Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 02:07
Static task
static1
Behavioral task
behavioral1
Sample
94d99496a9087ccd0cafd80fa38b5fefd22ea107e580c0c9475c1af576a570b3.exe
Resource
win7-20240903-en
General
-
Target
94d99496a9087ccd0cafd80fa38b5fefd22ea107e580c0c9475c1af576a570b3.exe
-
Size
455KB
-
MD5
d0246ea9665f16b301cd37508b7c8b78
-
SHA1
597a09e53cdcf69b04e1ee1bac61489a8fadbb18
-
SHA256
94d99496a9087ccd0cafd80fa38b5fefd22ea107e580c0c9475c1af576a570b3
-
SHA512
44ced969ddbc215c50b8931f606dd0646bf62ec1cfedc72b8099b63bd1d8b99b8baef3bc1dcb90f808c47196c75a3e9f720acb5620d9fc27e34c75613ea2d6ee
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRd:q7Tc2NYHUrAwfMp3CDRd
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 54 IoCs
Processes:
resource yara_rule behavioral1/memory/2068-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2948-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-101-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1816-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-125-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2128-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1780-140-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1780-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1160-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2432-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/596-181-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/596-186-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2508-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-237-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/840-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/840-227-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/864-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/716-261-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1952-268-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2996-295-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2244-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2312-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1632-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2040-409-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1864-434-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1672-473-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1672-495-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/568-530-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/864-534-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/864-539-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2080-552-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2156-556-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2832-620-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-633-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2020-694-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2264-775-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-788-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2388-825-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2228-832-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2316-863-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1932-1002-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2304-1142-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2292-1144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-1153-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
xfflxrr.exelfrrrrl.exetnntbn.exe3btntn.exe5vjpv.exejjdpd.exe9jppv.exepvjpp.exe9lxxffl.exevpdjp.exevvppp.exedvvdj.exefxrrxfl.exepjvjp.exerfxfllr.exedpdvv.exeffxlflf.exevvpvd.exe9dddv.exe3vjvj.exerrrflrf.exejpjjj.exelrfrflr.exebttthb.exepdpvd.exe9pdvd.exevppdp.exedddvj.exerrrlrxl.exe3jddj.exe7rfflrx.exellflxlf.exe3pppv.exe9frlffl.exe3nbtbb.exejvddv.exejjpjp.exelxfxxrx.exennhnbh.exeddvdp.exevjvvv.exerxrxlfr.exehhbbnt.exe9hthhh.exe1vjdd.exerlfffxf.exehhttbh.exe7thttt.exedvpvv.exexxllxxx.exelffflrf.exe5bhnnn.exe9vjpv.exe7lxxxrr.exerfxlrxf.exehnttht.exevpjpj.exevjvvv.exexxxlxfx.exebtbbbh.exevjvvv.exejpvpd.exerfxxffr.exe7hhhbb.exepid Process 2548 xfflxrr.exe 2112 lfrrrrl.exe 2284 tnntbn.exe 2360 3btntn.exe 2836 5vjpv.exe 2724 jjdpd.exe 2948 9jppv.exe 3064 pvjpp.exe 2620 9lxxffl.exe 3020 vpdjp.exe 1760 vvppp.exe 1816 dvvdj.exe 2128 fxrrxfl.exe 1780 pjvjp.exe 1160 rfxfllr.exe 2432 dpdvv.exe 1708 ffxlflf.exe 596 vvpvd.exe 2440 9dddv.exe 2508 3vjvj.exe 2224 rrrflrf.exe 448 jpjjj.exe 840 lrfrflr.exe 2812 bttthb.exe 864 pdpvd.exe 716 9pdvd.exe 1952 vppdp.exe 2472 dddvj.exe 1636 rrrlrxl.exe 2996 3jddj.exe 2068 7rfflrx.exe 2316 llflxlf.exe 2800 3pppv.exe 2244 9frlffl.exe 2312 3nbtbb.exe 1632 jvddv.exe 2848 jjpjp.exe 2728 lxfxxrx.exe 2872 nnhnbh.exe 2656 ddvdp.exe 2916 vjvvv.exe 2668 rxrxlfr.exe 2640 hhbbnt.exe 2740 9hthhh.exe 3036 1vjdd.exe 3028 rlfffxf.exe 2040 hhttbh.exe 1428 7thttt.exe 2372 dvpvv.exe 2436 xxllxxx.exe 1864 lffflrf.exe 600 5bhnnn.exe 1048 9vjpv.exe 548 7lxxxrr.exe 1784 rfxlrxf.exe 2680 hnttht.exe 1672 vpjpj.exe 2220 vjvvv.exe 1976 xxxlxfx.exe 1684 btbbbh.exe 108 vjvvv.exe 2980 jpvpd.exe 1800 rfxxffr.exe 588 7hhhbb.exe -
Processes:
resource yara_rule behavioral1/memory/2068-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-60-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2724-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-96-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2620-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1816-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1816-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1780-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1160-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1780-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1160-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-176-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2508-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/840-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/716-256-0x0000000000430000-0x000000000045A000-memory.dmp upx behavioral1/memory/864-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/716-261-0x0000000000430000-0x000000000045A000-memory.dmp upx behavioral1/memory/2244-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2040-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1864-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1048-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-486-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/864-531-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-552-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-553-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-567-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-620-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-633-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2020-694-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1948-756-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-775-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-788-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-825-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-832-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-863-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-921-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-995-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-1082-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-1144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-1153-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2500-1184-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
tnnthh.exe1nhntt.exerfffffl.exellxxlrf.exexrfrflx.exefrllllr.exedpjvd.exefrfffff.exedvpjv.exe7rfxllx.exelxlxrrr.exevvdjv.exe3fffrfx.exe5pjpd.exe5vvdd.exe3ppdj.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nhntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfffffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxxlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frllllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rfxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3fffrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ppdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
94d99496a9087ccd0cafd80fa38b5fefd22ea107e580c0c9475c1af576a570b3.exexfflxrr.exelfrrrrl.exetnntbn.exe3btntn.exe5vjpv.exejjdpd.exe9jppv.exepvjpp.exe9lxxffl.exevpdjp.exevvppp.exedvvdj.exefxrrxfl.exepjvjp.exerfxfllr.exedescription pid Process procid_target PID 2068 wrote to memory of 2548 2068 94d99496a9087ccd0cafd80fa38b5fefd22ea107e580c0c9475c1af576a570b3.exe 30 PID 2068 wrote to memory of 2548 2068 94d99496a9087ccd0cafd80fa38b5fefd22ea107e580c0c9475c1af576a570b3.exe 30 PID 2068 wrote to memory of 2548 2068 94d99496a9087ccd0cafd80fa38b5fefd22ea107e580c0c9475c1af576a570b3.exe 30 PID 2068 wrote to memory of 2548 2068 94d99496a9087ccd0cafd80fa38b5fefd22ea107e580c0c9475c1af576a570b3.exe 30 PID 2548 wrote to memory of 2112 2548 xfflxrr.exe 31 PID 2548 wrote to memory of 2112 2548 xfflxrr.exe 31 PID 2548 wrote to memory of 2112 2548 xfflxrr.exe 31 PID 2548 wrote to memory of 2112 2548 xfflxrr.exe 31 PID 2112 wrote to memory of 2284 2112 lfrrrrl.exe 32 PID 2112 wrote to memory of 2284 2112 lfrrrrl.exe 32 PID 2112 wrote to memory of 2284 2112 lfrrrrl.exe 32 PID 2112 wrote to memory of 2284 2112 lfrrrrl.exe 32 PID 2284 wrote to memory of 2360 2284 tnntbn.exe 33 PID 2284 wrote to memory of 2360 2284 tnntbn.exe 33 PID 2284 wrote to memory of 2360 2284 tnntbn.exe 33 PID 2284 wrote to memory of 2360 2284 tnntbn.exe 33 PID 2360 wrote to memory of 2836 2360 3btntn.exe 34 PID 2360 wrote to memory of 2836 2360 3btntn.exe 34 PID 2360 wrote to memory of 2836 2360 3btntn.exe 34 PID 2360 wrote to memory of 2836 2360 3btntn.exe 34 PID 2836 wrote to memory of 2724 2836 5vjpv.exe 35 PID 2836 wrote to memory of 2724 2836 5vjpv.exe 35 PID 2836 wrote to memory of 2724 2836 5vjpv.exe 35 PID 2836 wrote to memory of 2724 2836 5vjpv.exe 35 PID 2724 wrote to memory of 2948 2724 jjdpd.exe 36 PID 2724 wrote to memory of 2948 2724 jjdpd.exe 36 PID 2724 wrote to memory of 2948 2724 jjdpd.exe 36 PID 2724 wrote to memory of 2948 2724 jjdpd.exe 36 PID 2948 wrote to memory of 3064 2948 9jppv.exe 37 PID 2948 wrote to memory of 3064 2948 9jppv.exe 37 PID 2948 wrote to memory of 3064 2948 9jppv.exe 37 PID 2948 wrote to memory of 3064 2948 9jppv.exe 37 PID 3064 wrote to memory of 2620 3064 pvjpp.exe 38 PID 3064 wrote to memory of 2620 3064 pvjpp.exe 38 PID 3064 wrote to memory of 2620 3064 pvjpp.exe 38 PID 3064 wrote to memory of 2620 3064 pvjpp.exe 38 PID 2620 wrote to memory of 3020 2620 9lxxffl.exe 39 PID 2620 wrote to memory of 3020 2620 9lxxffl.exe 39 PID 2620 wrote to memory of 3020 2620 9lxxffl.exe 39 PID 2620 wrote to memory of 3020 2620 9lxxffl.exe 39 PID 3020 wrote to memory of 1760 3020 vpdjp.exe 40 PID 3020 wrote to memory of 1760 3020 vpdjp.exe 40 PID 3020 wrote to memory of 1760 3020 vpdjp.exe 40 PID 3020 wrote to memory of 1760 3020 vpdjp.exe 40 PID 1760 wrote to memory of 1816 1760 vvppp.exe 41 PID 1760 wrote to memory of 1816 1760 vvppp.exe 41 PID 1760 wrote to memory of 1816 1760 vvppp.exe 41 PID 1760 wrote to memory of 1816 1760 vvppp.exe 41 PID 1816 wrote to memory of 2128 1816 dvvdj.exe 42 PID 1816 wrote to memory of 2128 1816 dvvdj.exe 42 PID 1816 wrote to memory of 2128 1816 dvvdj.exe 42 PID 1816 wrote to memory of 2128 1816 dvvdj.exe 42 PID 2128 wrote to memory of 1780 2128 fxrrxfl.exe 43 PID 2128 wrote to memory of 1780 2128 fxrrxfl.exe 43 PID 2128 wrote to memory of 1780 2128 fxrrxfl.exe 43 PID 2128 wrote to memory of 1780 2128 fxrrxfl.exe 43 PID 1780 wrote to memory of 1160 1780 pjvjp.exe 44 PID 1780 wrote to memory of 1160 1780 pjvjp.exe 44 PID 1780 wrote to memory of 1160 1780 pjvjp.exe 44 PID 1780 wrote to memory of 1160 1780 pjvjp.exe 44 PID 1160 wrote to memory of 2432 1160 rfxfllr.exe 45 PID 1160 wrote to memory of 2432 1160 rfxfllr.exe 45 PID 1160 wrote to memory of 2432 1160 rfxfllr.exe 45 PID 1160 wrote to memory of 2432 1160 rfxfllr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\94d99496a9087ccd0cafd80fa38b5fefd22ea107e580c0c9475c1af576a570b3.exe"C:\Users\Admin\AppData\Local\Temp\94d99496a9087ccd0cafd80fa38b5fefd22ea107e580c0c9475c1af576a570b3.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\xfflxrr.exec:\xfflxrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\lfrrrrl.exec:\lfrrrrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\tnntbn.exec:\tnntbn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\3btntn.exec:\3btntn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\5vjpv.exec:\5vjpv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\jjdpd.exec:\jjdpd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\9jppv.exec:\9jppv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\pvjpp.exec:\pvjpp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\9lxxffl.exec:\9lxxffl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\vpdjp.exec:\vpdjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\vvppp.exec:\vvppp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
\??\c:\dvvdj.exec:\dvvdj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
\??\c:\fxrrxfl.exec:\fxrrxfl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\pjvjp.exec:\pjvjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\rfxfllr.exec:\rfxfllr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
\??\c:\dpdvv.exec:\dpdvv.exe17⤵
- Executes dropped EXE
PID:2432 -
\??\c:\ffxlflf.exec:\ffxlflf.exe18⤵
- Executes dropped EXE
PID:1708 -
\??\c:\vvpvd.exec:\vvpvd.exe19⤵
- Executes dropped EXE
PID:596 -
\??\c:\9dddv.exec:\9dddv.exe20⤵
- Executes dropped EXE
PID:2440 -
\??\c:\3vjvj.exec:\3vjvj.exe21⤵
- Executes dropped EXE
PID:2508 -
\??\c:\rrrflrf.exec:\rrrflrf.exe22⤵
- Executes dropped EXE
PID:2224 -
\??\c:\jpjjj.exec:\jpjjj.exe23⤵
- Executes dropped EXE
PID:448 -
\??\c:\lrfrflr.exec:\lrfrflr.exe24⤵
- Executes dropped EXE
PID:840 -
\??\c:\bttthb.exec:\bttthb.exe25⤵
- Executes dropped EXE
PID:2812 -
\??\c:\pdpvd.exec:\pdpvd.exe26⤵
- Executes dropped EXE
PID:864 -
\??\c:\9pdvd.exec:\9pdvd.exe27⤵
- Executes dropped EXE
PID:716 -
\??\c:\vppdp.exec:\vppdp.exe28⤵
- Executes dropped EXE
PID:1952 -
\??\c:\dddvj.exec:\dddvj.exe29⤵
- Executes dropped EXE
PID:2472 -
\??\c:\rrrlrxl.exec:\rrrlrxl.exe30⤵
- Executes dropped EXE
PID:1636 -
\??\c:\3jddj.exec:\3jddj.exe31⤵
- Executes dropped EXE
PID:2996 -
\??\c:\7rfflrx.exec:\7rfflrx.exe32⤵
- Executes dropped EXE
PID:2068 -
\??\c:\llflxlf.exec:\llflxlf.exe33⤵
- Executes dropped EXE
PID:2316 -
\??\c:\3pppv.exec:\3pppv.exe34⤵
- Executes dropped EXE
PID:2800 -
\??\c:\9frlffl.exec:\9frlffl.exe35⤵
- Executes dropped EXE
PID:2244 -
\??\c:\3nbtbb.exec:\3nbtbb.exe36⤵
- Executes dropped EXE
PID:2312 -
\??\c:\jvddv.exec:\jvddv.exe37⤵
- Executes dropped EXE
PID:1632 -
\??\c:\jjpjp.exec:\jjpjp.exe38⤵
- Executes dropped EXE
PID:2848 -
\??\c:\lxfxxrx.exec:\lxfxxrx.exe39⤵
- Executes dropped EXE
PID:2728 -
\??\c:\nnhnbh.exec:\nnhnbh.exe40⤵
- Executes dropped EXE
PID:2872 -
\??\c:\ddvdp.exec:\ddvdp.exe41⤵
- Executes dropped EXE
PID:2656 -
\??\c:\vjvvv.exec:\vjvvv.exe42⤵
- Executes dropped EXE
PID:2916 -
\??\c:\rxrxlfr.exec:\rxrxlfr.exe43⤵
- Executes dropped EXE
PID:2668 -
\??\c:\hhbbnt.exec:\hhbbnt.exe44⤵
- Executes dropped EXE
PID:2640 -
\??\c:\9hthhh.exec:\9hthhh.exe45⤵
- Executes dropped EXE
PID:2740 -
\??\c:\1vjdd.exec:\1vjdd.exe46⤵
- Executes dropped EXE
PID:3036 -
\??\c:\rlfffxf.exec:\rlfffxf.exe47⤵
- Executes dropped EXE
PID:3028 -
\??\c:\hhttbh.exec:\hhttbh.exe48⤵
- Executes dropped EXE
PID:2040 -
\??\c:\7thttt.exec:\7thttt.exe49⤵
- Executes dropped EXE
PID:1428 -
\??\c:\dvpvv.exec:\dvpvv.exe50⤵
- Executes dropped EXE
PID:2372 -
\??\c:\xxllxxx.exec:\xxllxxx.exe51⤵
- Executes dropped EXE
PID:2436 -
\??\c:\lffflrf.exec:\lffflrf.exe52⤵
- Executes dropped EXE
PID:1864 -
\??\c:\5bhnnn.exec:\5bhnnn.exe53⤵
- Executes dropped EXE
PID:600 -
\??\c:\9vjpv.exec:\9vjpv.exe54⤵
- Executes dropped EXE
PID:1048 -
\??\c:\7lxxxrr.exec:\7lxxxrr.exe55⤵
- Executes dropped EXE
PID:548 -
\??\c:\rfxlrxf.exec:\rfxlrxf.exe56⤵
- Executes dropped EXE
PID:1784 -
\??\c:\hnttht.exec:\hnttht.exe57⤵
- Executes dropped EXE
PID:2680 -
\??\c:\vpjpj.exec:\vpjpj.exe58⤵
- Executes dropped EXE
PID:1672 -
\??\c:\vjvvv.exec:\vjvvv.exe59⤵
- Executes dropped EXE
PID:2220 -
\??\c:\xxxlxfx.exec:\xxxlxfx.exe60⤵
- Executes dropped EXE
PID:1976 -
\??\c:\btbbbh.exec:\btbbbh.exe61⤵
- Executes dropped EXE
PID:1684 -
\??\c:\vjvvv.exec:\vjvvv.exe62⤵
- Executes dropped EXE
PID:108 -
\??\c:\jpvpd.exec:\jpvpd.exe63⤵
- Executes dropped EXE
PID:2980 -
\??\c:\rfxxffr.exec:\rfxxffr.exe64⤵
- Executes dropped EXE
PID:1800 -
\??\c:\7hhhbb.exec:\7hhhbb.exe65⤵
- Executes dropped EXE
PID:588 -
\??\c:\nbnthn.exec:\nbnthn.exe66⤵PID:1752
-
\??\c:\dvpjp.exec:\dvpjp.exe67⤵PID:568
-
\??\c:\3rfxxxl.exec:\3rfxxxl.exe68⤵PID:864
-
\??\c:\hbtttn.exec:\hbtttn.exe69⤵PID:3060
-
\??\c:\nbtbnt.exec:\nbtbnt.exe70⤵PID:2080
-
\??\c:\pdjdj.exec:\pdjdj.exe71⤵PID:2156
-
\??\c:\llxflfr.exec:\llxflfr.exe72⤵PID:1956
-
\??\c:\tnbbhb.exec:\tnbbhb.exe73⤵PID:2364
-
\??\c:\ntnbnb.exec:\ntnbnb.exe74⤵PID:2072
-
\??\c:\dvppd.exec:\dvppd.exe75⤵PID:2112
-
\??\c:\ffrrffr.exec:\ffrrffr.exe76⤵PID:2396
-
\??\c:\lxxxlxf.exec:\lxxxlxf.exe77⤵PID:2300
-
\??\c:\bthnnt.exec:\bthnnt.exe78⤵PID:2944
-
\??\c:\3pjdj.exec:\3pjdj.exe79⤵PID:2748
-
\??\c:\vpddv.exec:\vpddv.exe80⤵PID:2260
-
\??\c:\5rrflfl.exec:\5rrflfl.exe81⤵PID:2832
-
\??\c:\nnttbh.exec:\nnttbh.exe82⤵PID:2452
-
\??\c:\vjjdv.exec:\vjjdv.exe83⤵PID:2768
-
\??\c:\pjvvv.exec:\pjvvv.exe84⤵PID:2724
-
\??\c:\3frxffl.exec:\3frxffl.exe85⤵PID:2744
-
\??\c:\9bnhnn.exec:\9bnhnn.exe86⤵PID:2732
-
\??\c:\ppdpv.exec:\ppdpv.exe87⤵PID:2888
-
\??\c:\pjdpv.exec:\pjdpv.exe88⤵PID:2624
-
\??\c:\xlrrrll.exec:\xlrrrll.exe89⤵PID:2456
-
\??\c:\nbnnnt.exec:\nbnnnt.exe90⤵PID:2592
-
\??\c:\thtbtb.exec:\thtbtb.exe91⤵PID:1820
-
\??\c:\vvpdp.exec:\vvpdp.exe92⤵PID:1320
-
\??\c:\rffxlfl.exec:\rffxlfl.exe93⤵PID:2020
-
\??\c:\xxrxffr.exec:\xxrxffr.exe94⤵PID:1652
-
\??\c:\nbhbbb.exec:\nbhbbb.exe95⤵PID:1280
-
\??\c:\pjddj.exec:\pjddj.exe96⤵PID:264
-
\??\c:\dpvpj.exec:\dpvpj.exe97⤵PID:1688
-
\??\c:\3llllll.exec:\3llllll.exe98⤵PID:1596
-
\??\c:\hbtntn.exec:\hbtntn.exe99⤵PID:1036
-
\??\c:\ppvdp.exec:\ppvdp.exe100⤵PID:780
-
\??\c:\ddvpp.exec:\ddvpp.exe101⤵PID:2688
-
\??\c:\rrfrflr.exec:\rrfrflr.exe102⤵PID:2856
-
\??\c:\hthbhh.exec:\hthbhh.exe103⤵PID:2140
-
\??\c:\tnntbb.exec:\tnntbb.exe104⤵PID:1948
-
\??\c:\dpvvv.exec:\dpvvv.exe105⤵PID:2508
-
\??\c:\9rfllrr.exec:\9rfllrr.exe106⤵PID:2264
-
\??\c:\xrffllr.exec:\xrffllr.exe107⤵PID:1772
-
\??\c:\bnhthn.exec:\bnhthn.exe108⤵PID:1376
-
\??\c:\7vdvd.exec:\7vdvd.exe109⤵PID:2604
-
\??\c:\jvjdv.exec:\jvjdv.exe110⤵PID:2812
-
\??\c:\lxlfffr.exec:\lxlfffr.exe111⤵PID:1728
-
\??\c:\7thntb.exec:\7thntb.exe112⤵PID:2236
-
\??\c:\pjdpp.exec:\pjdpp.exe113⤵PID:2900
-
\??\c:\vpjpv.exec:\vpjpv.exe114⤵PID:2388
-
\??\c:\1lxrrll.exec:\1lxrrll.exe115⤵PID:2228
-
\??\c:\1rffllr.exec:\1rffllr.exe116⤵PID:2168
-
\??\c:\nhttbb.exec:\nhttbb.exe117⤵PID:1880
-
\??\c:\vjvpp.exec:\vjvpp.exe118⤵PID:2552
-
\??\c:\9rxllff.exec:\9rxllff.exe119⤵PID:2496
-
\??\c:\frffffl.exec:\frffffl.exe120⤵PID:2316
-
\??\c:\thbhhh.exec:\thbhhh.exe121⤵PID:2076
-
\??\c:\pjvjp.exec:\pjvjp.exe122⤵PID:2268
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-