Analysis
-
max time kernel
120s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 10:19
Behavioral task
behavioral1
Sample
fe792787839413ec9052e7b6a9a0d267d501191e1df639530971074b20f1b0bb.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
fe792787839413ec9052e7b6a9a0d267d501191e1df639530971074b20f1b0bb.exe
-
Size
91KB
-
MD5
d86d960a54efe7c9f9801b7fc58e35ab
-
SHA1
76fa8703bda1dbad4cd62ed2ff9c030882e2aa0e
-
SHA256
fe792787839413ec9052e7b6a9a0d267d501191e1df639530971074b20f1b0bb
-
SHA512
1b5398f0fb86e61a281ed82544ccdafcd171d6948f76109f9371a0ac99e5ab79ed4f80aa82bc703b03cb2281c54350c807bd8de3ed68f99f8303056cc236a8e1
-
SSDEEP
1536:9vQBeOGtrYS3srx93UBWfwC6Ggnouy8yaVskCzYBbKd+XsWgADUOj2YUW+S436Cn:9hOmTsF93UYfwC6GIoutyaVszyKd+XYt
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 56 IoCs
resource yara_rule behavioral1/memory/2788-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2328-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2760-32-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2820-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2760-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2988-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1576-57-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1576-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1656-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2724-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2272-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2112-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2452-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2880-114-0x00000000003B0000-0x00000000003D7000-memory.dmp family_blackmoon behavioral1/memory/2880-113-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2372-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1060-150-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2928-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1608-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/288-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2244-198-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2244-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2016-211-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1308-222-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3040-265-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1284-286-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2688-283-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2744-304-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2832-315-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2364-331-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2776-344-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2060-355-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2632-358-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1572-375-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2032-401-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2004-414-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1908-421-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/1908-422-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2780-430-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1108-436-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2584-470-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2584-490-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2496-515-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/268-568-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/268-570-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3056-577-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2788-585-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2956-587-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2808-599-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2608-614-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2988-628-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2276-657-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2276-656-0x00000000003D0000-0x00000000003F7000-memory.dmp family_blackmoon behavioral1/memory/1720-671-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2912-699-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1896-731-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2328 xflflrl.exe 2820 hnhhnb.exe 2760 jdppp.exe 2988 flffrxr.exe 1576 rrllllx.exe 1656 xrlxllx.exe 2724 tnhtbh.exe 2272 1pjjj.exe 2112 rrllflx.exe 2452 9bbnbn.exe 2880 3dvjp.exe 2508 xlxxfxf.exe 2780 nhbtbh.exe 2372 jdpvj.exe 1060 5fflrrf.exe 2928 btnbnb.exe 1608 ppppd.exe 288 1lfllrx.exe 1148 3hhntb.exe 2456 dvdvv.exe 2244 5dvvj.exe 2016 xxlrlrf.exe 1308 hbnhnh.exe 408 ddpdp.exe 2960 llxfllx.exe 1732 llfxxlx.exe 2688 btnnbb.exe 3040 dvppj.exe 2956 llflxlf.exe 1284 bthhhh.exe 1628 3jdjd.exe 2080 rrxllff.exe 2744 1dpvv.exe 2832 lfrlrxr.exe 1852 lxlrxxf.exe 2992 nbhhhb.exe 2364 9vjpv.exe 2636 vpjjp.exe 2776 1rllrxx.exe 2060 nbhtnt.exe 2632 hbhhhb.exe 2296 jvvvp.exe 1572 rlfrxlr.exe 1720 9bthbh.exe 2488 7tttbh.exe 2056 dvvvp.exe 2032 lfrxfrx.exe 2932 rlxlrxf.exe 2004 ttnhth.exe 1908 pppvj.exe 2780 dvjjp.exe 1108 xxrfrfr.exe 2964 3ttbnn.exe 568 ttntnb.exe 2012 dpvvj.exe 1508 lfrxffr.exe 2584 3rllxxf.exe 2324 bntntt.exe 2436 vpdpj.exe 2176 pjppv.exe 1480 rlxlrxl.exe 2228 nhbhtb.exe 904 dvpjd.exe 2496 rrflrlx.exe -
resource yara_rule behavioral1/memory/2788-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000001211a-5.dat upx behavioral1/memory/2788-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2328-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000161f6-18.dat upx behavioral1/files/0x0008000000016307-29.dat upx behavioral1/memory/2820-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2760-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000800000001658c-38.dat upx behavioral1/files/0x0007000000016855-46.dat upx behavioral1/memory/2988-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016aa9-58.dat upx behavioral1/memory/1576-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016c62-65.dat upx behavioral1/memory/1656-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016c84-77.dat upx behavioral1/memory/2724-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000173da-86.dat upx behavioral1/memory/2272-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000173f1-96.dat upx behavioral1/memory/2112-94-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000173f4-104.dat upx behavioral1/memory/2452-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000173fc-115.dat upx behavioral1/memory/2880-113-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017472-123.dat upx behavioral1/files/0x0006000000017487-132.dat upx behavioral1/files/0x00060000000174a2-140.dat upx behavioral1/memory/2372-141-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1060-150-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017525-149.dat upx behavioral1/memory/2928-159-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0014000000018663-158.dat upx behavioral1/files/0x000d00000001866e-169.dat upx behavioral1/memory/1608-167-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/288-178-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018687-177.dat upx behavioral1/files/0x0005000000018792-186.dat upx behavioral1/files/0x0006000000018c1a-194.dat upx behavioral1/files/0x0006000000018c26-204.dat upx behavioral1/memory/2244-203-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0036000000015f81-212.dat upx behavioral1/memory/2016-211-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0006000000018f53-221.dat upx behavioral1/files/0x000600000001903b-229.dat upx behavioral1/files/0x00060000000190ce-240.dat upx behavioral1/files/0x00060000000190e0-247.dat upx behavioral1/files/0x00050000000191d4-256.dat upx behavioral1/memory/3040-264-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/3040-265-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000191ff-266.dat upx behavioral1/files/0x000500000001922c-275.dat upx behavioral1/files/0x0005000000019244-287.dat upx behavioral1/memory/1284-286-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019256-294.dat upx behavioral1/memory/2744-304-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2832-315-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1852-318-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2364-331-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2776-344-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2060-355-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2632-358-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/1572-375-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2032-401-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btttht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btntbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrxrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rlxxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrflxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hbttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2788 wrote to memory of 2328 2788 fe792787839413ec9052e7b6a9a0d267d501191e1df639530971074b20f1b0bb.exe 30 PID 2788 wrote to memory of 2328 2788 fe792787839413ec9052e7b6a9a0d267d501191e1df639530971074b20f1b0bb.exe 30 PID 2788 wrote to memory of 2328 2788 fe792787839413ec9052e7b6a9a0d267d501191e1df639530971074b20f1b0bb.exe 30 PID 2788 wrote to memory of 2328 2788 fe792787839413ec9052e7b6a9a0d267d501191e1df639530971074b20f1b0bb.exe 30 PID 2328 wrote to memory of 2820 2328 xflflrl.exe 31 PID 2328 wrote to memory of 2820 2328 xflflrl.exe 31 PID 2328 wrote to memory of 2820 2328 xflflrl.exe 31 PID 2328 wrote to memory of 2820 2328 xflflrl.exe 31 PID 2820 wrote to memory of 2760 2820 hnhhnb.exe 32 PID 2820 wrote to memory of 2760 2820 hnhhnb.exe 32 PID 2820 wrote to memory of 2760 2820 hnhhnb.exe 32 PID 2820 wrote to memory of 2760 2820 hnhhnb.exe 32 PID 2760 wrote to memory of 2988 2760 jdppp.exe 33 PID 2760 wrote to memory of 2988 2760 jdppp.exe 33 PID 2760 wrote to memory of 2988 2760 jdppp.exe 33 PID 2760 wrote to memory of 2988 2760 jdppp.exe 33 PID 2988 wrote to memory of 1576 2988 flffrxr.exe 34 PID 2988 wrote to memory of 1576 2988 flffrxr.exe 34 PID 2988 wrote to memory of 1576 2988 flffrxr.exe 34 PID 2988 wrote to memory of 1576 2988 flffrxr.exe 34 PID 1576 wrote to memory of 1656 1576 rrllllx.exe 35 PID 1576 wrote to memory of 1656 1576 rrllllx.exe 35 PID 1576 wrote to memory of 1656 1576 rrllllx.exe 35 PID 1576 wrote to memory of 1656 1576 rrllllx.exe 35 PID 1656 wrote to memory of 2724 1656 xrlxllx.exe 36 PID 1656 wrote to memory of 2724 1656 xrlxllx.exe 36 PID 1656 wrote to memory of 2724 1656 xrlxllx.exe 36 PID 1656 wrote to memory of 2724 1656 xrlxllx.exe 36 PID 2724 wrote to memory of 2272 2724 tnhtbh.exe 37 PID 2724 wrote to memory of 2272 2724 tnhtbh.exe 37 PID 2724 wrote to memory of 2272 2724 tnhtbh.exe 37 PID 2724 wrote to memory of 2272 2724 tnhtbh.exe 37 PID 2272 wrote to memory of 2112 2272 1pjjj.exe 38 PID 2272 wrote to memory of 2112 2272 1pjjj.exe 38 PID 2272 wrote to memory of 2112 2272 1pjjj.exe 38 PID 2272 wrote to memory of 2112 2272 1pjjj.exe 38 PID 2112 wrote to memory of 2452 2112 rrllflx.exe 39 PID 2112 wrote to memory of 2452 2112 rrllflx.exe 39 PID 2112 wrote to memory of 2452 2112 rrllflx.exe 39 PID 2112 wrote to memory of 2452 2112 rrllflx.exe 39 PID 2452 wrote to memory of 2880 2452 9bbnbn.exe 40 PID 2452 wrote to memory of 2880 2452 9bbnbn.exe 40 PID 2452 wrote to memory of 2880 2452 9bbnbn.exe 40 PID 2452 wrote to memory of 2880 2452 9bbnbn.exe 40 PID 2880 wrote to memory of 2508 2880 3dvjp.exe 41 PID 2880 wrote to memory of 2508 2880 3dvjp.exe 41 PID 2880 wrote to memory of 2508 2880 3dvjp.exe 41 PID 2880 wrote to memory of 2508 2880 3dvjp.exe 41 PID 2508 wrote to memory of 2780 2508 xlxxfxf.exe 42 PID 2508 wrote to memory of 2780 2508 xlxxfxf.exe 42 PID 2508 wrote to memory of 2780 2508 xlxxfxf.exe 42 PID 2508 wrote to memory of 2780 2508 xlxxfxf.exe 42 PID 2780 wrote to memory of 2372 2780 nhbtbh.exe 43 PID 2780 wrote to memory of 2372 2780 nhbtbh.exe 43 PID 2780 wrote to memory of 2372 2780 nhbtbh.exe 43 PID 2780 wrote to memory of 2372 2780 nhbtbh.exe 43 PID 2372 wrote to memory of 1060 2372 jdpvj.exe 44 PID 2372 wrote to memory of 1060 2372 jdpvj.exe 44 PID 2372 wrote to memory of 1060 2372 jdpvj.exe 44 PID 2372 wrote to memory of 1060 2372 jdpvj.exe 44 PID 1060 wrote to memory of 2928 1060 5fflrrf.exe 45 PID 1060 wrote to memory of 2928 1060 5fflrrf.exe 45 PID 1060 wrote to memory of 2928 1060 5fflrrf.exe 45 PID 1060 wrote to memory of 2928 1060 5fflrrf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe792787839413ec9052e7b6a9a0d267d501191e1df639530971074b20f1b0bb.exe"C:\Users\Admin\AppData\Local\Temp\fe792787839413ec9052e7b6a9a0d267d501191e1df639530971074b20f1b0bb.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\xflflrl.exec:\xflflrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\hnhhnb.exec:\hnhhnb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\jdppp.exec:\jdppp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\flffrxr.exec:\flffrxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\rrllllx.exec:\rrllllx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\xrlxllx.exec:\xrlxllx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\tnhtbh.exec:\tnhtbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\1pjjj.exec:\1pjjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\rrllflx.exec:\rrllflx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\9bbnbn.exec:\9bbnbn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\3dvjp.exec:\3dvjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\xlxxfxf.exec:\xlxxfxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\nhbtbh.exec:\nhbtbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\jdpvj.exec:\jdpvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\5fflrrf.exec:\5fflrrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
\??\c:\btnbnb.exec:\btnbnb.exe17⤵
- Executes dropped EXE
PID:2928 -
\??\c:\ppppd.exec:\ppppd.exe18⤵
- Executes dropped EXE
PID:1608 -
\??\c:\1lfllrx.exec:\1lfllrx.exe19⤵
- Executes dropped EXE
PID:288 -
\??\c:\3hhntb.exec:\3hhntb.exe20⤵
- Executes dropped EXE
PID:1148 -
\??\c:\dvdvv.exec:\dvdvv.exe21⤵
- Executes dropped EXE
PID:2456 -
\??\c:\5dvvj.exec:\5dvvj.exe22⤵
- Executes dropped EXE
PID:2244 -
\??\c:\xxlrlrf.exec:\xxlrlrf.exe23⤵
- Executes dropped EXE
PID:2016 -
\??\c:\hbnhnh.exec:\hbnhnh.exe24⤵
- Executes dropped EXE
PID:1308 -
\??\c:\ddpdp.exec:\ddpdp.exe25⤵
- Executes dropped EXE
PID:408 -
\??\c:\llxfllx.exec:\llxfllx.exe26⤵
- Executes dropped EXE
PID:2960 -
\??\c:\llfxxlx.exec:\llfxxlx.exe27⤵
- Executes dropped EXE
PID:1732 -
\??\c:\btnnbb.exec:\btnnbb.exe28⤵
- Executes dropped EXE
PID:2688 -
\??\c:\dvppj.exec:\dvppj.exe29⤵
- Executes dropped EXE
PID:3040 -
\??\c:\llflxlf.exec:\llflxlf.exe30⤵
- Executes dropped EXE
PID:2956 -
\??\c:\bthhhh.exec:\bthhhh.exe31⤵
- Executes dropped EXE
PID:1284 -
\??\c:\3jdjd.exec:\3jdjd.exe32⤵
- Executes dropped EXE
PID:1628 -
\??\c:\rrxllff.exec:\rrxllff.exe33⤵
- Executes dropped EXE
PID:2080 -
\??\c:\1dpvv.exec:\1dpvv.exe34⤵
- Executes dropped EXE
PID:2744 -
\??\c:\lfrlrxr.exec:\lfrlrxr.exe35⤵
- Executes dropped EXE
PID:2832 -
\??\c:\lxlrxxf.exec:\lxlrxxf.exe36⤵
- Executes dropped EXE
PID:1852 -
\??\c:\nbhhhb.exec:\nbhhhb.exe37⤵
- Executes dropped EXE
PID:2992 -
\??\c:\9vjpv.exec:\9vjpv.exe38⤵
- Executes dropped EXE
PID:2364 -
\??\c:\vpjjp.exec:\vpjjp.exe39⤵
- Executes dropped EXE
PID:2636 -
\??\c:\1rllrxx.exec:\1rllrxx.exe40⤵
- Executes dropped EXE
PID:2776 -
\??\c:\nbhtnt.exec:\nbhtnt.exe41⤵
- Executes dropped EXE
PID:2060 -
\??\c:\hbhhhb.exec:\hbhhhb.exe42⤵
- Executes dropped EXE
PID:2632 -
\??\c:\jvvvp.exec:\jvvvp.exe43⤵
- Executes dropped EXE
PID:2296 -
\??\c:\rlfrxlr.exec:\rlfrxlr.exe44⤵
- Executes dropped EXE
PID:1572 -
\??\c:\9bthbh.exec:\9bthbh.exe45⤵
- Executes dropped EXE
PID:1720 -
\??\c:\7tttbh.exec:\7tttbh.exe46⤵
- Executes dropped EXE
PID:2488 -
\??\c:\dvvvp.exec:\dvvvp.exe47⤵
- Executes dropped EXE
PID:2056 -
\??\c:\lfrxfrx.exec:\lfrxfrx.exe48⤵
- Executes dropped EXE
PID:2032 -
\??\c:\rlxlrxf.exec:\rlxlrxf.exe49⤵
- Executes dropped EXE
PID:2932 -
\??\c:\ttnhth.exec:\ttnhth.exe50⤵
- Executes dropped EXE
PID:2004 -
\??\c:\pppvj.exec:\pppvj.exe51⤵
- Executes dropped EXE
PID:1908 -
\??\c:\dvjjp.exec:\dvjjp.exe52⤵
- Executes dropped EXE
PID:2780 -
\??\c:\xxrfrfr.exec:\xxrfrfr.exe53⤵
- Executes dropped EXE
PID:1108 -
\??\c:\3ttbnn.exec:\3ttbnn.exe54⤵
- Executes dropped EXE
PID:2964 -
\??\c:\ttntnb.exec:\ttntnb.exe55⤵
- Executes dropped EXE
PID:568 -
\??\c:\dpvvj.exec:\dpvvj.exe56⤵
- Executes dropped EXE
PID:2012 -
\??\c:\lfrxffr.exec:\lfrxffr.exe57⤵
- Executes dropped EXE
PID:1508 -
\??\c:\3rllxxf.exec:\3rllxxf.exe58⤵
- Executes dropped EXE
PID:2584 -
\??\c:\bntntt.exec:\bntntt.exe59⤵
- Executes dropped EXE
PID:2324 -
\??\c:\vpdpj.exec:\vpdpj.exe60⤵
- Executes dropped EXE
PID:2436 -
\??\c:\pjppv.exec:\pjppv.exe61⤵
- Executes dropped EXE
PID:2176 -
\??\c:\rlxlrxl.exec:\rlxlrxl.exe62⤵
- Executes dropped EXE
PID:1480 -
\??\c:\nhbhtb.exec:\nhbhtb.exe63⤵
- Executes dropped EXE
PID:2228 -
\??\c:\dvpjd.exec:\dvpjd.exe64⤵
- Executes dropped EXE
PID:904 -
\??\c:\rrflrlx.exec:\rrflrlx.exe65⤵
- Executes dropped EXE
PID:2496 -
\??\c:\frfrfxx.exec:\frfrfxx.exe66⤵PID:1612
-
\??\c:\httnnn.exec:\httnnn.exe67⤵PID:628
-
\??\c:\ddjdd.exec:\ddjdd.exe68⤵PID:560
-
\??\c:\5jvdp.exec:\5jvdp.exe69⤵PID:976
-
\??\c:\9xxxrrx.exec:\9xxxrrx.exe70⤵PID:2068
-
\??\c:\bbnntn.exec:\bbnntn.exe71⤵PID:2072
-
\??\c:\jpvvd.exec:\jpvvd.exe72⤵PID:2956
-
\??\c:\lflxlxr.exec:\lflxlxr.exe73⤵PID:268
-
\??\c:\bbnhbh.exec:\bbnhbh.exe74⤵PID:3056
-
\??\c:\dvpdp.exec:\dvpdp.exe75⤵PID:2788
-
\??\c:\pjvpj.exec:\pjvpj.exe76⤵PID:2712
-
\??\c:\rrrfrxf.exec:\rrrfrxf.exe77⤵PID:2808
-
\??\c:\hbnhhn.exec:\hbnhhn.exe78⤵PID:2836
-
\??\c:\tnbhhh.exec:\tnbhhh.exe79⤵PID:2608
-
\??\c:\vpjpj.exec:\vpjpj.exe80⤵PID:2856
-
\??\c:\3dpdj.exec:\3dpdj.exe81⤵PID:2988
-
\??\c:\5fxlrfr.exec:\5fxlrfr.exe82⤵PID:2656
-
\??\c:\5nhtnb.exec:\5nhtnb.exe83⤵PID:2680
-
\??\c:\7nbttb.exec:\7nbttb.exe84⤵PID:2676
-
\??\c:\vvdpd.exec:\vvdpd.exe85⤵PID:2276
-
\??\c:\7lflrxf.exec:\7lflrxf.exe86⤵PID:1572
-
\??\c:\3bbnbn.exec:\3bbnbn.exe87⤵PID:1720
-
\??\c:\9nhnhn.exec:\9nhnhn.exe88⤵PID:1788
-
\??\c:\3jjvv.exec:\3jjvv.exe89⤵PID:2852
-
\??\c:\jdpvj.exec:\jdpvj.exe90⤵PID:2352
-
\??\c:\7ffrflx.exec:\7ffrflx.exe91⤵PID:2912
-
\??\c:\tbtttb.exec:\tbtttb.exe92⤵PID:1924
-
\??\c:\nnnttb.exec:\nnnttb.exe93⤵PID:1352
-
\??\c:\7vjdv.exec:\7vjdv.exe94⤵PID:2908
-
\??\c:\fllffxr.exec:\fllffxr.exe95⤵PID:1060
-
\??\c:\1frxllx.exec:\1frxllx.exe96⤵PID:1896
-
\??\c:\3pddd.exec:\3pddd.exe97⤵PID:1152
-
\??\c:\dpddd.exec:\dpddd.exe98⤵PID:2012
-
\??\c:\lxflrxf.exec:\lxflrxf.exe99⤵PID:352
-
\??\c:\lffxflf.exec:\lffxflf.exe100⤵PID:2584
-
\??\c:\bththt.exec:\bththt.exe101⤵PID:2460
-
\??\c:\htbnhn.exec:\htbnhn.exe102⤵PID:2792
-
\??\c:\vjjdp.exec:\vjjdp.exe103⤵PID:1272
-
\??\c:\5dpjv.exec:\5dpjv.exe104⤵PID:2016
-
\??\c:\lxflxxl.exec:\lxflxxl.exe105⤵PID:1964
-
\??\c:\5nbbhb.exec:\5nbbhb.exe106⤵PID:2008
-
\??\c:\9nhthh.exec:\9nhthh.exe107⤵PID:2024
-
\??\c:\dvddv.exec:\dvddv.exe108⤵PID:880
-
\??\c:\vjpjp.exec:\vjpjp.exe109⤵PID:628
-
\??\c:\1xxrflr.exec:\1xxrflr.exe110⤵PID:2688
-
\??\c:\xrfrffl.exec:\xrfrffl.exe111⤵PID:976
-
\??\c:\nnhnhh.exec:\nnhnhh.exe112⤵PID:1244
-
\??\c:\bbtbhn.exec:\bbtbhn.exe113⤵PID:1940
-
\??\c:\5vppv.exec:\5vppv.exe114⤵PID:2956
-
\??\c:\dpvdv.exec:\dpvdv.exe115⤵PID:2240
-
\??\c:\xxxrflx.exec:\xxxrflx.exe116⤵PID:2280
-
\??\c:\nhbnbn.exec:\nhbnbn.exe117⤵PID:2208
-
\??\c:\tnbbhb.exec:\tnbbhb.exe118⤵PID:2816
-
\??\c:\pjjpd.exec:\pjjpd.exe119⤵PID:1692
-
\??\c:\ddvjj.exec:\ddvjj.exe120⤵PID:2840
-
\??\c:\5lrrxxl.exec:\5lrrxxl.exe121⤵PID:2736
-
\??\c:\lfxxllx.exec:\lfxxllx.exe122⤵PID:2944
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-