Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 09:04
Behavioral task
behavioral1
Sample
c6c4c9e56c0e4c526e57e9229474e1a231b4037971cebb38440a0e286dd75379.exe
Resource
win7-20240903-en
General
-
Target
c6c4c9e56c0e4c526e57e9229474e1a231b4037971cebb38440a0e286dd75379.exe
-
Size
91KB
-
MD5
f66665e8915c3d3682adc114cd97f658
-
SHA1
790d90a518b13d1abd9356b21b34d84257ff9b30
-
SHA256
c6c4c9e56c0e4c526e57e9229474e1a231b4037971cebb38440a0e286dd75379
-
SHA512
433dff41a794073667047e34048dd625f0f2cab5757f43d17e98b65a5b188ce83cd1e94e11deaa2210c08f0187e1c9b96bb23b8f28bfedadf3d57a7b4cbbf90b
-
SSDEEP
1536:9vQBeOGtrYS3srx93UBWfwC6Ggnouy8yaVskCzYBbKd+XsWgADUOj2YUW+S436CS:9hOmTsF93UYfwC6GIoutyaVszyKd+XYM
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 60 IoCs
Processes:
resource yara_rule behavioral1/memory/2284-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2296-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2128-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2640-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2904-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2888-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2696-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2664-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2664-72-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/2512-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2972-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/808-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2812-135-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2844-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2812-136-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2460-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1712-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1712-153-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1572-173-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1572-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1536-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1204-192-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2540-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2908-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2908-226-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2356-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1228-265-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1952-299-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3020-314-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2632-346-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2888-358-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2672-366-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2672-365-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1824-404-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1824-403-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2028-424-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3036-520-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1792-534-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2272-595-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2640-622-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2856-660-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2564-671-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1876-737-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1728-754-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2248-768-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1872-775-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2100-795-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2916-803-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2064-808-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1832-842-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2200-845-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2280-885-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2176-890-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2780-903-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1340-939-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2576-949-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1680-963-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/1488-978-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/2796-991-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2844-1020-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
fxllxfl.exedvjdj.exejjjjd.exeffllrrf.exe9btthh.exennnttb.exeddpjp.exeppjjv.exerlflrxl.exennbhbn.exevvvpv.exepjdjp.exexxrrxxf.exe9fxrxrf.exerrffllr.exehhthnt.exe7nhnnt.exejjpvd.exeffxfxfr.exe3bbthb.exejpppd.exedjdvv.exerlxlffl.exenhbhtb.exe5jdvv.exe9rflrrx.exenbhbhb.exe7djpp.exevjvvv.exe9rlflll.exe1btbbh.exe9nnbbb.exeppjvd.exexrfxrrr.exexlrlllr.exetnttbb.exejvdjj.exeddpjp.exexrlrffr.exe3lrxfll.exenhnbnn.exepvjpd.exellffflr.exelfxxfll.exe1tttbb.exepddvv.exe9frffxl.exerffflfr.exenbnnnn.exebtbthn.exepdpvj.exevdpjp.exelxfflrl.exe3hbhnn.exe3thnnt.exejvpjj.exe9rffrxf.exerffffll.exe9xllxfl.exenbhnnn.exevpvjd.exelxlllrx.exenhhnhb.exenbnnhn.exepid process 2296 fxllxfl.exe 2128 dvjdj.exe 2640 jjjjd.exe 2904 ffllrrf.exe 2888 9btthh.exe 2696 nnnttb.exe 2664 ddpjp.exe 2512 ppjjv.exe 2972 rlflrxl.exe 1256 nnbhbn.exe 808 vvvpv.exe 1500 pjdjp.exe 2028 xxrrxxf.exe 2812 9fxrxrf.exe 2844 rrffllr.exe 1712 hhthnt.exe 2460 7nhnnt.exe 1572 jjpvd.exe 1536 ffxfxfr.exe 1204 3bbthb.exe 1992 jpppd.exe 2076 djdvv.exe 2540 rlxlffl.exe 2908 nhbhtb.exe 2356 5jdvv.exe 964 9rflrrx.exe 1368 nbhbhb.exe 1228 7djpp.exe 888 vjvvv.exe 1528 9rlflll.exe 2176 1btbbh.exe 1496 9nnbbb.exe 1952 ppjvd.exe 3020 xrfxrrr.exe 1588 xlrlllr.exe 3056 tnttbb.exe 2724 jvdjj.exe 2608 ddpjp.exe 2632 xrlrffr.exe 2624 3lrxfll.exe 2888 nhnbnn.exe 2672 pvjpd.exe 2856 llffflr.exe 2544 lfxxfll.exe 2976 1tttbb.exe 2552 pddvv.exe 556 9frffxl.exe 1824 rffflfr.exe 808 nbnnnn.exe 1868 btbthn.exe 2028 pdpvj.exe 2676 vdpjp.exe 2588 lxfflrl.exe 1816 3hbhnn.exe 1248 3thnnt.exe 1400 jvpjj.exe 764 9rffrxf.exe 1836 rffffll.exe 1096 9xllxfl.exe 2404 nbhnnn.exe 2472 vpvjd.exe 1972 lxlllrx.exe 2468 nhhnhb.exe 2076 nbnnhn.exe -
Processes:
resource yara_rule behavioral1/memory/2284-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2284-7-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fxllxfl.exe upx behavioral1/memory/2296-11-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\dvjdj.exe upx behavioral1/memory/2128-25-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2128-27-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jjjjd.exe upx behavioral1/memory/2640-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2640-37-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ffllrrf.exe upx C:\9btthh.exe upx behavioral1/memory/2904-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2888-50-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nnnttb.exe upx C:\ddpjp.exe upx behavioral1/memory/2664-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2696-64-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ppjjv.exe upx behavioral1/memory/2664-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2512-85-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rlflrxl.exe upx behavioral1/memory/2972-93-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nnbhbn.exe upx C:\vvvpv.exe upx C:\pjdjp.exe upx behavioral1/memory/808-110-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xxrrxxf.exe upx C:\9fxrxrf.exe upx behavioral1/memory/2812-135-0x0000000000220000-0x0000000000247000-memory.dmp upx \??\c:\rrffllr.exe upx behavioral1/memory/2844-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2812-136-0x0000000000220000-0x0000000000247000-memory.dmp upx C:\hhthnt.exe upx C:\jjpvd.exe upx behavioral1/memory/2460-164-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\7nhnnt.exe upx behavioral1/memory/1712-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1572-175-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ffxfxfr.exe upx behavioral1/memory/1536-183-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3bbthb.exe upx C:\jpppd.exe upx C:\djdvv.exe upx C:\rlxlffl.exe upx behavioral1/memory/2540-217-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhbhtb.exe upx behavioral1/memory/2356-229-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2908-228-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5jdvv.exe upx behavioral1/memory/2356-237-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9rflrrx.exe upx C:\nbhbhb.exe upx C:\7djpp.exe upx C:\vjvvv.exe upx behavioral1/memory/1228-265-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9rlflll.exe upx C:\1btbbh.exe upx C:\9nnbbb.exe upx behavioral1/memory/1952-299-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3020-314-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2632-346-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2888-358-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2672-366-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
frlrrfl.exeffflrfr.exepdjdd.exehbhthn.exefrfllrx.exe3lrffxf.exedpjjp.exedpjdd.exepjdpj.exedvjjp.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlrrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffflrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfllrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lrffxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
c6c4c9e56c0e4c526e57e9229474e1a231b4037971cebb38440a0e286dd75379.exefxllxfl.exedvjdj.exejjjjd.exeffllrrf.exe9btthh.exennnttb.exeddpjp.exeppjjv.exerlflrxl.exennbhbn.exevvvpv.exepjdjp.exexxrrxxf.exe9fxrxrf.exerrffllr.exedescription pid process target process PID 2284 wrote to memory of 2296 2284 c6c4c9e56c0e4c526e57e9229474e1a231b4037971cebb38440a0e286dd75379.exe fxllxfl.exe PID 2284 wrote to memory of 2296 2284 c6c4c9e56c0e4c526e57e9229474e1a231b4037971cebb38440a0e286dd75379.exe fxllxfl.exe PID 2284 wrote to memory of 2296 2284 c6c4c9e56c0e4c526e57e9229474e1a231b4037971cebb38440a0e286dd75379.exe fxllxfl.exe PID 2284 wrote to memory of 2296 2284 c6c4c9e56c0e4c526e57e9229474e1a231b4037971cebb38440a0e286dd75379.exe fxllxfl.exe PID 2296 wrote to memory of 2128 2296 fxllxfl.exe dvjdj.exe PID 2296 wrote to memory of 2128 2296 fxllxfl.exe dvjdj.exe PID 2296 wrote to memory of 2128 2296 fxllxfl.exe dvjdj.exe PID 2296 wrote to memory of 2128 2296 fxllxfl.exe dvjdj.exe PID 2128 wrote to memory of 2640 2128 dvjdj.exe jjjjd.exe PID 2128 wrote to memory of 2640 2128 dvjdj.exe jjjjd.exe PID 2128 wrote to memory of 2640 2128 dvjdj.exe jjjjd.exe PID 2128 wrote to memory of 2640 2128 dvjdj.exe jjjjd.exe PID 2640 wrote to memory of 2904 2640 jjjjd.exe ffllrrf.exe PID 2640 wrote to memory of 2904 2640 jjjjd.exe ffllrrf.exe PID 2640 wrote to memory of 2904 2640 jjjjd.exe ffllrrf.exe PID 2640 wrote to memory of 2904 2640 jjjjd.exe ffllrrf.exe PID 2904 wrote to memory of 2888 2904 ffllrrf.exe 9btthh.exe PID 2904 wrote to memory of 2888 2904 ffllrrf.exe 9btthh.exe PID 2904 wrote to memory of 2888 2904 ffllrrf.exe 9btthh.exe PID 2904 wrote to memory of 2888 2904 ffllrrf.exe 9btthh.exe PID 2888 wrote to memory of 2696 2888 9btthh.exe nnnttb.exe PID 2888 wrote to memory of 2696 2888 9btthh.exe nnnttb.exe PID 2888 wrote to memory of 2696 2888 9btthh.exe nnnttb.exe PID 2888 wrote to memory of 2696 2888 9btthh.exe nnnttb.exe PID 2696 wrote to memory of 2664 2696 nnnttb.exe ddpjp.exe PID 2696 wrote to memory of 2664 2696 nnnttb.exe ddpjp.exe PID 2696 wrote to memory of 2664 2696 nnnttb.exe ddpjp.exe PID 2696 wrote to memory of 2664 2696 nnnttb.exe ddpjp.exe PID 2664 wrote to memory of 2512 2664 ddpjp.exe ppjjv.exe PID 2664 wrote to memory of 2512 2664 ddpjp.exe ppjjv.exe PID 2664 wrote to memory of 2512 2664 ddpjp.exe ppjjv.exe PID 2664 wrote to memory of 2512 2664 ddpjp.exe ppjjv.exe PID 2512 wrote to memory of 2972 2512 ppjjv.exe rlflrxl.exe PID 2512 wrote to memory of 2972 2512 ppjjv.exe rlflrxl.exe PID 2512 wrote to memory of 2972 2512 ppjjv.exe rlflrxl.exe PID 2512 wrote to memory of 2972 2512 ppjjv.exe rlflrxl.exe PID 2972 wrote to memory of 1256 2972 rlflrxl.exe nnbhbn.exe PID 2972 wrote to memory of 1256 2972 rlflrxl.exe nnbhbn.exe PID 2972 wrote to memory of 1256 2972 rlflrxl.exe nnbhbn.exe PID 2972 wrote to memory of 1256 2972 rlflrxl.exe nnbhbn.exe PID 1256 wrote to memory of 808 1256 nnbhbn.exe vvvpv.exe PID 1256 wrote to memory of 808 1256 nnbhbn.exe vvvpv.exe PID 1256 wrote to memory of 808 1256 nnbhbn.exe vvvpv.exe PID 1256 wrote to memory of 808 1256 nnbhbn.exe vvvpv.exe PID 808 wrote to memory of 1500 808 vvvpv.exe pjdjp.exe PID 808 wrote to memory of 1500 808 vvvpv.exe pjdjp.exe PID 808 wrote to memory of 1500 808 vvvpv.exe pjdjp.exe PID 808 wrote to memory of 1500 808 vvvpv.exe pjdjp.exe PID 1500 wrote to memory of 2028 1500 pjdjp.exe xxrrxxf.exe PID 1500 wrote to memory of 2028 1500 pjdjp.exe xxrrxxf.exe PID 1500 wrote to memory of 2028 1500 pjdjp.exe xxrrxxf.exe PID 1500 wrote to memory of 2028 1500 pjdjp.exe xxrrxxf.exe PID 2028 wrote to memory of 2812 2028 xxrrxxf.exe 9fxrxrf.exe PID 2028 wrote to memory of 2812 2028 xxrrxxf.exe 9fxrxrf.exe PID 2028 wrote to memory of 2812 2028 xxrrxxf.exe 9fxrxrf.exe PID 2028 wrote to memory of 2812 2028 xxrrxxf.exe 9fxrxrf.exe PID 2812 wrote to memory of 2844 2812 9fxrxrf.exe rrffllr.exe PID 2812 wrote to memory of 2844 2812 9fxrxrf.exe rrffllr.exe PID 2812 wrote to memory of 2844 2812 9fxrxrf.exe rrffllr.exe PID 2812 wrote to memory of 2844 2812 9fxrxrf.exe rrffllr.exe PID 2844 wrote to memory of 1712 2844 rrffllr.exe hhthnt.exe PID 2844 wrote to memory of 1712 2844 rrffllr.exe hhthnt.exe PID 2844 wrote to memory of 1712 2844 rrffllr.exe hhthnt.exe PID 2844 wrote to memory of 1712 2844 rrffllr.exe hhthnt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c6c4c9e56c0e4c526e57e9229474e1a231b4037971cebb38440a0e286dd75379.exe"C:\Users\Admin\AppData\Local\Temp\c6c4c9e56c0e4c526e57e9229474e1a231b4037971cebb38440a0e286dd75379.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\fxllxfl.exec:\fxllxfl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\dvjdj.exec:\dvjdj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\jjjjd.exec:\jjjjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\ffllrrf.exec:\ffllrrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\9btthh.exec:\9btthh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\nnnttb.exec:\nnnttb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\ddpjp.exec:\ddpjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\ppjjv.exec:\ppjjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\rlflrxl.exec:\rlflrxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\nnbhbn.exec:\nnbhbn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
\??\c:\vvvpv.exec:\vvvpv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
\??\c:\pjdjp.exec:\pjdjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
\??\c:\xxrrxxf.exec:\xxrrxxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\9fxrxrf.exec:\9fxrxrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\rrffllr.exec:\rrffllr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\hhthnt.exec:\hhthnt.exe17⤵
- Executes dropped EXE
PID:1712 -
\??\c:\7nhnnt.exec:\7nhnnt.exe18⤵
- Executes dropped EXE
PID:2460 -
\??\c:\jjpvd.exec:\jjpvd.exe19⤵
- Executes dropped EXE
PID:1572 -
\??\c:\ffxfxfr.exec:\ffxfxfr.exe20⤵
- Executes dropped EXE
PID:1536 -
\??\c:\3bbthb.exec:\3bbthb.exe21⤵
- Executes dropped EXE
PID:1204 -
\??\c:\jpppd.exec:\jpppd.exe22⤵
- Executes dropped EXE
PID:1992 -
\??\c:\djdvv.exec:\djdvv.exe23⤵
- Executes dropped EXE
PID:2076 -
\??\c:\rlxlffl.exec:\rlxlffl.exe24⤵
- Executes dropped EXE
PID:2540 -
\??\c:\nhbhtb.exec:\nhbhtb.exe25⤵
- Executes dropped EXE
PID:2908 -
\??\c:\5jdvv.exec:\5jdvv.exe26⤵
- Executes dropped EXE
PID:2356 -
\??\c:\9rflrrx.exec:\9rflrrx.exe27⤵
- Executes dropped EXE
PID:964 -
\??\c:\nbhbhb.exec:\nbhbhb.exe28⤵
- Executes dropped EXE
PID:1368 -
\??\c:\7djpp.exec:\7djpp.exe29⤵
- Executes dropped EXE
PID:1228 -
\??\c:\vjvvv.exec:\vjvvv.exe30⤵
- Executes dropped EXE
PID:888 -
\??\c:\9rlflll.exec:\9rlflll.exe31⤵
- Executes dropped EXE
PID:1528 -
\??\c:\1btbbh.exec:\1btbbh.exe32⤵
- Executes dropped EXE
PID:2176 -
\??\c:\9nnbbb.exec:\9nnbbb.exe33⤵
- Executes dropped EXE
PID:1496 -
\??\c:\ppjvd.exec:\ppjvd.exe34⤵
- Executes dropped EXE
PID:1952 -
\??\c:\xrfxrrr.exec:\xrfxrrr.exe35⤵
- Executes dropped EXE
PID:3020 -
\??\c:\xlrlllr.exec:\xlrlllr.exe36⤵
- Executes dropped EXE
PID:1588 -
\??\c:\tnttbb.exec:\tnttbb.exe37⤵
- Executes dropped EXE
PID:3056 -
\??\c:\jvdjj.exec:\jvdjj.exe38⤵
- Executes dropped EXE
PID:2724 -
\??\c:\ddpjp.exec:\ddpjp.exe39⤵
- Executes dropped EXE
PID:2608 -
\??\c:\xrlrffr.exec:\xrlrffr.exe40⤵
- Executes dropped EXE
PID:2632 -
\??\c:\3lrxfll.exec:\3lrxfll.exe41⤵
- Executes dropped EXE
PID:2624 -
\??\c:\nhnbnn.exec:\nhnbnn.exe42⤵
- Executes dropped EXE
PID:2888 -
\??\c:\pvjpd.exec:\pvjpd.exe43⤵
- Executes dropped EXE
PID:2672 -
\??\c:\llffflr.exec:\llffflr.exe44⤵
- Executes dropped EXE
PID:2856 -
\??\c:\lfxxfll.exec:\lfxxfll.exe45⤵
- Executes dropped EXE
PID:2544 -
\??\c:\1tttbb.exec:\1tttbb.exe46⤵
- Executes dropped EXE
PID:2976 -
\??\c:\pddvv.exec:\pddvv.exe47⤵
- Executes dropped EXE
PID:2552 -
\??\c:\9frffxl.exec:\9frffxl.exe48⤵
- Executes dropped EXE
PID:556 -
\??\c:\rffflfr.exec:\rffflfr.exe49⤵
- Executes dropped EXE
PID:1824 -
\??\c:\nbnnnn.exec:\nbnnnn.exe50⤵
- Executes dropped EXE
PID:808 -
\??\c:\btbthn.exec:\btbthn.exe51⤵
- Executes dropped EXE
PID:1868 -
\??\c:\pdpvj.exec:\pdpvj.exe52⤵
- Executes dropped EXE
PID:2028 -
\??\c:\vdpjp.exec:\vdpjp.exe53⤵
- Executes dropped EXE
PID:2676 -
\??\c:\lxfflrl.exec:\lxfflrl.exe54⤵
- Executes dropped EXE
PID:2588 -
\??\c:\3hbhnn.exec:\3hbhnn.exe55⤵
- Executes dropped EXE
PID:1816 -
\??\c:\3thnnt.exec:\3thnnt.exe56⤵
- Executes dropped EXE
PID:1248 -
\??\c:\jvpjj.exec:\jvpjj.exe57⤵
- Executes dropped EXE
PID:1400 -
\??\c:\9rffrxf.exec:\9rffrxf.exe58⤵
- Executes dropped EXE
PID:764 -
\??\c:\rffffll.exec:\rffffll.exe59⤵
- Executes dropped EXE
PID:1836 -
\??\c:\9xllxfl.exec:\9xllxfl.exe60⤵
- Executes dropped EXE
PID:1096 -
\??\c:\nbhnnn.exec:\nbhnnn.exe61⤵
- Executes dropped EXE
PID:2404 -
\??\c:\vpvjd.exec:\vpvjd.exe62⤵
- Executes dropped EXE
PID:2472 -
\??\c:\lxlllrx.exec:\lxlllrx.exe63⤵
- Executes dropped EXE
PID:1972 -
\??\c:\nhhnhb.exec:\nhhnhb.exe64⤵
- Executes dropped EXE
PID:2468 -
\??\c:\nbnnhn.exec:\nbnnhn.exe65⤵
- Executes dropped EXE
PID:2076 -
\??\c:\pjdjj.exec:\pjdjj.exe66⤵PID:2540
-
\??\c:\llffxrl.exec:\llffxrl.exe67⤵PID:3036
-
\??\c:\rfllxff.exec:\rfllxff.exe68⤵PID:1828
-
\??\c:\hntbbb.exec:\hntbbb.exe69⤵PID:1792
-
\??\c:\vpjpd.exec:\vpjpd.exe70⤵PID:1556
-
\??\c:\3lrfflr.exec:\3lrfflr.exe71⤵PID:2268
-
\??\c:\7rrfxfl.exec:\7rrfxfl.exe72⤵PID:944
-
\??\c:\7bhnbb.exec:\7bhnbb.exe73⤵PID:928
-
\??\c:\hhbhnn.exec:\hhbhnn.exe74⤵PID:1968
-
\??\c:\pdpvv.exec:\pdpvv.exe75⤵PID:2132
-
\??\c:\rllrlfx.exec:\rllrlfx.exe76⤵PID:1000
-
\??\c:\7rrlfxx.exec:\7rrlfxx.exe77⤵PID:1516
-
\??\c:\bbnhhb.exec:\bbnhhb.exe78⤵PID:2420
-
\??\c:\9vpvp.exec:\9vpvp.exe79⤵PID:1956
-
\??\c:\1ddjd.exec:\1ddjd.exe80⤵PID:2272
-
\??\c:\ffflxrr.exec:\ffflxrr.exe81⤵PID:2284
-
\??\c:\hbttbt.exec:\hbttbt.exe82⤵PID:2592
-
\??\c:\httthb.exec:\httthb.exe83⤵PID:3056
-
\??\c:\9vvjd.exec:\9vvjd.exe84⤵PID:2640
-
\??\c:\pjdpj.exec:\pjdpj.exe85⤵
- System Location Discovery: System Language Discovery
PID:3068 -
\??\c:\xrlrrlr.exec:\xrlrrlr.exe86⤵PID:2708
-
\??\c:\fxlflll.exec:\fxlflll.exe87⤵PID:2144
-
\??\c:\nbhbhh.exec:\nbhbhh.exe88⤵PID:2696
-
\??\c:\nnhthb.exec:\nnhthb.exe89⤵PID:2520
-
\??\c:\vpddj.exec:\vpddj.exe90⤵PID:2856
-
\??\c:\1pvvv.exec:\1pvvv.exe91⤵PID:2564
-
\??\c:\llxxffl.exec:\llxxffl.exe92⤵PID:2976
-
\??\c:\xlrrffl.exec:\xlrrffl.exe93⤵PID:2980
-
\??\c:\nbnthb.exec:\nbnthb.exe94⤵PID:584
-
\??\c:\7nttbb.exec:\7nttbb.exe95⤵PID:292
-
\??\c:\hhbhtb.exec:\hhbhtb.exe96⤵PID:1500
-
\??\c:\jpdjd.exec:\jpdjd.exe97⤵PID:1868
-
\??\c:\djvvd.exec:\djvvd.exe98⤵PID:552
-
\??\c:\frflxfl.exec:\frflxfl.exe99⤵PID:280
-
\??\c:\rlxlxxl.exec:\rlxlxxl.exe100⤵PID:2588
-
\??\c:\3bhnnt.exec:\3bhnnt.exe101⤵PID:1816
-
\??\c:\1vdvv.exec:\1vdvv.exe102⤵PID:1876
-
\??\c:\pdjdj.exec:\pdjdj.exe103⤵PID:2476
-
\??\c:\frfllrx.exec:\frfllrx.exe104⤵
- System Location Discovery: System Language Discovery
PID:1728 -
\??\c:\lfrxrlr.exec:\lfrxrlr.exe105⤵PID:1080
-
\??\c:\tnbhnt.exec:\tnbhnt.exe106⤵PID:2248
-
\??\c:\vpjpv.exec:\vpjpv.exe107⤵PID:1872
-
\??\c:\jvpdd.exec:\jvpdd.exe108⤵PID:2872
-
\??\c:\lxllrlr.exec:\lxllrlr.exe109⤵PID:2360
-
\??\c:\bhthbb.exec:\bhthbb.exe110⤵PID:2100
-
\??\c:\5ntntb.exec:\5ntntb.exe111⤵PID:2916
-
\??\c:\ddvpp.exec:\ddvpp.exe112⤵PID:2064
-
\??\c:\pdpdj.exec:\pdpdj.exe113⤵PID:684
-
\??\c:\ffffllx.exec:\ffffllx.exe114⤵PID:1332
-
\??\c:\5xfxxxf.exec:\5xfxxxf.exe115⤵PID:1164
-
\??\c:\3tbhtb.exec:\3tbhtb.exe116⤵PID:812
-
\??\c:\tnbbnn.exec:\tnbbnn.exe117⤵PID:1832
-
\??\c:\pvjpv.exec:\pvjpv.exe118⤵PID:2200
-
\??\c:\vpdvd.exec:\vpdvd.exe119⤵PID:1784
-
\??\c:\lfrrxfx.exec:\lfrrxfx.exe120⤵PID:996
-
\??\c:\5xrxxxx.exec:\5xrxxxx.exe121⤵PID:2176
-
\??\c:\ttbtnb.exec:\ttbtnb.exe122⤵PID:1496
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-