Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 04:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
da977cb1e3afd4d56f0e49ef978bfb02cda2fe9cee04b112d6e049acb6dc5f2b.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
da977cb1e3afd4d56f0e49ef978bfb02cda2fe9cee04b112d6e049acb6dc5f2b.exe
-
Size
455KB
-
MD5
baf0de87168f5f8e4372bcd13873d8bf
-
SHA1
42ff17385708196ce129cc9802157220a8a5cdd5
-
SHA256
da977cb1e3afd4d56f0e49ef978bfb02cda2fe9cee04b112d6e049acb6dc5f2b
-
SHA512
de818867d5b440aee664e80c1524ecb01942da951be3114d1de4a1fd793fdff3325407ccabcd057c6f0c2351b6e9a3548e9eba326a8f46bf8fef1c88b82fbfda
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRy:q7Tc2NYHUrAwfMp3CDRy
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
Processes:
resource yara_rule behavioral1/memory/2228-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-48-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2552-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1820-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2152-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2508-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2008-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1636-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1036-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2180-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-215-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1336-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1760-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1656-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1716-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1880-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1392-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1780-289-0x0000000076AF0000-0x0000000076C0F000-memory.dmp family_blackmoon behavioral1/memory/1964-297-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1444-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-357-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2200-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1980-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2420-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/696-452-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-506-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1016-553-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2600-615-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/320-717-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2148-733-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
rlxrxrl.exebbtbhh.exejjvdj.exebnnntt.exerrlrflx.exexxlxfrf.exebbthtb.exerlfrlrl.exenbtnhb.exejdvpd.exerrrxrfx.exevpdpp.exe3ffflrx.exepjddp.exe9lxxxxf.exenhbnnn.exerlxfrxf.exexxxrflr.exepvjpv.exellfrffr.exehbbnhh.exepjvdj.exetnbhtb.exevvjpv.exeffxlxlf.exevpjvd.exelllrrlf.exetttbhn.exelrlfxfx.exetbbhtb.exepjpvj.exe5ppdv.exexfxfxfx.exerxrlrxl.exebbbbbb.exedjjvv.exerrflrxf.exentbhnt.exepdvjv.exe3xffrxx.exetnnttt.exevdjpv.exe7dvdp.exexxfrxlx.exe7bbhbh.exe1bnttt.exevpjpv.exefffxlrl.exe1btnbh.exe9vjpv.exe5rlrxfl.exerlfxlrx.exe5hbhtt.exeppvdd.exefxffrxl.exehnbnbh.exepvvpv.exejdvvj.exexrrxflf.exebhhntb.exe1jddj.exevppvv.exeflflxlr.exehbbhtb.exepid Process 2228 rlxrxrl.exe 2788 bbtbhh.exe 2652 jjvdj.exe 2556 bnnntt.exe 2688 rrlrflx.exe 2552 xxlxfrf.exe 3048 bbthtb.exe 1820 rlfrlrl.exe 2240 nbtnhb.exe 2152 jdvpd.exe 2820 rrrxrfx.exe 1676 vpdpp.exe 636 3ffflrx.exe 2508 pjddp.exe 2008 9lxxxxf.exe 1636 nhbnnn.exe 1036 rlxfrxf.exe 1108 xxxrflr.exe 2180 pvjpv.exe 2232 llfrffr.exe 2608 hbbnhh.exe 2372 pjvdj.exe 1336 tnbhtb.exe 1760 vvjpv.exe 1716 ffxlxlf.exe 1656 vpjvd.exe 1880 lllrrlf.exe 1612 tttbhn.exe 1392 lrlfxfx.exe 276 tbbhtb.exe 1780 pjpvj.exe 1640 5ppdv.exe 1444 xfxfxfx.exe 2656 rxrlrxl.exe 2224 bbbbbb.exe 2880 djjvv.exe 2568 rrflrxf.exe 2596 ntbhnt.exe 2052 pdvjv.exe 2000 3xffrxx.exe 2988 tnnttt.exe 2400 vdjpv.exe 2200 7dvdp.exe 2160 xxfrxlx.exe 1980 7bbhbh.exe 2820 1bnttt.exe 2420 vpjpv.exe 2580 fffxlrl.exe 784 1btnbh.exe 272 9vjpv.exe 2452 5rlrxfl.exe 2624 rlfxlrx.exe 696 5hbhtt.exe 2208 ppvdd.exe 1456 fxffrxl.exe 2180 hnbnbh.exe 2944 pvvpv.exe 2172 jdvvj.exe 1040 xrrxflf.exe 2480 bhhntb.exe 700 1jddj.exe 944 vppvv.exe 2464 flflxlr.exe 1940 hbbhtb.exe -
Processes:
resource yara_rule behavioral1/memory/2228-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1820-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1036-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1336-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1880-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1392-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1780-289-0x0000000076AF0000-0x0000000076C0F000-memory.dmp upx behavioral1/memory/1444-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-357-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2200-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/272-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-446-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/696-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-465-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-532-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-544-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1016-553-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1564-574-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-587-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-600-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-615-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2956-689-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/320-717-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/644-724-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-733-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
3dpvp.exevdvjd.exelffrrrx.exennhhnb.exedjjvj.exejjdjp.exetbthnb.exe5pjdp.exevdpjp.exellfrlrr.exe7ttbnt.exejpjpd.exevvvdp.exe9tnbbb.exebtnntb.exevvppd.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbthnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfrlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ttbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tnbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
da977cb1e3afd4d56f0e49ef978bfb02cda2fe9cee04b112d6e049acb6dc5f2b.exerlxrxrl.exebbtbhh.exejjvdj.exebnnntt.exerrlrflx.exexxlxfrf.exebbthtb.exerlfrlrl.exenbtnhb.exejdvpd.exerrrxrfx.exevpdpp.exe3ffflrx.exepjddp.exe9lxxxxf.exedescription pid Process procid_target PID 2616 wrote to memory of 2228 2616 da977cb1e3afd4d56f0e49ef978bfb02cda2fe9cee04b112d6e049acb6dc5f2b.exe 30 PID 2616 wrote to memory of 2228 2616 da977cb1e3afd4d56f0e49ef978bfb02cda2fe9cee04b112d6e049acb6dc5f2b.exe 30 PID 2616 wrote to memory of 2228 2616 da977cb1e3afd4d56f0e49ef978bfb02cda2fe9cee04b112d6e049acb6dc5f2b.exe 30 PID 2616 wrote to memory of 2228 2616 da977cb1e3afd4d56f0e49ef978bfb02cda2fe9cee04b112d6e049acb6dc5f2b.exe 30 PID 2228 wrote to memory of 2788 2228 rlxrxrl.exe 31 PID 2228 wrote to memory of 2788 2228 rlxrxrl.exe 31 PID 2228 wrote to memory of 2788 2228 rlxrxrl.exe 31 PID 2228 wrote to memory of 2788 2228 rlxrxrl.exe 31 PID 2788 wrote to memory of 2652 2788 bbtbhh.exe 32 PID 2788 wrote to memory of 2652 2788 bbtbhh.exe 32 PID 2788 wrote to memory of 2652 2788 bbtbhh.exe 32 PID 2788 wrote to memory of 2652 2788 bbtbhh.exe 32 PID 2652 wrote to memory of 2556 2652 jjvdj.exe 33 PID 2652 wrote to memory of 2556 2652 jjvdj.exe 33 PID 2652 wrote to memory of 2556 2652 jjvdj.exe 33 PID 2652 wrote to memory of 2556 2652 jjvdj.exe 33 PID 2556 wrote to memory of 2688 2556 bnnntt.exe 34 PID 2556 wrote to memory of 2688 2556 bnnntt.exe 34 PID 2556 wrote to memory of 2688 2556 bnnntt.exe 34 PID 2556 wrote to memory of 2688 2556 bnnntt.exe 34 PID 2688 wrote to memory of 2552 2688 rrlrflx.exe 35 PID 2688 wrote to memory of 2552 2688 rrlrflx.exe 35 PID 2688 wrote to memory of 2552 2688 rrlrflx.exe 35 PID 2688 wrote to memory of 2552 2688 rrlrflx.exe 35 PID 2552 wrote to memory of 3048 2552 xxlxfrf.exe 36 PID 2552 wrote to memory of 3048 2552 xxlxfrf.exe 36 PID 2552 wrote to memory of 3048 2552 xxlxfrf.exe 36 PID 2552 wrote to memory of 3048 2552 xxlxfrf.exe 36 PID 3048 wrote to memory of 1820 3048 bbthtb.exe 37 PID 3048 wrote to memory of 1820 3048 bbthtb.exe 37 PID 3048 wrote to memory of 1820 3048 bbthtb.exe 37 PID 3048 wrote to memory of 1820 3048 bbthtb.exe 37 PID 1820 wrote to memory of 2240 1820 rlfrlrl.exe 38 PID 1820 wrote to memory of 2240 1820 rlfrlrl.exe 38 PID 1820 wrote to memory of 2240 1820 rlfrlrl.exe 38 PID 1820 wrote to memory of 2240 1820 rlfrlrl.exe 38 PID 2240 wrote to memory of 2152 2240 nbtnhb.exe 39 PID 2240 wrote to memory of 2152 2240 nbtnhb.exe 39 PID 2240 wrote to memory of 2152 2240 nbtnhb.exe 39 PID 2240 wrote to memory of 2152 2240 nbtnhb.exe 39 PID 2152 wrote to memory of 2820 2152 jdvpd.exe 40 PID 2152 wrote to memory of 2820 2152 jdvpd.exe 40 PID 2152 wrote to memory of 2820 2152 jdvpd.exe 40 PID 2152 wrote to memory of 2820 2152 jdvpd.exe 40 PID 2820 wrote to memory of 1676 2820 rrrxrfx.exe 41 PID 2820 wrote to memory of 1676 2820 rrrxrfx.exe 41 PID 2820 wrote to memory of 1676 2820 rrrxrfx.exe 41 PID 2820 wrote to memory of 1676 2820 rrrxrfx.exe 41 PID 1676 wrote to memory of 636 1676 vpdpp.exe 42 PID 1676 wrote to memory of 636 1676 vpdpp.exe 42 PID 1676 wrote to memory of 636 1676 vpdpp.exe 42 PID 1676 wrote to memory of 636 1676 vpdpp.exe 42 PID 636 wrote to memory of 2508 636 3ffflrx.exe 43 PID 636 wrote to memory of 2508 636 3ffflrx.exe 43 PID 636 wrote to memory of 2508 636 3ffflrx.exe 43 PID 636 wrote to memory of 2508 636 3ffflrx.exe 43 PID 2508 wrote to memory of 2008 2508 pjddp.exe 44 PID 2508 wrote to memory of 2008 2508 pjddp.exe 44 PID 2508 wrote to memory of 2008 2508 pjddp.exe 44 PID 2508 wrote to memory of 2008 2508 pjddp.exe 44 PID 2008 wrote to memory of 1636 2008 9lxxxxf.exe 45 PID 2008 wrote to memory of 1636 2008 9lxxxxf.exe 45 PID 2008 wrote to memory of 1636 2008 9lxxxxf.exe 45 PID 2008 wrote to memory of 1636 2008 9lxxxxf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\da977cb1e3afd4d56f0e49ef978bfb02cda2fe9cee04b112d6e049acb6dc5f2b.exe"C:\Users\Admin\AppData\Local\Temp\da977cb1e3afd4d56f0e49ef978bfb02cda2fe9cee04b112d6e049acb6dc5f2b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\rlxrxrl.exec:\rlxrxrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\bbtbhh.exec:\bbtbhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\jjvdj.exec:\jjvdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\bnnntt.exec:\bnnntt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\rrlrflx.exec:\rrlrflx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\xxlxfrf.exec:\xxlxfrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\bbthtb.exec:\bbthtb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\rlfrlrl.exec:\rlfrlrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\nbtnhb.exec:\nbtnhb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\jdvpd.exec:\jdvpd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\rrrxrfx.exec:\rrrxrfx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\vpdpp.exec:\vpdpp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\3ffflrx.exec:\3ffflrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
\??\c:\pjddp.exec:\pjddp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\9lxxxxf.exec:\9lxxxxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\nhbnnn.exec:\nhbnnn.exe17⤵
- Executes dropped EXE
PID:1636 -
\??\c:\rlxfrxf.exec:\rlxfrxf.exe18⤵
- Executes dropped EXE
PID:1036 -
\??\c:\xxxrflr.exec:\xxxrflr.exe19⤵
- Executes dropped EXE
PID:1108 -
\??\c:\pvjpv.exec:\pvjpv.exe20⤵
- Executes dropped EXE
PID:2180 -
\??\c:\llfrffr.exec:\llfrffr.exe21⤵
- Executes dropped EXE
PID:2232 -
\??\c:\hbbnhh.exec:\hbbnhh.exe22⤵
- Executes dropped EXE
PID:2608 -
\??\c:\pjvdj.exec:\pjvdj.exe23⤵
- Executes dropped EXE
PID:2372 -
\??\c:\tnbhtb.exec:\tnbhtb.exe24⤵
- Executes dropped EXE
PID:1336 -
\??\c:\vvjpv.exec:\vvjpv.exe25⤵
- Executes dropped EXE
PID:1760 -
\??\c:\ffxlxlf.exec:\ffxlxlf.exe26⤵
- Executes dropped EXE
PID:1716 -
\??\c:\vpjvd.exec:\vpjvd.exe27⤵
- Executes dropped EXE
PID:1656 -
\??\c:\lllrrlf.exec:\lllrrlf.exe28⤵
- Executes dropped EXE
PID:1880 -
\??\c:\tttbhn.exec:\tttbhn.exe29⤵
- Executes dropped EXE
PID:1612 -
\??\c:\lrlfxfx.exec:\lrlfxfx.exe30⤵
- Executes dropped EXE
PID:1392 -
\??\c:\tbbhtb.exec:\tbbhtb.exe31⤵
- Executes dropped EXE
PID:276 -
\??\c:\pjpvj.exec:\pjpvj.exe32⤵
- Executes dropped EXE
PID:1780 -
\??\c:\rrrfxfr.exec:\rrrfxfr.exe33⤵PID:1964
-
\??\c:\5ppdv.exec:\5ppdv.exe34⤵
- Executes dropped EXE
PID:1640 -
\??\c:\xfxfxfx.exec:\xfxfxfx.exe35⤵
- Executes dropped EXE
PID:1444 -
\??\c:\rxrlrxl.exec:\rxrlrxl.exe36⤵
- Executes dropped EXE
PID:2656 -
\??\c:\bbbbbb.exec:\bbbbbb.exe37⤵
- Executes dropped EXE
PID:2224 -
\??\c:\djjvv.exec:\djjvv.exe38⤵
- Executes dropped EXE
PID:2880 -
\??\c:\rrflrxf.exec:\rrflrxf.exe39⤵
- Executes dropped EXE
PID:2568 -
\??\c:\ntbhnt.exec:\ntbhnt.exe40⤵
- Executes dropped EXE
PID:2596 -
\??\c:\pdvjv.exec:\pdvjv.exe41⤵
- Executes dropped EXE
PID:2052 -
\??\c:\3xffrxx.exec:\3xffrxx.exe42⤵
- Executes dropped EXE
PID:2000 -
\??\c:\tnnttt.exec:\tnnttt.exe43⤵
- Executes dropped EXE
PID:2988 -
\??\c:\vdjpv.exec:\vdjpv.exe44⤵
- Executes dropped EXE
PID:2400 -
\??\c:\7dvdp.exec:\7dvdp.exe45⤵
- Executes dropped EXE
PID:2200 -
\??\c:\xxfrxlx.exec:\xxfrxlx.exe46⤵
- Executes dropped EXE
PID:2160 -
\??\c:\7bbhbh.exec:\7bbhbh.exe47⤵
- Executes dropped EXE
PID:1980 -
\??\c:\1bnttt.exec:\1bnttt.exe48⤵
- Executes dropped EXE
PID:2820 -
\??\c:\vpjpv.exec:\vpjpv.exe49⤵
- Executes dropped EXE
PID:2420 -
\??\c:\fffxlrl.exec:\fffxlrl.exe50⤵
- Executes dropped EXE
PID:2580 -
\??\c:\1btnbh.exec:\1btnbh.exe51⤵
- Executes dropped EXE
PID:784 -
\??\c:\9vjpv.exec:\9vjpv.exe52⤵
- Executes dropped EXE
PID:272 -
\??\c:\5rlrxfl.exec:\5rlrxfl.exe53⤵
- Executes dropped EXE
PID:2452 -
\??\c:\rlfxlrx.exec:\rlfxlrx.exe54⤵
- Executes dropped EXE
PID:2624 -
\??\c:\5hbhtt.exec:\5hbhtt.exe55⤵
- Executes dropped EXE
PID:696 -
\??\c:\ppvdd.exec:\ppvdd.exe56⤵
- Executes dropped EXE
PID:2208 -
\??\c:\fxffrxl.exec:\fxffrxl.exe57⤵
- Executes dropped EXE
PID:1456 -
\??\c:\hnbnbh.exec:\hnbnbh.exe58⤵
- Executes dropped EXE
PID:2180 -
\??\c:\pvvpv.exec:\pvvpv.exe59⤵
- Executes dropped EXE
PID:2944 -
\??\c:\jdvvj.exec:\jdvvj.exe60⤵
- Executes dropped EXE
PID:2172 -
\??\c:\xrrxflf.exec:\xrrxflf.exe61⤵
- Executes dropped EXE
PID:1040 -
\??\c:\bhhntb.exec:\bhhntb.exe62⤵
- Executes dropped EXE
PID:2480 -
\??\c:\1jddj.exec:\1jddj.exe63⤵
- Executes dropped EXE
PID:700 -
\??\c:\vppvv.exec:\vppvv.exe64⤵
- Executes dropped EXE
PID:944 -
\??\c:\flflxlr.exec:\flflxlr.exe65⤵
- Executes dropped EXE
PID:2464 -
\??\c:\hbbhtb.exec:\hbbhtb.exe66⤵
- Executes dropped EXE
PID:1940 -
\??\c:\tthnhn.exec:\tthnhn.exe67⤵PID:1656
-
\??\c:\5ppjv.exec:\5ppjv.exe68⤵PID:2888
-
\??\c:\lffxxfx.exec:\lffxxfx.exe69⤵PID:2056
-
\??\c:\hhbnht.exec:\hhbnht.exe70⤵PID:1016
-
\??\c:\thnbnn.exec:\thnbnn.exe71⤵PID:2868
-
\??\c:\jjvdj.exec:\jjvdj.exe72⤵PID:276
-
\??\c:\lfrrlff.exec:\lfrrlff.exe73⤵PID:1628
-
\??\c:\7btbtt.exec:\7btbtt.exe74⤵PID:1564
-
\??\c:\ttnbtb.exec:\ttnbtb.exe75⤵PID:2776
-
\??\c:\djjvj.exec:\djjvj.exe76⤵
- System Location Discovery: System Language Discovery
PID:2764 -
\??\c:\xrffxlf.exec:\xrffxlf.exe77⤵PID:2640
-
\??\c:\tnhnhh.exec:\tnhnhh.exe78⤵PID:2744
-
\??\c:\tnhnhh.exec:\tnhnhh.exe79⤵PID:3044
-
\??\c:\1vvpj.exec:\1vvpj.exe80⤵PID:2600
-
\??\c:\5ffxfxf.exec:\5ffxfxf.exe81⤵PID:2524
-
\??\c:\xrrflrl.exec:\xrrflrl.exe82⤵PID:2540
-
\??\c:\hnbnhb.exec:\hnbnhb.exe83⤵PID:2588
-
\??\c:\vvdjp.exec:\vvdjp.exe84⤵PID:1044
-
\??\c:\9lfxlxx.exec:\9lfxlxx.exe85⤵PID:2164
-
\??\c:\3fxflxf.exec:\3fxflxf.exe86⤵PID:1924
-
\??\c:\nnhnnn.exec:\nnhnnn.exe87⤵PID:2824
-
\??\c:\vpvvj.exec:\vpvvj.exe88⤵PID:596
-
\??\c:\lrrxlfl.exec:\lrrxlfl.exe89⤵PID:2860
-
\??\c:\llxrflx.exec:\llxrflx.exe90⤵PID:1440
-
\??\c:\bbnbtb.exec:\bbnbtb.exe91⤵PID:1676
-
\??\c:\jjdpd.exec:\jjdpd.exe92⤵PID:2956
-
\??\c:\llxrfxl.exec:\llxrfxl.exe93⤵PID:784
-
\??\c:\lllfrff.exec:\lllfrff.exe94⤵PID:272
-
\??\c:\nnnthn.exec:\nnnthn.exe95⤵PID:320
-
\??\c:\ppjjp.exec:\ppjjp.exe96⤵PID:1784
-
\??\c:\djdjj.exec:\djdjj.exe97⤵PID:644
-
\??\c:\lrxlxlx.exec:\lrxlxlx.exe98⤵PID:2148
-
\??\c:\bbbbnb.exec:\bbbbnb.exe99⤵PID:2252
-
\??\c:\dvddj.exec:\dvddj.exe100⤵PID:1096
-
\??\c:\vddjd.exec:\vddjd.exe101⤵PID:2608
-
\??\c:\rlflrxl.exec:\rlflrxl.exe102⤵PID:2032
-
\??\c:\bbtnbb.exec:\bbtnbb.exe103⤵PID:1736
-
\??\c:\7btbhb.exec:\7btbhb.exe104⤵PID:1524
-
\??\c:\5jdpd.exec:\5jdpd.exe105⤵PID:316
-
\??\c:\llllrxl.exec:\llllrxl.exe106⤵PID:876
-
\??\c:\bbnbtt.exec:\bbnbtt.exe107⤵PID:2120
-
\??\c:\nbhtnb.exec:\nbhtnb.exe108⤵PID:2496
-
\??\c:\dvpvd.exec:\dvpvd.exe109⤵PID:1808
-
\??\c:\5xrrxfx.exec:\5xrrxfx.exe110⤵PID:1612
-
\??\c:\bbntbn.exec:\bbntbn.exe111⤵PID:1700
-
\??\c:\3bnnnt.exec:\3bnnnt.exe112⤵PID:1692
-
\??\c:\1pjjv.exec:\1pjjv.exe113⤵PID:3068
-
\??\c:\lfllxxf.exec:\lfllxxf.exe114⤵PID:2752
-
\??\c:\rrlfflf.exec:\rrlfflf.exe115⤵PID:2228
-
\??\c:\nhthtb.exec:\nhthtb.exe116⤵PID:2192
-
\??\c:\pvvjv.exec:\pvvjv.exe117⤵PID:2652
-
\??\c:\jpppp.exec:\jpppp.exe118⤵PID:2528
-
\??\c:\xfxflfx.exec:\xfxflfx.exe119⤵PID:1724
-
\??\c:\tthtbb.exec:\tthtbb.exe120⤵PID:2692
-
\??\c:\7bbbnn.exec:\7bbbnn.exe121⤵PID:2088
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-