Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 02:19
Static task
static1
Behavioral task
behavioral1
Sample
98f6a9eb5af52fca53cceedf89688553b42758ea49e4b4a52d493ec5d0e20720.exe
Resource
win7-20240903-en
General
-
Target
98f6a9eb5af52fca53cceedf89688553b42758ea49e4b4a52d493ec5d0e20720.exe
-
Size
453KB
-
MD5
1ed920f9954d0971060e9a75577cd7ac
-
SHA1
16f3876f008c05239a2ea00423cda1762a2959ac
-
SHA256
98f6a9eb5af52fca53cceedf89688553b42758ea49e4b4a52d493ec5d0e20720
-
SHA512
66ac63cab28eeddc2b79905b29fc94fff96ca64956406ee7e3e8aa71ba9bf00420627f45bf904a8bedf43b31091af88bd20a40267f363ad97214333224cd69c8
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeW:q7Tc2NYHUrAwfMp3CDW
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
Processes:
resource yara_rule behavioral1/memory/1972-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2536-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1864-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1932-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1320-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-110-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2936-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1952-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-167-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/380-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1500-208-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2248-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/940-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2492-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2416-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1972-307-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2144-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-398-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/356-412-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1992-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-426-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1640-465-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/304-472-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2152-485-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-531-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2144-611-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-676-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2700-696-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2796-705-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
lxfxxrf.exennbthb.exefrffflx.exe9xxxrll.exe3jddj.exebtnthn.exepdpvv.exexxrxfll.exebnbbbb.exelxfxffx.exelxxxrxf.exe1xlrfrf.exe9hbhbb.exe9lfflff.exe5hbhtn.exe3pvpp.exerfrrxrr.exevpdjp.exelrrrllr.exennbhhb.exe7pdvp.exe5htntb.exe5vdvp.exeffrlrlr.exe1bhttb.exellflxxr.exexlrxxrx.exepjvjp.exe5lxrxfl.exetnbbhb.exedvdjp.exellxfxrf.exe5bhbhn.exe3ppjj.exerlxrfxf.exefrfrfxx.exehbnntb.exe7jvjv.exe3pjpj.exexllffff.exenbhnnh.exehthbbb.exe1jvvd.exe3lrlllr.exe3xxlllf.exehthhhh.exejdjdv.exepjppp.exerfrxrxf.exehnbbtt.exehhttth.exepdvpd.exelfxrrff.exelxllllx.exehthhnn.exejdppp.exevpvjv.exefrfxxxf.exerlxrrlr.exebtbttt.exejvddv.exe9pjjp.exerflrlll.exe1ntntn.exepid process 1864 lxfxxrf.exe 2536 nnbthb.exe 2800 frffflx.exe 1932 9xxxrll.exe 2884 3jddj.exe 2620 btnthn.exe 2848 pdpvv.exe 2656 xxrxfll.exe 2644 bnbbbb.exe 1320 lxfxffx.exe 692 lxxxrxf.exe 2936 1xlrfrf.exe 2680 9hbhbb.exe 1952 9lfflff.exe 2368 5hbhtn.exe 2000 3pvpp.exe 380 rfrrxrr.exe 2988 vpdjp.exe 2792 lrrrllr.exe 1500 nnbhhb.exe 2248 7pdvp.exe 1356 5htntb.exe 1712 5vdvp.exe 1964 ffrlrlr.exe 940 1bhttb.exe 2492 llflxxr.exe 2472 xlrxxrx.exe 1040 pjvjp.exe 904 5lxrxfl.exe 2348 tnbbhb.exe 1972 dvdjp.exe 2416 llxfxrf.exe 2588 5bhbhn.exe 2144 3ppjj.exe 2716 rlxrfxf.exe 2880 frfrfxx.exe 2768 hbnntb.exe 2888 7jvjv.exe 2824 3pjpj.exe 2636 xllffff.exe 2864 nbhnnh.exe 2724 hthbbb.exe 2628 1jvvd.exe 2464 3lrlllr.exe 1320 3xxlllf.exe 356 hthhhh.exe 1992 jdjdv.exe 2860 pjppp.exe 2680 rfrxrxf.exe 1952 hnbbtt.exe 2016 hhttth.exe 2672 pdvpd.exe 1660 lfxrrff.exe 1640 lxllllx.exe 304 hthhnn.exe 2988 jdppp.exe 2152 vpvjv.exe 2320 frfxxxf.exe 1748 rlxrrlr.exe 2248 btbttt.exe 1272 jvddv.exe 1236 9pjjp.exe 1540 rflrlll.exe 2116 1ntntn.exe -
Processes:
resource yara_rule behavioral1/memory/1972-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1864-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1320-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-167-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2988-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/380-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1500-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/940-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2416-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1320-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/356-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/356-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1992-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1640-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/304-472-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-473-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-486-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-531-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-570-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-580-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-611-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-618-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-669-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/872-677-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-698-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-705-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-712-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/1636-732-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
5hhbtn.exepvppp.exe1tbbbt.exexllrffl.exebbthnt.exenhtnbt.exevjvvd.exenhttbb.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tbbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllrffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbthnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
98f6a9eb5af52fca53cceedf89688553b42758ea49e4b4a52d493ec5d0e20720.exelxfxxrf.exennbthb.exefrffflx.exe9xxxrll.exe3jddj.exebtnthn.exepdpvv.exexxrxfll.exebnbbbb.exelxfxffx.exelxxxrxf.exe1xlrfrf.exe9hbhbb.exe9lfflff.exe5hbhtn.exedescription pid process target process PID 1972 wrote to memory of 1864 1972 98f6a9eb5af52fca53cceedf89688553b42758ea49e4b4a52d493ec5d0e20720.exe lxfxxrf.exe PID 1972 wrote to memory of 1864 1972 98f6a9eb5af52fca53cceedf89688553b42758ea49e4b4a52d493ec5d0e20720.exe lxfxxrf.exe PID 1972 wrote to memory of 1864 1972 98f6a9eb5af52fca53cceedf89688553b42758ea49e4b4a52d493ec5d0e20720.exe lxfxxrf.exe PID 1972 wrote to memory of 1864 1972 98f6a9eb5af52fca53cceedf89688553b42758ea49e4b4a52d493ec5d0e20720.exe lxfxxrf.exe PID 1864 wrote to memory of 2536 1864 lxfxxrf.exe nnbthb.exe PID 1864 wrote to memory of 2536 1864 lxfxxrf.exe nnbthb.exe PID 1864 wrote to memory of 2536 1864 lxfxxrf.exe nnbthb.exe PID 1864 wrote to memory of 2536 1864 lxfxxrf.exe nnbthb.exe PID 2536 wrote to memory of 2800 2536 nnbthb.exe frffflx.exe PID 2536 wrote to memory of 2800 2536 nnbthb.exe frffflx.exe PID 2536 wrote to memory of 2800 2536 nnbthb.exe frffflx.exe PID 2536 wrote to memory of 2800 2536 nnbthb.exe frffflx.exe PID 2800 wrote to memory of 1932 2800 frffflx.exe 9xxxrll.exe PID 2800 wrote to memory of 1932 2800 frffflx.exe 9xxxrll.exe PID 2800 wrote to memory of 1932 2800 frffflx.exe 9xxxrll.exe PID 2800 wrote to memory of 1932 2800 frffflx.exe 9xxxrll.exe PID 1932 wrote to memory of 2884 1932 9xxxrll.exe 3jddj.exe PID 1932 wrote to memory of 2884 1932 9xxxrll.exe 3jddj.exe PID 1932 wrote to memory of 2884 1932 9xxxrll.exe 3jddj.exe PID 1932 wrote to memory of 2884 1932 9xxxrll.exe 3jddj.exe PID 2884 wrote to memory of 2620 2884 3jddj.exe btnthn.exe PID 2884 wrote to memory of 2620 2884 3jddj.exe btnthn.exe PID 2884 wrote to memory of 2620 2884 3jddj.exe btnthn.exe PID 2884 wrote to memory of 2620 2884 3jddj.exe btnthn.exe PID 2620 wrote to memory of 2848 2620 btnthn.exe pdpvv.exe PID 2620 wrote to memory of 2848 2620 btnthn.exe pdpvv.exe PID 2620 wrote to memory of 2848 2620 btnthn.exe pdpvv.exe PID 2620 wrote to memory of 2848 2620 btnthn.exe pdpvv.exe PID 2848 wrote to memory of 2656 2848 pdpvv.exe xxrxfll.exe PID 2848 wrote to memory of 2656 2848 pdpvv.exe xxrxfll.exe PID 2848 wrote to memory of 2656 2848 pdpvv.exe xxrxfll.exe PID 2848 wrote to memory of 2656 2848 pdpvv.exe xxrxfll.exe PID 2656 wrote to memory of 2644 2656 xxrxfll.exe bnbbbb.exe PID 2656 wrote to memory of 2644 2656 xxrxfll.exe bnbbbb.exe PID 2656 wrote to memory of 2644 2656 xxrxfll.exe bnbbbb.exe PID 2656 wrote to memory of 2644 2656 xxrxfll.exe bnbbbb.exe PID 2644 wrote to memory of 1320 2644 bnbbbb.exe lxfxffx.exe PID 2644 wrote to memory of 1320 2644 bnbbbb.exe lxfxffx.exe PID 2644 wrote to memory of 1320 2644 bnbbbb.exe lxfxffx.exe PID 2644 wrote to memory of 1320 2644 bnbbbb.exe lxfxffx.exe PID 1320 wrote to memory of 692 1320 lxfxffx.exe lxxxrxf.exe PID 1320 wrote to memory of 692 1320 lxfxffx.exe lxxxrxf.exe PID 1320 wrote to memory of 692 1320 lxfxffx.exe lxxxrxf.exe PID 1320 wrote to memory of 692 1320 lxfxffx.exe lxxxrxf.exe PID 692 wrote to memory of 2936 692 lxxxrxf.exe 1xlrfrf.exe PID 692 wrote to memory of 2936 692 lxxxrxf.exe 1xlrfrf.exe PID 692 wrote to memory of 2936 692 lxxxrxf.exe 1xlrfrf.exe PID 692 wrote to memory of 2936 692 lxxxrxf.exe 1xlrfrf.exe PID 2936 wrote to memory of 2680 2936 1xlrfrf.exe 9hbhbb.exe PID 2936 wrote to memory of 2680 2936 1xlrfrf.exe 9hbhbb.exe PID 2936 wrote to memory of 2680 2936 1xlrfrf.exe 9hbhbb.exe PID 2936 wrote to memory of 2680 2936 1xlrfrf.exe 9hbhbb.exe PID 2680 wrote to memory of 1952 2680 9hbhbb.exe 9lfflff.exe PID 2680 wrote to memory of 1952 2680 9hbhbb.exe 9lfflff.exe PID 2680 wrote to memory of 1952 2680 9hbhbb.exe 9lfflff.exe PID 2680 wrote to memory of 1952 2680 9hbhbb.exe 9lfflff.exe PID 1952 wrote to memory of 2368 1952 9lfflff.exe 5hbhtn.exe PID 1952 wrote to memory of 2368 1952 9lfflff.exe 5hbhtn.exe PID 1952 wrote to memory of 2368 1952 9lfflff.exe 5hbhtn.exe PID 1952 wrote to memory of 2368 1952 9lfflff.exe 5hbhtn.exe PID 2368 wrote to memory of 2000 2368 5hbhtn.exe 3pvpp.exe PID 2368 wrote to memory of 2000 2368 5hbhtn.exe 3pvpp.exe PID 2368 wrote to memory of 2000 2368 5hbhtn.exe 3pvpp.exe PID 2368 wrote to memory of 2000 2368 5hbhtn.exe 3pvpp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\98f6a9eb5af52fca53cceedf89688553b42758ea49e4b4a52d493ec5d0e20720.exe"C:\Users\Admin\AppData\Local\Temp\98f6a9eb5af52fca53cceedf89688553b42758ea49e4b4a52d493ec5d0e20720.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\lxfxxrf.exec:\lxfxxrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\nnbthb.exec:\nnbthb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\frffflx.exec:\frffflx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\9xxxrll.exec:\9xxxrll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\3jddj.exec:\3jddj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\btnthn.exec:\btnthn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\pdpvv.exec:\pdpvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\xxrxfll.exec:\xxrxfll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\bnbbbb.exec:\bnbbbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\lxfxffx.exec:\lxfxffx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
\??\c:\lxxxrxf.exec:\lxxxrxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:692 -
\??\c:\1xlrfrf.exec:\1xlrfrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\9hbhbb.exec:\9hbhbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\9lfflff.exec:\9lfflff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\5hbhtn.exec:\5hbhtn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\3pvpp.exec:\3pvpp.exe17⤵
- Executes dropped EXE
PID:2000 -
\??\c:\rfrrxrr.exec:\rfrrxrr.exe18⤵
- Executes dropped EXE
PID:380 -
\??\c:\vpdjp.exec:\vpdjp.exe19⤵
- Executes dropped EXE
PID:2988 -
\??\c:\lrrrllr.exec:\lrrrllr.exe20⤵
- Executes dropped EXE
PID:2792 -
\??\c:\nnbhhb.exec:\nnbhhb.exe21⤵
- Executes dropped EXE
PID:1500 -
\??\c:\7pdvp.exec:\7pdvp.exe22⤵
- Executes dropped EXE
PID:2248 -
\??\c:\5htntb.exec:\5htntb.exe23⤵
- Executes dropped EXE
PID:1356 -
\??\c:\5vdvp.exec:\5vdvp.exe24⤵
- Executes dropped EXE
PID:1712 -
\??\c:\ffrlrlr.exec:\ffrlrlr.exe25⤵
- Executes dropped EXE
PID:1964 -
\??\c:\1bhttb.exec:\1bhttb.exe26⤵
- Executes dropped EXE
PID:940 -
\??\c:\llflxxr.exec:\llflxxr.exe27⤵
- Executes dropped EXE
PID:2492 -
\??\c:\xlrxxrx.exec:\xlrxxrx.exe28⤵
- Executes dropped EXE
PID:2472 -
\??\c:\pjvjp.exec:\pjvjp.exe29⤵
- Executes dropped EXE
PID:1040 -
\??\c:\5lxrxfl.exec:\5lxrxfl.exe30⤵
- Executes dropped EXE
PID:904 -
\??\c:\tnbbhb.exec:\tnbbhb.exe31⤵
- Executes dropped EXE
PID:2348 -
\??\c:\dvdjp.exec:\dvdjp.exe32⤵
- Executes dropped EXE
PID:1972 -
\??\c:\llxfxrf.exec:\llxfxrf.exe33⤵
- Executes dropped EXE
PID:2416 -
\??\c:\5bhbhn.exec:\5bhbhn.exe34⤵
- Executes dropped EXE
PID:2588 -
\??\c:\3ppjj.exec:\3ppjj.exe35⤵
- Executes dropped EXE
PID:2144 -
\??\c:\rlxrfxf.exec:\rlxrfxf.exe36⤵
- Executes dropped EXE
PID:2716 -
\??\c:\frfrfxx.exec:\frfrfxx.exe37⤵
- Executes dropped EXE
PID:2880 -
\??\c:\hbnntb.exec:\hbnntb.exe38⤵
- Executes dropped EXE
PID:2768 -
\??\c:\7jvjv.exec:\7jvjv.exe39⤵
- Executes dropped EXE
PID:2888 -
\??\c:\3pjpj.exec:\3pjpj.exe40⤵
- Executes dropped EXE
PID:2824 -
\??\c:\xllffff.exec:\xllffff.exe41⤵
- Executes dropped EXE
PID:2636 -
\??\c:\nbhnnh.exec:\nbhnnh.exe42⤵
- Executes dropped EXE
PID:2864 -
\??\c:\hthbbb.exec:\hthbbb.exe43⤵
- Executes dropped EXE
PID:2724 -
\??\c:\1jvvd.exec:\1jvvd.exe44⤵
- Executes dropped EXE
PID:2628 -
\??\c:\3lrlllr.exec:\3lrlllr.exe45⤵
- Executes dropped EXE
PID:2464 -
\??\c:\3xxlllf.exec:\3xxlllf.exe46⤵
- Executes dropped EXE
PID:1320 -
\??\c:\hthhhh.exec:\hthhhh.exe47⤵
- Executes dropped EXE
PID:356 -
\??\c:\jdjdv.exec:\jdjdv.exe48⤵
- Executes dropped EXE
PID:1992 -
\??\c:\pjppp.exec:\pjppp.exe49⤵
- Executes dropped EXE
PID:2860 -
\??\c:\rfrxrxf.exec:\rfrxrxf.exe50⤵
- Executes dropped EXE
PID:2680 -
\??\c:\hnbbtt.exec:\hnbbtt.exe51⤵
- Executes dropped EXE
PID:1952 -
\??\c:\hhttth.exec:\hhttth.exe52⤵
- Executes dropped EXE
PID:2016 -
\??\c:\pdvpd.exec:\pdvpd.exe53⤵
- Executes dropped EXE
PID:2672 -
\??\c:\lfxrrff.exec:\lfxrrff.exe54⤵
- Executes dropped EXE
PID:1660 -
\??\c:\lxllllx.exec:\lxllllx.exe55⤵
- Executes dropped EXE
PID:1640 -
\??\c:\hthhnn.exec:\hthhnn.exe56⤵
- Executes dropped EXE
PID:304 -
\??\c:\jdppp.exec:\jdppp.exe57⤵
- Executes dropped EXE
PID:2988 -
\??\c:\vpvjv.exec:\vpvjv.exe58⤵
- Executes dropped EXE
PID:2152 -
\??\c:\frfxxxf.exec:\frfxxxf.exe59⤵
- Executes dropped EXE
PID:2320 -
\??\c:\rlxrrlr.exec:\rlxrrlr.exe60⤵
- Executes dropped EXE
PID:1748 -
\??\c:\btbttt.exec:\btbttt.exe61⤵
- Executes dropped EXE
PID:2248 -
\??\c:\jvddv.exec:\jvddv.exe62⤵
- Executes dropped EXE
PID:1272 -
\??\c:\9pjjp.exec:\9pjjp.exe63⤵
- Executes dropped EXE
PID:1236 -
\??\c:\rflrlll.exec:\rflrlll.exe64⤵
- Executes dropped EXE
PID:1540 -
\??\c:\1ntntn.exec:\1ntntn.exe65⤵
- Executes dropped EXE
PID:2116 -
\??\c:\bbtntb.exec:\bbtntb.exe66⤵PID:964
-
\??\c:\9jvvv.exec:\9jvvv.exe67⤵PID:3008
-
\??\c:\lxrrrrx.exec:\lxrrrrx.exe68⤵PID:1300
-
\??\c:\1bhbbb.exec:\1bhbbb.exe69⤵PID:2472
-
\??\c:\1ntnnn.exec:\1ntnnn.exe70⤵PID:2244
-
\??\c:\jvddj.exec:\jvddj.exe71⤵PID:1052
-
\??\c:\xfrxfff.exec:\xfrxfff.exe72⤵PID:3020
-
\??\c:\lfrllff.exec:\lfrllff.exe73⤵PID:2156
-
\??\c:\bntnnh.exec:\bntnnh.exe74⤵PID:1708
-
\??\c:\5pvvv.exec:\5pvvv.exe75⤵PID:1604
-
\??\c:\3vppj.exec:\3vppj.exe76⤵PID:2240
-
\??\c:\7lxxxxl.exec:\7lxxxxl.exe77⤵PID:1916
-
\??\c:\nbnbbn.exec:\nbnbbn.exe78⤵PID:2144
-
\??\c:\hhbhhb.exec:\hhbhhb.exe79⤵PID:2460
-
\??\c:\djddd.exec:\djddd.exe80⤵PID:3024
-
\??\c:\5lxrlll.exec:\5lxrlll.exe81⤵PID:2816
-
\??\c:\3xfrrff.exec:\3xfrrff.exe82⤵PID:2888
-
\??\c:\htnntb.exec:\htnntb.exe83⤵PID:2896
-
\??\c:\3pjpj.exec:\3pjpj.exe84⤵PID:2652
-
\??\c:\rfxflrx.exec:\rfxflrx.exe85⤵PID:2688
-
\??\c:\rfrrxxx.exec:\rfrrxxx.exe86⤵PID:2656
-
\??\c:\btbhnn.exec:\btbhnn.exe87⤵PID:2616
-
\??\c:\jdppd.exec:\jdppd.exe88⤵PID:2664
-
\??\c:\jpdvp.exec:\jpdvp.exe89⤵PID:872
-
\??\c:\frxffxx.exec:\frxffxx.exe90⤵PID:572
-
\??\c:\5tbtnh.exec:\5tbtnh.exe91⤵PID:2700
-
\??\c:\7ntntn.exec:\7ntntn.exe92⤵PID:2936
-
\??\c:\vjvdj.exec:\vjvdj.exe93⤵PID:2796
-
\??\c:\jvjdj.exec:\jvjdj.exe94⤵PID:1996
-
\??\c:\rrxrrxf.exec:\rrxrrxf.exe95⤵PID:2600
-
\??\c:\7httbb.exec:\7httbb.exe96⤵PID:2956
-
\??\c:\1bhnhh.exec:\1bhnhh.exe97⤵PID:1636
-
\??\c:\pdjvd.exec:\pdjvd.exe98⤵PID:2500
-
\??\c:\7fxffff.exec:\7fxffff.exe99⤵PID:1372
-
\??\c:\5xrrxrr.exec:\5xrrxrr.exe100⤵PID:2328
-
\??\c:\9thbhb.exec:\9thbhb.exe101⤵PID:2072
-
\??\c:\dpjjj.exec:\dpjjj.exe102⤵PID:2708
-
\??\c:\pvjpp.exec:\pvjpp.exe103⤵PID:900
-
\??\c:\5fffrxl.exec:\5fffrxl.exe104⤵PID:1016
-
\??\c:\hhttbt.exec:\hhttbt.exe105⤵PID:1808
-
\??\c:\hnhbth.exec:\hnhbth.exe106⤵PID:2964
-
\??\c:\3pdpp.exec:\3pdpp.exe107⤵PID:1964
-
\??\c:\fxxxffr.exec:\fxxxffr.exe108⤵PID:912
-
\??\c:\fxllrll.exec:\fxllrll.exe109⤵PID:2372
-
\??\c:\bnntht.exec:\bnntht.exe110⤵PID:1508
-
\??\c:\dvjjp.exec:\dvjjp.exe111⤵PID:528
-
\??\c:\ppjpd.exec:\ppjpd.exe112⤵PID:884
-
\??\c:\lfrfffl.exec:\lfrfffl.exe113⤵PID:2472
-
\??\c:\nnhbhh.exec:\nnhbhh.exe114⤵PID:1064
-
\??\c:\nbtbbh.exec:\nbtbbh.exe115⤵PID:1944
-
\??\c:\dvvvj.exec:\dvvvj.exe116⤵PID:1800
-
\??\c:\vjvpv.exec:\vjvpv.exe117⤵PID:2156
-
\??\c:\xrfrrxf.exec:\xrfrrxf.exe118⤵PID:1968
-
\??\c:\ttnthh.exec:\ttnthh.exe119⤵PID:2404
-
\??\c:\nhbnth.exec:\nhbnth.exe120⤵PID:1936
-
\??\c:\jdvdd.exec:\jdvdd.exe121⤵PID:2720
-
\??\c:\rrxlrfr.exec:\rrxlrfr.exe122⤵PID:2144
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-