executes dropped EXE
PID:2324 -
\??\c:\pjjpd.exec:\pjjpd.exe21⤵
- Executes dropped EXE
PID:2428 -
\??\c:\rlflflx.exec:\rlflflx.exe22⤵
- Executes dropped EXE
PID:2196 -
\??\c:\5dpvj.exec:\5dpvj.exe23⤵
- Executes dropped EXE
PID:468 -
\??\c:\7rfrfrx.exec:\7rfrfrx.exe24⤵
- Executes dropped EXE
PID:2360 -
\??\c:\9thbht.exec:\9thbht.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1480 -
\??\c:\xxlxlrx.exec:\xxlxlrx.exe26⤵
- Executes dropped EXE
PID:1300 -
\??\c:\hbnbbn.exec:\hbnbbn.exe27⤵
- Executes dropped EXE
PID:1984 -
\??\c:\xxfxlfx.exec:\xxfxlfx.exe28⤵
- Executes dropped EXE
PID:1908 -
\??\c:\xfxlffx.exec:\xfxlffx.exe29⤵
- Executes dropped EXE
PID:2368 -
\??\c:\ttthtb.exec:\ttthtb.exe30⤵
- Executes dropped EXE
PID:1744 -
\??\c:\djdpj.exec:\djdpj.exe31⤵
- Executes dropped EXE
PID:2520 -
\??\c:\3fflxll.exec:\3fflxll.exe32⤵
- Executes dropped EXE
PID:1560 -
\??\c:\ntnbth.exec:\ntnbth.exe33⤵
- Executes dropped EXE
PID:2184 -
\??\c:\djjdp.exec:\djjdp.exe34⤵
- Executes dropped EXE
PID:2920 -
\??\c:\fxrfrxr.exec:\fxrfrxr.exe35⤵
- Executes dropped EXE
PID:2916 -
\??\c:\httnht.exec:\httnht.exe36⤵
- Executes dropped EXE
PID:2696 -
\??\c:\7vjdp.exec:\7vjdp.exe37⤵
- Executes dropped EXE
PID:2596 -
\??\c:\5rfxrxl.exec:\5rfxrxl.exe38⤵
- Executes dropped EXE
PID:2704 -
\??\c:\bbbbnt.exec:\bbbbnt.exe39⤵
- Executes dropped EXE
PID:2116 -
\??\c:\bbtbnt.exec:\bbtbnt.exe40⤵
- Executes dropped EXE
PID:2176 -
\??\c:\djpdp.exec:\djpdp.exe41⤵
- Executes dropped EXE
PID:764 -
\??\c:\lrrlxfl.exec:\lrrlxfl.exe42⤵
- Executes dropped EXE
PID:2624 -
\??\c:\7hhbbt.exec:\7hhbbt.exe43⤵
- Executes dropped EXE
PID:1308 -
\??\c:\jjddp.exec:\jjddp.exe44⤵
- Executes dropped EXE
PID:1928 -
\??\c:\vppvj.exec:\vppvj.exe45⤵
- Executes dropped EXE
PID:2272 -
\??\c:\fllxlrf.exec:\fllxlrf.exe46⤵
- Executes dropped EXE
PID:2940 -
\??\c:\hnnhht.exec:\hnnhht.exe47⤵
- Executes dropped EXE
PID:2144 -
\??\c:\7dvpj.exec:\7dvpj.exe48⤵
- Executes dropped EXE
PID:2880 -
\??\c:\xfxlrrf.exec:\xfxlrrf.exe49⤵
- Executes dropped EXE
PID:1940 -
\??\c:\hnnhhn.exec:\hnnhhn.exe50⤵
- Executes dropped EXE
PID:2820 -
\??\c:\bbhnhb.exec:\bbhnhb.exe51⤵
- Executes dropped EXE
PID:2416 -
\??\c:\vppvp.exec:\vppvp.exe52⤵
- Executes dropped EXE
PID:1604 -
\??\c:\rffrflf.exec:\rffrflf.exe53⤵
- Executes dropped EXE
PID:1148 -
\??\c:\ttthbh.exec:\ttthbh.exe54⤵
- Executes dropped EXE
PID:2436 -
\??\c:\jpjvj.exec:\jpjvj.exe55⤵
- Executes dropped EXE
PID:2452 -
\??\c:\lfrlflf.exec:\lfrlflf.exe56⤵
- Executes dropped EXE
PID:2328 -
\??\c:\nbtnbh.exec:\nbtnbh.exe57⤵
- Executes dropped EXE
PID:2324 -
\??\c:\ppdjv.exec:\ppdjv.exe58⤵
- Executes dropped EXE
PID:1756 -
\??\c:\rrfrfrx.exec:\rrfrfrx.exe59⤵
- Executes dropped EXE
PID:268 -
\??\c:\tttbht.exec:\tttbht.exe60⤵
- Executes dropped EXE
PID:1684 -
\??\c:\jjdjj.exec:\jjdjj.exe61⤵
- Executes dropped EXE
PID:1784 -
\??\c:\pppdv.exec:\pppdv.exe62⤵
- Executes dropped EXE
PID:2080 -
\??\c:\ffrfrxr.exec:\ffrfrxr.exe63⤵
- Executes dropped EXE
PID:684 -
\??\c:\7nhthh.exec:\7nhthh.exe64⤵
- Executes dropped EXE
PID:1688 -
\??\c:\dddvv.exec:\dddvv.exe65⤵
- Executes dropped EXE
PID:1440 -
\??\c:\1fxlfxl.exec:\1fxlfxl.exe66⤵
- System Location Discovery: System Language Discovery
PID:2400 -
\??\c:\xfxllrf.exec:\xfxllrf.exe67⤵PID:2504
-
\??\c:\hnnbnh.exec:\hnnbnh.exe68⤵PID:2228
-
\??\c:\1jdvp.exec:\1jdvp.exe69⤵PID:884
-
\??\c:\lfxlllx.exec:\lfxlllx.exe70⤵PID:888
-
\??\c:\hhbhnh.exec:\hhbhnh.exe71⤵PID:2520
-
\??\c:\ttbhbh.exec:\ttbhbh.exe72⤵PID:2856
-
\??\c:\pjdpd.exec:\pjdpd.exe73⤵PID:2708
-
\??\c:\rxrxrrf.exec:\rxrxrrf.exe74⤵PID:2884
-
\??\c:\tnbtbn.exec:\tnbtbn.exe75⤵PID:2920
-
\??\c:\bntthn.exec:\bntthn.exe76⤵PID:2868
-
\??\c:\pppdp.exec:\pppdp.exe77⤵
- System Location Discovery: System Language Discovery
PID:2696 -
\??\c:\xxrrflr.exec:\xxrrflr.exe78⤵PID:2596
-
\??\c:\bbbbth.exec:\bbbbth.exe79⤵PID:3068
-
\??\c:\3vddj.exec:\3vddj.exe80⤵PID:2256
-
\??\c:\7dvpd.exec:\7dvpd.exe81⤵PID:2492
-
\??\c:\rrrfxrl.exec:\rrrfxrl.exe82⤵PID:580
-
\??\c:\bbhnht.exec:\bbhnht.exe83⤵PID:2292
-
\??\c:\hnnnbt.exec:\hnnnbt.exe84⤵PID:2232
-
\??\c:\vjdpp.exec:\vjdpp.exe85⤵PID:400
-
\??\c:\rrrlfrl.exec:\rrrlfrl.exe86⤵PID:2932
-
\??\c:\bbhhbh.exec:\bbhhbh.exe87⤵PID:1216
-
\??\c:\hhhbhn.exec:\hhhbhn.exe88⤵PID:2784
-
\??\c:\fllrlfr.exec:\fllrlfr.exe89⤵PID:1644
-
\??\c:\frrllxr.exec:\frrllxr.exe90⤵PID:1268
-
\??\c:\1btbht.exec:\1btbht.exe91⤵PID:2936
-
\??\c:\vvdpj.exec:\vvdpj.exe92⤵PID:2948
-
\??\c:\lflfrxr.exec:\lflfrxr.exe93⤵PID:2060
-
\??\c:\lrlxxxf.exec:\lrlxxxf.exe94⤵PID:1188
-
\??\c:\hhbnhn.exec:\hhbnhn.exe95⤵PID:1340
-
\??\c:\jpdpp.exec:\jpdpp.exe96⤵PID:2436
-
\??\c:\vpvdp.exec:\vpvdp.exe97⤵PID:2452
-
\??\c:\rlxxllx.exec:\rlxxllx.exe98⤵PID:1772
-
\??\c:\tttntn.exec:\tttntn.exe99⤵PID:2324
-
\??\c:\7ppjd.exec:\7ppjd.exe100⤵
- System Location Discovery: System Language Discovery
PID:2196 -
\??\c:\rrllrxr.exec:\rrllrxr.exe101⤵PID:1600
-
\??\c:\bhhbnt.exec:\bhhbnt.exe102⤵PID:1808
-
\??\c:\3jjvp.exec:\3jjvp.exe103⤵PID:2360
-
\??\c:\vjdvj.exec:\vjdvj.exe104⤵PID:1980
-
\??\c:\llflflr.exec:\llflflr.exe105⤵PID:2468
-
\??\c:\ttthth.exec:\ttthth.exe106⤵PID:2000
-
\??\c:\djjdd.exec:\djjdd.exe107⤵PID:1220
-
\??\c:\lllxlrf.exec:\lllxlrf.exe108⤵PID:1952
-
\??\c:\rrxlxfl.exec:\rrxlxfl.exe109⤵PID:1908
-
\??\c:\dddjv.exec:\dddjv.exe110⤵PID:2228
-
\??\c:\1xxfrfx.exec:\1xxfrfx.exe111⤵PID:2348
-
\??\c:\lfxxllx.exec:\lfxxllx.exe112⤵PID:2740
-
\??\c:\bbbtht.exec:\bbbtht.exe113⤵
- System Location Discovery: System Language Discovery
PID:2712 -
\??\c:\pvdjd.exec:\pvdjd.exe114⤵PID:2988
-
\??\c:\rrlxlrl.exec:\rrlxlrl.exe115⤵PID:2872
-
\??\c:\lfllxlx.exec:\lfllxlx.exe116⤵PID:2912
-
\??\c:\3ttnhn.exec:\3ttnhn.exe117⤵PID:2920
-
\??\c:\3vpvj.exec:\3vpvj.exe118⤵PID:2580
-
\??\c:\llxfrfr.exec:\llxfrfr.exe119⤵PID:2604
-
\??\c:\nhthnh.exec:\nhthnh.exe120⤵
- System Location Discovery: System Language Discovery
PID:484 -
\??\c:\3jjvd.exec:\3jjvd.exe121⤵PID:2076
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-