Analysis
-
max time kernel
120s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 10:19
Behavioral task
behavioral1
Sample
fe792787839413ec9052e7b6a9a0d267d501191e1df639530971074b20f1b0bb.exe
Resource
win7-20240903-en
General
-
Target
fe792787839413ec9052e7b6a9a0d267d501191e1df639530971074b20f1b0bb.exe
-
Size
91KB
-
MD5
d86d960a54efe7c9f9801b7fc58e35ab
-
SHA1
76fa8703bda1dbad4cd62ed2ff9c030882e2aa0e
-
SHA256
fe792787839413ec9052e7b6a9a0d267d501191e1df639530971074b20f1b0bb
-
SHA512
1b5398f0fb86e61a281ed82544ccdafcd171d6948f76109f9371a0ac99e5ab79ed4f80aa82bc703b03cb2281c54350c807bd8de3ed68f99f8303056cc236a8e1
-
SSDEEP
1536:9vQBeOGtrYS3srx93UBWfwC6Ggnouy8yaVskCzYBbKd+XsWgADUOj2YUW+S436Cn:9hOmTsF93UYfwC6GIoutyaVszyKd+XYt
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 56 IoCs
Processes:
resource yara_rule behavioral1/memory/2788-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2328-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2760-32-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2820-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2760-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2988-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1576-57-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1576-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1656-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2724-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2272-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2112-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2452-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2880-114-0x00000000003B0000-0x00000000003D7000-memory.dmp family_blackmoon behavioral1/memory/2880-113-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2372-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1060-150-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2928-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1608-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/288-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2244-198-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2244-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2016-211-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1308-222-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3040-265-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1284-286-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2688-283-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2744-304-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2832-315-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2364-331-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2776-344-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2060-355-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2632-358-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1572-375-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2032-401-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2004-414-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1908-421-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/1908-422-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2780-430-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1108-436-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2584-470-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2584-490-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2496-515-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/268-568-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/268-570-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3056-577-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2788-585-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2956-587-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2808-599-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2608-614-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2988-628-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2276-657-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2276-656-0x00000000003D0000-0x00000000003F7000-memory.dmp family_blackmoon behavioral1/memory/1720-671-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2912-699-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1896-731-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
xflflrl.exehnhhnb.exejdppp.exeflffrxr.exerrllllx.exexrlxllx.exetnhtbh.exe1pjjj.exerrllflx.exe9bbnbn.exe3dvjp.exexlxxfxf.exenhbtbh.exejdpvj.exe5fflrrf.exebtnbnb.exeppppd.exe1lfllrx.exe3hhntb.exedvdvv.exe5dvvj.exexxlrlrf.exehbnhnh.exeddpdp.exellxfllx.exellfxxlx.exebtnnbb.exedvppj.exellflxlf.exebthhhh.exe3jdjd.exerrxllff.exe1dpvv.exelfrlrxr.exelxlrxxf.exenbhhhb.exe9vjpv.exevpjjp.exe1rllrxx.exenbhtnt.exehbhhhb.exejvvvp.exerlfrxlr.exe9bthbh.exe7tttbh.exedvvvp.exelfrxfrx.exerlxlrxf.exettnhth.exepppvj.exedvjjp.exexxrfrfr.exe3ttbnn.exettntnb.exedpvvj.exelfrxffr.exe3rllxxf.exebntntt.exevpdpj.exepjppv.exerlxlrxl.exenhbhtb.exedvpjd.exerrflrlx.exepid process 2328 xflflrl.exe 2820 hnhhnb.exe 2760 jdppp.exe 2988 flffrxr.exe 1576 rrllllx.exe 1656 xrlxllx.exe 2724 tnhtbh.exe 2272 1pjjj.exe 2112 rrllflx.exe 2452 9bbnbn.exe 2880 3dvjp.exe 2508 xlxxfxf.exe 2780 nhbtbh.exe 2372 jdpvj.exe 1060 5fflrrf.exe 2928 btnbnb.exe 1608 ppppd.exe 288 1lfllrx.exe 1148 3hhntb.exe 2456 dvdvv.exe 2244 5dvvj.exe 2016 xxlrlrf.exe 1308 hbnhnh.exe 408 ddpdp.exe 2960 llxfllx.exe 1732 llfxxlx.exe 2688 btnnbb.exe 3040 dvppj.exe 2956 llflxlf.exe 1284 bthhhh.exe 1628 3jdjd.exe 2080 rrxllff.exe 2744 1dpvv.exe 2832 lfrlrxr.exe 1852 lxlrxxf.exe 2992 nbhhhb.exe 2364 9vjpv.exe 2636 vpjjp.exe 2776 1rllrxx.exe 2060 nbhtnt.exe 2632 hbhhhb.exe 2296 jvvvp.exe 1572 rlfrxlr.exe 1720 9bthbh.exe 2488 7tttbh.exe 2056 dvvvp.exe 2032 lfrxfrx.exe 2932 rlxlrxf.exe 2004 ttnhth.exe 1908 pppvj.exe 2780 dvjjp.exe 1108 xxrfrfr.exe 2964 3ttbnn.exe 568 ttntnb.exe 2012 dpvvj.exe 1508 lfrxffr.exe 2584 3rllxxf.exe 2324 bntntt.exe 2436 vpdpj.exe 2176 pjppv.exe 1480 rlxlrxl.exe 2228 nhbhtb.exe 904 dvpjd.exe 2496 rrflrlx.exe -
Processes:
resource yara_rule behavioral1/memory/2788-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xflflrl.exe upx behavioral1/memory/2788-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2328-11-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hnhhnb.exe upx \??\c:\jdppp.exe upx behavioral1/memory/2820-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2760-39-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\flffrxr.exe upx C:\rrllllx.exe upx behavioral1/memory/2988-48-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrlxllx.exe upx behavioral1/memory/1576-56-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tnhtbh.exe upx behavioral1/memory/1656-67-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1pjjj.exe upx behavioral1/memory/2724-75-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rrllflx.exe upx behavioral1/memory/2272-85-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9bbnbn.exe upx behavioral1/memory/2112-94-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3dvjp.exe upx behavioral1/memory/2452-105-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xlxxfxf.exe upx behavioral1/memory/2880-113-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhbtbh.exe upx C:\jdpvj.exe upx C:\5fflrrf.exe upx behavioral1/memory/2372-141-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1060-150-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\btnbnb.exe upx behavioral1/memory/2928-159-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ppppd.exe upx C:\1lfllrx.exe upx behavioral1/memory/1608-167-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/288-178-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3hhntb.exe upx C:\dvdvv.exe upx C:\5dvvj.exe upx C:\xxlrlrf.exe upx behavioral1/memory/2244-203-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hbnhnh.exe upx behavioral1/memory/2016-211-0x0000000000220000-0x0000000000247000-memory.dmp upx C:\ddpdp.exe upx C:\llxfllx.exe upx \??\c:\llfxxlx.exe upx C:\btnnbb.exe upx C:\dvppj.exe upx behavioral1/memory/3040-264-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/3040-265-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\llflxlf.exe upx C:\bthhhh.exe upx \??\c:\3jdjd.exe upx behavioral1/memory/1284-286-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rrxllff.exe upx behavioral1/memory/2744-304-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2832-315-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1852-318-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2364-331-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2776-344-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2060-355-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2632-358-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/1572-375-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2032-401-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
btttht.exepjpvj.exe5pdvd.exejjpvj.exebtntbh.exejdvpd.exerrrxrfx.exejpjjj.exe3rlxxrf.exevvpvj.exerrrflxl.exe5hbttb.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btttht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btntbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrxrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rlxxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrflxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hbttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
fe792787839413ec9052e7b6a9a0d267d501191e1df639530971074b20f1b0bb.exexflflrl.exehnhhnb.exejdppp.exeflffrxr.exerrllllx.exexrlxllx.exetnhtbh.exe1pjjj.exerrllflx.exe9bbnbn.exe3dvjp.exexlxxfxf.exenhbtbh.exejdpvj.exe5fflrrf.exedescription pid process target process PID 2788 wrote to memory of 2328 2788 fe792787839413ec9052e7b6a9a0d267d501191e1df639530971074b20f1b0bb.exe xflflrl.exe PID 2788 wrote to memory of 2328 2788 fe792787839413ec9052e7b6a9a0d267d501191e1df639530971074b20f1b0bb.exe xflflrl.exe PID 2788 wrote to memory of 2328 2788 fe792787839413ec9052e7b6a9a0d267d501191e1df639530971074b20f1b0bb.exe xflflrl.exe PID 2788 wrote to memory of 2328 2788 fe792787839413ec9052e7b6a9a0d267d501191e1df639530971074b20f1b0bb.exe xflflrl.exe PID 2328 wrote to memory of 2820 2328 xflflrl.exe hnhhnb.exe PID 2328 wrote to memory of 2820 2328 xflflrl.exe hnhhnb.exe PID 2328 wrote to memory of 2820 2328 xflflrl.exe hnhhnb.exe PID 2328 wrote to memory of 2820 2328 xflflrl.exe hnhhnb.exe PID 2820 wrote to memory of 2760 2820 hnhhnb.exe jdppp.exe PID 2820 wrote to memory of 2760 2820 hnhhnb.exe jdppp.exe PID 2820 wrote to memory of 2760 2820 hnhhnb.exe jdppp.exe PID 2820 wrote to memory of 2760 2820 hnhhnb.exe jdppp.exe PID 2760 wrote to memory of 2988 2760 jdppp.exe flffrxr.exe PID 2760 wrote to memory of 2988 2760 jdppp.exe flffrxr.exe PID 2760 wrote to memory of 2988 2760 jdppp.exe flffrxr.exe PID 2760 wrote to memory of 2988 2760 jdppp.exe flffrxr.exe PID 2988 wrote to memory of 1576 2988 flffrxr.exe rrllllx.exe PID 2988 wrote to memory of 1576 2988 flffrxr.exe rrllllx.exe PID 2988 wrote to memory of 1576 2988 flffrxr.exe rrllllx.exe PID 2988 wrote to memory of 1576 2988 flffrxr.exe rrllllx.exe PID 1576 wrote to memory of 1656 1576 rrllllx.exe xrlxllx.exe PID 1576 wrote to memory of 1656 1576 rrllllx.exe xrlxllx.exe PID 1576 wrote to memory of 1656 1576 rrllllx.exe xrlxllx.exe PID 1576 wrote to memory of 1656 1576 rrllllx.exe xrlxllx.exe PID 1656 wrote to memory of 2724 1656 xrlxllx.exe tnhtbh.exe PID 1656 wrote to memory of 2724 1656 xrlxllx.exe tnhtbh.exe PID 1656 wrote to memory of 2724 1656 xrlxllx.exe tnhtbh.exe PID 1656 wrote to memory of 2724 1656 xrlxllx.exe tnhtbh.exe PID 2724 wrote to memory of 2272 2724 tnhtbh.exe 1pjjj.exe PID 2724 wrote to memory of 2272 2724 tnhtbh.exe 1pjjj.exe PID 2724 wrote to memory of 2272 2724 tnhtbh.exe 1pjjj.exe PID 2724 wrote to memory of 2272 2724 tnhtbh.exe 1pjjj.exe PID 2272 wrote to memory of 2112 2272 1pjjj.exe rrllflx.exe PID 2272 wrote to memory of 2112 2272 1pjjj.exe rrllflx.exe PID 2272 wrote to memory of 2112 2272 1pjjj.exe rrllflx.exe PID 2272 wrote to memory of 2112 2272 1pjjj.exe rrllflx.exe PID 2112 wrote to memory of 2452 2112 rrllflx.exe 9bbnbn.exe PID 2112 wrote to memory of 2452 2112 rrllflx.exe 9bbnbn.exe PID 2112 wrote to memory of 2452 2112 rrllflx.exe 9bbnbn.exe PID 2112 wrote to memory of 2452 2112 rrllflx.exe 9bbnbn.exe PID 2452 wrote to memory of 2880 2452 9bbnbn.exe 3dvjp.exe PID 2452 wrote to memory of 2880 2452 9bbnbn.exe 3dvjp.exe PID 2452 wrote to memory of 2880 2452 9bbnbn.exe 3dvjp.exe PID 2452 wrote to memory of 2880 2452 9bbnbn.exe 3dvjp.exe PID 2880 wrote to memory of 2508 2880 3dvjp.exe xlxxfxf.exe PID 2880 wrote to memory of 2508 2880 3dvjp.exe xlxxfxf.exe PID 2880 wrote to memory of 2508 2880 3dvjp.exe xlxxfxf.exe PID 2880 wrote to memory of 2508 2880 3dvjp.exe xlxxfxf.exe PID 2508 wrote to memory of 2780 2508 xlxxfxf.exe nhbtbh.exe PID 2508 wrote to memory of 2780 2508 xlxxfxf.exe nhbtbh.exe PID 2508 wrote to memory of 2780 2508 xlxxfxf.exe nhbtbh.exe PID 2508 wrote to memory of 2780 2508 xlxxfxf.exe nhbtbh.exe PID 2780 wrote to memory of 2372 2780 nhbtbh.exe jdpvj.exe PID 2780 wrote to memory of 2372 2780 nhbtbh.exe jdpvj.exe PID 2780 wrote to memory of 2372 2780 nhbtbh.exe jdpvj.exe PID 2780 wrote to memory of 2372 2780 nhbtbh.exe jdpvj.exe PID 2372 wrote to memory of 1060 2372 jdpvj.exe 5fflrrf.exe PID 2372 wrote to memory of 1060 2372 jdpvj.exe 5fflrrf.exe PID 2372 wrote to memory of 1060 2372 jdpvj.exe 5fflrrf.exe PID 2372 wrote to memory of 1060 2372 jdpvj.exe 5fflrrf.exe PID 1060 wrote to memory of 2928 1060 5fflrrf.exe btnbnb.exe PID 1060 wrote to memory of 2928 1060 5fflrrf.exe btnbnb.exe PID 1060 wrote to memory of 2928 1060 5fflrrf.exe btnbnb.exe PID 1060 wrote to memory of 2928 1060 5fflrrf.exe btnbnb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe792787839413ec9052e7b6a9a0d267d501191e1df639530971074b20f1b0bb.exe"C:\Users\Admin\AppData\Local\Temp\fe792787839413ec9052e7b6a9a0d267d501191e1df639530971074b20f1b0bb.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\xflflrl.exec:\xflflrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\hnhhnb.exec:\hnhhnb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\jdppp.exec:\jdppp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\flffrxr.exec:\flffrxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\rrllllx.exec:\rrllllx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\xrlxllx.exec:\xrlxllx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\tnhtbh.exec:\tnhtbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\1pjjj.exec:\1pjjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\rrllflx.exec:\rrllflx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\9bbnbn.exec:\9bbnbn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\3dvjp.exec:\3dvjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\xlxxfxf.exec:\xlxxfxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\nhbtbh.exec:\nhbtbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\jdpvj.exec:\jdpvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\5fflrrf.exec:\5fflrrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
\??\c:\btnbnb.exec:\btnbnb.exe17⤵
- Executes dropped EXE
PID:2928 -
\??\c:\ppppd.exec:\ppppd.exe18⤵
- Executes dropped EXE
PID:1608 -
\??\c:\1lfllrx.exec:\1lfllrx.exe19⤵
- Executes dropped EXE
PID:288 -
\??\c:\3hhntb.exec:\3hhntb.exe20⤵
- Executes dropped EXE
PID:1148 -
\??\c:\dvdvv.exec:\dvdvv.exe21⤵
- Executes dropped EXE
PID:2456 -
\??\c:\5dvvj.exec:\5dvvj.exe22⤵
- Executes dropped EXE
PID:2244 -
\??\c:\xxlrlrf.exec:\xxlrlrf.exe23⤵
- Executes dropped EXE
PID:2016 -
\??\c:\hbnhnh.exec:\hbnhnh.exe24⤵
- Executes dropped EXE
PID:1308 -
\??\c:\ddpdp.exec:\ddpdp.exe25⤵
- Executes dropped EXE
PID:408 -
\??\c:\llxfllx.exec:\llxfllx.exe26⤵
- Executes dropped EXE
PID:2960 -
\??\c:\llfxxlx.exec:\llfxxlx.exe27⤵
- Executes dropped EXE
PID:1732 -
\??\c:\btnnbb.exec:\btnnbb.exe28⤵
- Executes dropped EXE
PID:2688 -
\??\c:\dvppj.exec:\dvppj.exe29⤵
- Executes dropped EXE
PID:3040 -
\??\c:\llflxlf.exec:\llflxlf.exe30⤵
- Executes dropped EXE
PID:2956 -
\??\c:\bthhhh.exec:\bthhhh.exe31⤵
- Executes dropped EXE
PID:1284 -
\??\c:\3jdjd.exec:\3jdjd.exe32⤵
- Executes dropped EXE
PID:1628 -
\??\c:\rrxllff.exec:\rrxllff.exe33⤵
- Executes dropped EXE
PID:2080 -
\??\c:\1dpvv.exec:\1dpvv.exe34⤵
- Executes dropped EXE
PID:2744 -
\??\c:\lfrlrxr.exec:\lfrlrxr.exe35⤵
- Executes dropped EXE
PID:2832 -
\??\c:\lxlrxxf.exec:\lxlrxxf.exe36⤵
- Executes dropped EXE
PID:1852 -
\??\c:\nbhhhb.exec:\nbhhhb.exe37⤵
- Executes dropped EXE
PID:2992 -
\??\c:\9vjpv.exec:\9vjpv.exe38⤵
- Executes dropped EXE
PID:2364 -
\??\c:\vpjjp.exec:\vpjjp.exe39⤵
- Executes dropped EXE
PID:2636 -
\??\c:\1rllrxx.exec:\1rllrxx.exe40⤵
- Executes dropped EXE
PID:2776 -
\??\c:\nbhtnt.exec:\nbhtnt.exe41⤵
- Executes dropped EXE
PID:2060 -
\??\c:\hbhhhb.exec:\hbhhhb.exe42⤵
- Executes dropped EXE
PID:2632 -
\??\c:\jvvvp.exec:\jvvvp.exe43⤵
- Executes dropped EXE
PID:2296 -
\??\c:\rlfrxlr.exec:\rlfrxlr.exe44⤵
- Executes dropped EXE
PID:1572 -
\??\c:\9bthbh.exec:\9bthbh.exe45⤵
- Executes dropped EXE
PID:1720 -
\??\c:\7tttbh.exec:\7tttbh.exe46⤵
- Executes dropped EXE
PID:2488 -
\??\c:\dvvvp.exec:\dvvvp.exe47⤵
- Executes dropped EXE
PID:2056 -
\??\c:\lfrxfrx.exec:\lfrxfrx.exe48⤵
- Executes dropped EXE
PID:2032 -
\??\c:\rlxlrxf.exec:\rlxlrxf.exe49⤵
- Executes dropped EXE
PID:2932 -
\??\c:\ttnhth.exec:\ttnhth.exe50⤵
- Executes dropped EXE
PID:2004 -
\??\c:\pppvj.exec:\pppvj.exe51⤵
- Executes dropped EXE
PID:1908 -
\??\c:\dvjjp.exec:\dvjjp.exe52⤵
- Executes dropped EXE
PID:2780 -
\??\c:\xxrfrfr.exec:\xxrfrfr.exe53⤵
- Executes dropped EXE
PID:1108 -
\??\c:\3ttbnn.exec:\3ttbnn.exe54⤵
- Executes dropped EXE
PID:2964 -
\??\c:\ttntnb.exec:\ttntnb.exe55⤵
- Executes dropped EXE
PID:568 -
\??\c:\dpvvj.exec:\dpvvj.exe56⤵
- Executes dropped EXE
PID:2012 -
\??\c:\lfrxffr.exec:\lfrxffr.exe57⤵
- Executes dropped EXE
PID:1508 -
\??\c:\3rllxxf.exec:\3rllxxf.exe58⤵
- Executes dropped EXE
PID:2584 -
\??\c:\bntntt.exec:\bntntt.exe59⤵
- Executes dropped EXE
PID:2324 -
\??\c:\vpdpj.exec:\vpdpj.exe60⤵
- Executes dropped EXE
PID:2436 -
\??\c:\pjppv.exec:\pjppv.exe61⤵
- Executes dropped EXE
PID:2176 -
\??\c:\rlxlrxl.exec:\rlxlrxl.exe62⤵
- Executes dropped EXE
PID:1480 -
\??\c:\nhbhtb.exec:\nhbhtb.exe63⤵
- Executes dropped EXE
PID:2228 -
\??\c:\dvpjd.exec:\dvpjd.exe64⤵
- Executes dropped EXE
PID:904 -
\??\c:\rrflrlx.exec:\rrflrlx.exe65⤵
- Executes dropped EXE
PID:2496 -
\??\c:\frfrfxx.exec:\frfrfxx.exe66⤵PID:1612
-
\??\c:\httnnn.exec:\httnnn.exe67⤵PID:628
-
\??\c:\ddjdd.exec:\ddjdd.exe68⤵PID:560
-
\??\c:\5jvdp.exec:\5jvdp.exe69⤵PID:976
-
\??\c:\9xxxrrx.exec:\9xxxrrx.exe70⤵PID:2068
-
\??\c:\bbnntn.exec:\bbnntn.exe71⤵PID:2072
-
\??\c:\jpvvd.exec:\jpvvd.exe72⤵PID:2956
-
\??\c:\lflxlxr.exec:\lflxlxr.exe73⤵PID:268
-
\??\c:\bbnhbh.exec:\bbnhbh.exe74⤵PID:3056
-
\??\c:\dvpdp.exec:\dvpdp.exe75⤵PID:2788
-
\??\c:\pjvpj.exec:\pjvpj.exe76⤵PID:2712
-
\??\c:\rrrfrxf.exec:\rrrfrxf.exe77⤵PID:2808
-
\??\c:\hbnhhn.exec:\hbnhhn.exe78⤵PID:2836
-
\??\c:\tnbhhh.exec:\tnbhhh.exe79⤵PID:2608
-
\??\c:\vpjpj.exec:\vpjpj.exe80⤵PID:2856
-
\??\c:\3dpdj.exec:\3dpdj.exe81⤵PID:2988
-
\??\c:\5fxlrfr.exec:\5fxlrfr.exe82⤵PID:2656
-
\??\c:\5nhtnb.exec:\5nhtnb.exe83⤵PID:2680
-
\??\c:\7nbttb.exec:\7nbttb.exe84⤵PID:2676
-
\??\c:\vvdpd.exec:\vvdpd.exe85⤵PID:2276
-
\??\c:\7lflrxf.exec:\7lflrxf.exe86⤵PID:1572
-
\??\c:\3bbnbn.exec:\3bbnbn.exe87⤵PID:1720
-
\??\c:\9nhnhn.exec:\9nhnhn.exe88⤵PID:1788
-
\??\c:\3jjvv.exec:\3jjvv.exe89⤵PID:2852
-
\??\c:\jdpvj.exec:\jdpvj.exe90⤵PID:2352
-
\??\c:\7ffrflx.exec:\7ffrflx.exe91⤵PID:2912
-
\??\c:\tbtttb.exec:\tbtttb.exe92⤵PID:1924
-
\??\c:\nnnttb.exec:\nnnttb.exe93⤵PID:1352
-
\??\c:\7vjdv.exec:\7vjdv.exe94⤵PID:2908
-
\??\c:\fllffxr.exec:\fllffxr.exe95⤵PID:1060
-
\??\c:\1frxllx.exec:\1frxllx.exe96⤵PID:1896
-
\??\c:\3pddd.exec:\3pddd.exe97⤵PID:1152
-
\??\c:\dpddd.exec:\dpddd.exe98⤵PID:2012
-
\??\c:\lxflrxf.exec:\lxflrxf.exe99⤵PID:352
-
\??\c:\lffxflf.exec:\lffxflf.exe100⤵PID:2584
-
\??\c:\bththt.exec:\bththt.exe101⤵PID:2460
-
\??\c:\htbnhn.exec:\htbnhn.exe102⤵PID:2792
-
\??\c:\vjjdp.exec:\vjjdp.exe103⤵PID:1272
-
\??\c:\5dpjv.exec:\5dpjv.exe104⤵PID:2016
-
\??\c:\lxflxxl.exec:\lxflxxl.exe105⤵PID:1964
-
\??\c:\5nbbhb.exec:\5nbbhb.exe106⤵PID:2008
-
\??\c:\9nhthh.exec:\9nhthh.exe107⤵PID:2024
-
\??\c:\dvddv.exec:\dvddv.exe108⤵PID:880
-
\??\c:\vjpjp.exec:\vjpjp.exe109⤵PID:628
-
\??\c:\1xxrflr.exec:\1xxrflr.exe110⤵PID:2688
-
\??\c:\xrfrffl.exec:\xrfrffl.exe111⤵PID:976
-
\??\c:\nnhnhh.exec:\nnhnhh.exe112⤵PID:1244
-
\??\c:\bbtbhn.exec:\bbtbhn.exe113⤵PID:1940
-
\??\c:\5vppv.exec:\5vppv.exe114⤵PID:2956
-
\??\c:\dpvdv.exec:\dpvdv.exe115⤵PID:2240
-
\??\c:\xxxrflx.exec:\xxxrflx.exe116⤵PID:2280
-
\??\c:\nhbnbn.exec:\nhbnbn.exe117⤵PID:2208
-
\??\c:\tnbbhb.exec:\tnbbhb.exe118⤵PID:2816
-
\??\c:\pjjpd.exec:\pjjpd.exe119⤵PID:1692
-
\??\c:\ddvjj.exec:\ddvjj.exe120⤵PID:2840
-
\??\c:\5lrrxxl.exec:\5lrrxxl.exe121⤵PID:2736
-
\??\c:\lfxxllx.exec:\lfxxllx.exe122⤵PID:2944
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-