Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 19:43
Behavioral task
behavioral1
Sample
0caee27f352a68f9eaaea874441415300bf888984803f0a65117db25cac4c181.exe
Resource
win7-20240903-en
General
-
Target
0caee27f352a68f9eaaea874441415300bf888984803f0a65117db25cac4c181.exe
-
Size
331KB
-
MD5
0338c99c86b68b6963301fb49170f14c
-
SHA1
a18f6c295f1aeb0c77bb5439d6c4a954fd73957e
-
SHA256
0caee27f352a68f9eaaea874441415300bf888984803f0a65117db25cac4c181
-
SHA512
13a1732b6fe58436abff3366cb369686f37150ffd3c0749a788376c2c6a29860c9217c4bda2cde90ccd4a8c85e6d2c966f808a219b84e9ea300ff6abfb3b0641
-
SSDEEP
6144:vcm4FmowdHoStJdJIjaRleL42bL37BoTPkhu9gX5yGsTshQc8R0nxA5ij8+RC7tI:94wFHoStJdSjylh2b77BoTMA9gX59sTg
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
Processes:
resource yara_rule behavioral1/memory/2688-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2976-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1028-210-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1968-195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2644-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1812-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2416-150-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1932-142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1956-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1892-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2552-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3016-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2388-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2764-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2728-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2892-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2800-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2100-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2188-287-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2544-288-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2748-321-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2940-333-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2940-331-0x00000000003B0000-0x00000000003D7000-memory.dmp family_blackmoon behavioral1/memory/2716-344-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2004-382-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1720-393-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1752-399-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1756-420-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/960-464-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2260-527-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2688-539-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2736-580-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2720-601-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2428-658-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2700-717-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2016-729-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2964-740-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/1884-797-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1700-808-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2784-927-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2332-7725-0x0000000077730000-0x000000007782A000-memory.dmp family_blackmoon behavioral1/memory/2332-9201-0x0000000077610000-0x000000007772F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
lfxrxfl.exe9pdjp.exeu862446.exe0420284.exehhhtnt.exejpddp.exe886200.exeddvvp.exe5nhtnb.exejdpjv.exelfxfrrx.exe260466.exerxrxlfr.exe0466442.exe8268068.exei084686.exe7bnbhh.exe042422.exe086684.exe4828002.exeo024662.exe5thhnn.exe2224282.exeo860284.exe2206842.exe60240.exexrlxrlf.exe22068.exec862402.exexxfrfrx.exei802624.exexrrlrxf.exeppjpv.exe5rflrfl.exeddvdp.exe20880.exepjpjp.exevddjp.exe9nnbht.exebthhth.exe4244628.exe226824.exe7dvpp.exe488084.exe44224.exeffxxffr.exebtnhtn.exe0424440.exe5rlllrx.exe9dvvj.exe4446408.exe04220.exeg6460.exee02462.exe48662.exe2022880.exe602868.exe48280.exe04624.exe04806.exe222002.exe664462.exe7rrfllr.exe1llrxfr.exepid Process 2688 lfxrxfl.exe 2544 9pdjp.exe 2100 u862446.exe 2800 0420284.exe 2744 hhhtnt.exe 2892 jpddp.exe 2728 886200.exe 2764 ddvvp.exe 2780 5nhtnb.exe 2388 jdpjv.exe 2624 lfxfrrx.exe 3016 260466.exe 2552 rxrxlfr.exe 1892 0466442.exe 2028 8268068.exe 1188 i084686.exe 1956 7bnbhh.exe 1932 042422.exe 2416 086684.exe 1812 4828002.exe 1684 o024662.exe 1788 5thhnn.exe 2644 2224282.exe 2448 o860284.exe 1968 2206842.exe 1644 60240.exe 1028 xrlxrlf.exe 2040 22068.exe 1800 c862402.exe 1660 xxfrfrx.exe 264 i802624.exe 792 xrrlrxf.exe 2948 ppjpv.exe 2336 5rflrfl.exe 700 ddvdp.exe 2524 20880.exe 1884 pjpjp.exe 2984 vddjp.exe 2188 9nnbht.exe 2544 bthhth.exe 2104 4244628.exe 3048 226824.exe 2800 7dvpp.exe 2876 488084.exe 2872 44224.exe 2748 ffxxffr.exe 2940 btnhtn.exe 2780 0424440.exe 2716 5rlllrx.exe 2400 9dvvj.exe 2676 4446408.exe 2944 04220.exe 2576 g6460.exe 1724 e02462.exe 1736 48662.exe 2004 2022880.exe 2900 602868.exe 1720 48280.exe 1616 04624.exe 1752 04806.exe 1812 222002.exe 1680 664462.exe 1756 7rrfllr.exe 1788 1llrxfr.exe -
Processes:
resource yara_rule behavioral1/memory/2976-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000012117-5.dat upx behavioral1/files/0x00080000000175f1-17.dat upx behavioral1/memory/2688-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2688-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2976-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195a8-245.dat upx behavioral1/files/0x0005000000019543-238.dat upx behavioral1/files/0x0005000000019535-231.dat upx behavioral1/files/0x000500000001952e-224.dat upx behavioral1/files/0x000500000001952b-217.dat upx behavioral1/memory/1028-210-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019520-209.dat upx behavioral1/files/0x0005000000019518-202.dat upx behavioral1/memory/1968-195-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019510-194.dat upx behavioral1/files/0x0005000000019508-187.dat upx behavioral1/memory/2644-180-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00090000000174b4-179.dat upx behavioral1/files/0x0005000000019502-172.dat upx behavioral1/files/0x00050000000194e1-165.dat upx behavioral1/memory/1812-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194d5-157.dat upx behavioral1/memory/2416-150-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194c3-149.dat upx behavioral1/memory/1932-142-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194ad-141.dat upx behavioral1/memory/1956-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019428-133.dat upx behavioral1/files/0x0005000000019426-126.dat upx behavioral1/files/0x00050000000193f9-119.dat upx behavioral1/memory/1892-112-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193dc-111.dat upx behavioral1/memory/2552-104-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193d0-103.dat upx behavioral1/memory/3016-96-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193cc-95.dat upx behavioral1/files/0x000500000001939f-88.dat upx behavioral1/memory/2388-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001938e-80.dat upx behavioral1/files/0x0005000000019358-73.dat upx behavioral1/memory/2764-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000018be7-65.dat upx behavioral1/memory/2728-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001871c-57.dat upx behavioral1/memory/2892-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001870c-48.dat upx behavioral1/files/0x0006000000018706-41.dat upx behavioral1/memory/2800-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000f000000018683-33.dat upx behavioral1/memory/2100-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000175f7-25.dat upx behavioral1/memory/2544-288-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2748-321-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2940-333-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2400-345-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2716-344-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2944-356-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2004-382-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1752-399-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1756-420-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/960-464-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2260-527-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2688-539-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
660640.exeddvvp.exe7fxrxxl.exe04806.exefxllrrx.exem0426.exe3tnnth.exe66064.exek68800.exejdvvj.exexlxrxfl.exe208028.exevvvjv.exec802440.exe2642002.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 660640.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7fxrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 04806.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language m0426.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tnnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66064.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language k68800.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 208028.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c802440.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2642002.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0caee27f352a68f9eaaea874441415300bf888984803f0a65117db25cac4c181.exelfxrxfl.exe9pdjp.exeu862446.exe0420284.exehhhtnt.exejpddp.exe886200.exeddvvp.exe5nhtnb.exejdpjv.exelfxfrrx.exe260466.exerxrxlfr.exe0466442.exe8268068.exedescription pid Process procid_target PID 2976 wrote to memory of 2688 2976 0caee27f352a68f9eaaea874441415300bf888984803f0a65117db25cac4c181.exe 30 PID 2976 wrote to memory of 2688 2976 0caee27f352a68f9eaaea874441415300bf888984803f0a65117db25cac4c181.exe 30 PID 2976 wrote to memory of 2688 2976 0caee27f352a68f9eaaea874441415300bf888984803f0a65117db25cac4c181.exe 30 PID 2976 wrote to memory of 2688 2976 0caee27f352a68f9eaaea874441415300bf888984803f0a65117db25cac4c181.exe 30 PID 2688 wrote to memory of 2544 2688 lfxrxfl.exe 31 PID 2688 wrote to memory of 2544 2688 lfxrxfl.exe 31 PID 2688 wrote to memory of 2544 2688 lfxrxfl.exe 31 PID 2688 wrote to memory of 2544 2688 lfxrxfl.exe 31 PID 2544 wrote to memory of 2100 2544 9pdjp.exe 32 PID 2544 wrote to memory of 2100 2544 9pdjp.exe 32 PID 2544 wrote to memory of 2100 2544 9pdjp.exe 32 PID 2544 wrote to memory of 2100 2544 9pdjp.exe 32 PID 2100 wrote to memory of 2800 2100 u862446.exe 33 PID 2100 wrote to memory of 2800 2100 u862446.exe 33 PID 2100 wrote to memory of 2800 2100 u862446.exe 33 PID 2100 wrote to memory of 2800 2100 u862446.exe 33 PID 2800 wrote to memory of 2744 2800 0420284.exe 34 PID 2800 wrote to memory of 2744 2800 0420284.exe 34 PID 2800 wrote to memory of 2744 2800 0420284.exe 34 PID 2800 wrote to memory of 2744 2800 0420284.exe 34 PID 2744 wrote to memory of 2892 2744 hhhtnt.exe 35 PID 2744 wrote to memory of 2892 2744 hhhtnt.exe 35 PID 2744 wrote to memory of 2892 2744 hhhtnt.exe 35 PID 2744 wrote to memory of 2892 2744 hhhtnt.exe 35 PID 2892 wrote to memory of 2728 2892 jpddp.exe 36 PID 2892 wrote to memory of 2728 2892 jpddp.exe 36 PID 2892 wrote to memory of 2728 2892 jpddp.exe 36 PID 2892 wrote to memory of 2728 2892 jpddp.exe 36 PID 2728 wrote to memory of 2764 2728 886200.exe 37 PID 2728 wrote to memory of 2764 2728 886200.exe 37 PID 2728 wrote to memory of 2764 2728 886200.exe 37 PID 2728 wrote to memory of 2764 2728 886200.exe 37 PID 2764 wrote to memory of 2780 2764 ddvvp.exe 38 PID 2764 wrote to memory of 2780 2764 ddvvp.exe 38 PID 2764 wrote to memory of 2780 2764 ddvvp.exe 38 PID 2764 wrote to memory of 2780 2764 ddvvp.exe 38 PID 2780 wrote to memory of 2388 2780 5nhtnb.exe 39 PID 2780 wrote to memory of 2388 2780 5nhtnb.exe 39 PID 2780 wrote to memory of 2388 2780 5nhtnb.exe 39 PID 2780 wrote to memory of 2388 2780 5nhtnb.exe 39 PID 2388 wrote to memory of 2624 2388 jdpjv.exe 40 PID 2388 wrote to memory of 2624 2388 jdpjv.exe 40 PID 2388 wrote to memory of 2624 2388 jdpjv.exe 40 PID 2388 wrote to memory of 2624 2388 jdpjv.exe 40 PID 2624 wrote to memory of 3016 2624 lfxfrrx.exe 41 PID 2624 wrote to memory of 3016 2624 lfxfrrx.exe 41 PID 2624 wrote to memory of 3016 2624 lfxfrrx.exe 41 PID 2624 wrote to memory of 3016 2624 lfxfrrx.exe 41 PID 3016 wrote to memory of 2552 3016 260466.exe 42 PID 3016 wrote to memory of 2552 3016 260466.exe 42 PID 3016 wrote to memory of 2552 3016 260466.exe 42 PID 3016 wrote to memory of 2552 3016 260466.exe 42 PID 2552 wrote to memory of 1892 2552 rxrxlfr.exe 43 PID 2552 wrote to memory of 1892 2552 rxrxlfr.exe 43 PID 2552 wrote to memory of 1892 2552 rxrxlfr.exe 43 PID 2552 wrote to memory of 1892 2552 rxrxlfr.exe 43 PID 1892 wrote to memory of 2028 1892 0466442.exe 44 PID 1892 wrote to memory of 2028 1892 0466442.exe 44 PID 1892 wrote to memory of 2028 1892 0466442.exe 44 PID 1892 wrote to memory of 2028 1892 0466442.exe 44 PID 2028 wrote to memory of 1188 2028 8268068.exe 45 PID 2028 wrote to memory of 1188 2028 8268068.exe 45 PID 2028 wrote to memory of 1188 2028 8268068.exe 45 PID 2028 wrote to memory of 1188 2028 8268068.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\0caee27f352a68f9eaaea874441415300bf888984803f0a65117db25cac4c181.exe"C:\Users\Admin\AppData\Local\Temp\0caee27f352a68f9eaaea874441415300bf888984803f0a65117db25cac4c181.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\lfxrxfl.exec:\lfxrxfl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\9pdjp.exec:\9pdjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\u862446.exec:\u862446.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\0420284.exec:\0420284.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\hhhtnt.exec:\hhhtnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\jpddp.exec:\jpddp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\886200.exec:\886200.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\ddvvp.exec:\ddvvp.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\5nhtnb.exec:\5nhtnb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\jdpjv.exec:\jdpjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\lfxfrrx.exec:\lfxfrrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\260466.exec:\260466.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\rxrxlfr.exec:\rxrxlfr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\0466442.exec:\0466442.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\8268068.exec:\8268068.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\i084686.exec:\i084686.exe17⤵
- Executes dropped EXE
PID:1188 -
\??\c:\7bnbhh.exec:\7bnbhh.exe18⤵
- Executes dropped EXE
PID:1956 -
\??\c:\042422.exec:\042422.exe19⤵
- Executes dropped EXE
PID:1932 -
\??\c:\086684.exec:\086684.exe20⤵
- Executes dropped EXE
PID:2416 -
\??\c:\4828002.exec:\4828002.exe21⤵
- Executes dropped EXE
PID:1812 -
\??\c:\o024662.exec:\o024662.exe22⤵
- Executes dropped EXE
PID:1684 -
\??\c:\5thhnn.exec:\5thhnn.exe23⤵
- Executes dropped EXE
PID:1788 -
\??\c:\2224282.exec:\2224282.exe24⤵
- Executes dropped EXE
PID:2644 -
\??\c:\o860284.exec:\o860284.exe25⤵
- Executes dropped EXE
PID:2448 -
\??\c:\2206842.exec:\2206842.exe26⤵
- Executes dropped EXE
PID:1968 -
\??\c:\60240.exec:\60240.exe27⤵
- Executes dropped EXE
PID:1644 -
\??\c:\xrlxrlf.exec:\xrlxrlf.exe28⤵
- Executes dropped EXE
PID:1028 -
\??\c:\22068.exec:\22068.exe29⤵
- Executes dropped EXE
PID:2040 -
\??\c:\c862402.exec:\c862402.exe30⤵
- Executes dropped EXE
PID:1800 -
\??\c:\xxfrfrx.exec:\xxfrfrx.exe31⤵
- Executes dropped EXE
PID:1660 -
\??\c:\i802624.exec:\i802624.exe32⤵
- Executes dropped EXE
PID:264 -
\??\c:\xrrlrxf.exec:\xrrlrxf.exe33⤵
- Executes dropped EXE
PID:792 -
\??\c:\ppjpv.exec:\ppjpv.exe34⤵
- Executes dropped EXE
PID:2948 -
\??\c:\5rflrfl.exec:\5rflrfl.exe35⤵
- Executes dropped EXE
PID:2336 -
\??\c:\ddvdp.exec:\ddvdp.exe36⤵
- Executes dropped EXE
PID:700 -
\??\c:\20880.exec:\20880.exe37⤵
- Executes dropped EXE
PID:2524 -
\??\c:\pjpjp.exec:\pjpjp.exe38⤵
- Executes dropped EXE
PID:1884 -
\??\c:\vddjp.exec:\vddjp.exe39⤵
- Executes dropped EXE
PID:2984 -
\??\c:\9nnbht.exec:\9nnbht.exe40⤵
- Executes dropped EXE
PID:2188 -
\??\c:\bthhth.exec:\bthhth.exe41⤵
- Executes dropped EXE
PID:2544 -
\??\c:\4244628.exec:\4244628.exe42⤵
- Executes dropped EXE
PID:2104 -
\??\c:\226824.exec:\226824.exe43⤵
- Executes dropped EXE
PID:3048 -
\??\c:\7dvpp.exec:\7dvpp.exe44⤵
- Executes dropped EXE
PID:2800 -
\??\c:\488084.exec:\488084.exe45⤵
- Executes dropped EXE
PID:2876 -
\??\c:\44224.exec:\44224.exe46⤵
- Executes dropped EXE
PID:2872 -
\??\c:\ffxxffr.exec:\ffxxffr.exe47⤵
- Executes dropped EXE
PID:2748 -
\??\c:\btnhtn.exec:\btnhtn.exe48⤵
- Executes dropped EXE
PID:2940 -
\??\c:\0424440.exec:\0424440.exe49⤵
- Executes dropped EXE
PID:2780 -
\??\c:\5rlllrx.exec:\5rlllrx.exe50⤵
- Executes dropped EXE
PID:2716 -
\??\c:\9dvvj.exec:\9dvvj.exe51⤵
- Executes dropped EXE
PID:2400 -
\??\c:\4446408.exec:\4446408.exe52⤵
- Executes dropped EXE
PID:2676 -
\??\c:\04220.exec:\04220.exe53⤵
- Executes dropped EXE
PID:2944 -
\??\c:\g6460.exec:\g6460.exe54⤵
- Executes dropped EXE
PID:2576 -
\??\c:\e02462.exec:\e02462.exe55⤵
- Executes dropped EXE
PID:1724 -
\??\c:\48662.exec:\48662.exe56⤵
- Executes dropped EXE
PID:1736 -
\??\c:\2022880.exec:\2022880.exe57⤵
- Executes dropped EXE
PID:2004 -
\??\c:\602868.exec:\602868.exe58⤵
- Executes dropped EXE
PID:2900 -
\??\c:\48280.exec:\48280.exe59⤵
- Executes dropped EXE
PID:1720 -
\??\c:\04624.exec:\04624.exe60⤵
- Executes dropped EXE
PID:1616 -
\??\c:\04806.exec:\04806.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1752 -
\??\c:\222002.exec:\222002.exe62⤵
- Executes dropped EXE
PID:1812 -
\??\c:\664462.exec:\664462.exe63⤵
- Executes dropped EXE
PID:1680 -
\??\c:\7rrfllr.exec:\7rrfllr.exe64⤵
- Executes dropped EXE
PID:1756 -
\??\c:\1llrxfr.exec:\1llrxfr.exe65⤵
- Executes dropped EXE
PID:1788 -
\??\c:\fffxxxr.exec:\fffxxxr.exe66⤵PID:2128
-
\??\c:\1nhhtb.exec:\1nhhtb.exe67⤵PID:2920
-
\??\c:\5hbbnn.exec:\5hbbnn.exe68⤵PID:2824
-
\??\c:\rlxfllx.exec:\rlxfllx.exe69⤵PID:1348
-
\??\c:\dvpvj.exec:\dvpvj.exe70⤵PID:1968
-
\??\c:\2644062.exec:\2644062.exe71⤵PID:1080
-
\??\c:\jdpjp.exec:\jdpjp.exe72⤵PID:960
-
\??\c:\1btbht.exec:\1btbht.exe73⤵PID:1952
-
\??\c:\rrxflrf.exec:\rrxflrf.exe74⤵PID:904
-
\??\c:\c244002.exec:\c244002.exe75⤵PID:2328
-
\??\c:\64886.exec:\64886.exe76⤵PID:1380
-
\??\c:\6068062.exec:\6068062.exe77⤵PID:2476
-
\??\c:\486266.exec:\486266.exe78⤵PID:2068
-
\??\c:\frfxfff.exec:\frfxfff.exe79⤵PID:1908
-
\??\c:\dpddj.exec:\dpddj.exe80⤵PID:544
-
\??\c:\5btnbb.exec:\5btnbb.exe81⤵PID:568
-
\??\c:\1rxxxlf.exec:\1rxxxlf.exe82⤵PID:2032
-
\??\c:\5dvdp.exec:\5dvdp.exe83⤵PID:2524
-
\??\c:\66462.exec:\66462.exe84⤵PID:2260
-
\??\c:\9pddj.exec:\9pddj.exe85⤵PID:2164
-
\??\c:\20486.exec:\20486.exe86⤵PID:2688
-
\??\c:\dddpj.exec:\dddpj.exe87⤵PID:480
-
\??\c:\xrrrlrr.exec:\xrrrlrr.exe88⤵PID:2532
-
\??\c:\7vjpv.exec:\7vjpv.exe89⤵PID:2488
-
\??\c:\7frxfrx.exec:\7frxfrx.exe90⤵PID:580
-
\??\c:\e86288.exec:\e86288.exe91⤵PID:2088
-
\??\c:\tnhhhn.exec:\tnhhhn.exe92⤵PID:3044
-
\??\c:\nhtbbn.exec:\nhtbbn.exe93⤵PID:2800
-
\??\c:\7lrrxrx.exec:\7lrrxrx.exe94⤵PID:2736
-
\??\c:\tnnhtb.exec:\tnnhtb.exe95⤵PID:2764
-
\??\c:\3tbthh.exec:\3tbthh.exe96⤵PID:2720
-
\??\c:\q44462.exec:\q44462.exe97⤵PID:3056
-
\??\c:\e64624.exec:\e64624.exe98⤵PID:2632
-
\??\c:\60846.exec:\60846.exe99⤵PID:2196
-
\??\c:\bnbhnh.exec:\bnbhnh.exe100⤵PID:2648
-
\??\c:\3fllrrx.exec:\3fllrrx.exe101⤵PID:1144
-
\??\c:\3rlffll.exec:\3rlffll.exe102⤵PID:2760
-
\??\c:\bbntbn.exec:\bbntbn.exe103⤵PID:2132
-
\??\c:\3rrxflr.exec:\3rrxflr.exe104⤵PID:1148
-
\??\c:\7xlrlrf.exec:\7xlrlrf.exe105⤵PID:1872
-
\??\c:\26028.exec:\26028.exe106⤵PID:2568
-
\??\c:\u084602.exec:\u084602.exe107⤵PID:2788
-
\??\c:\004088.exec:\004088.exe108⤵PID:2608
-
\??\c:\xxrfrrf.exec:\xxrfrrf.exe109⤵PID:2428
-
\??\c:\jdvdd.exec:\jdvdd.exe110⤵PID:2412
-
\??\c:\s4262.exec:\s4262.exe111⤵PID:1744
-
\??\c:\1ntttb.exec:\1ntttb.exe112⤵PID:1812
-
\??\c:\9hbbhn.exec:\9hbbhn.exe113⤵PID:556
-
\??\c:\hbthnt.exec:\hbthnt.exe114⤵PID:2844
-
\??\c:\08046.exec:\08046.exe115⤵PID:2644
-
\??\c:\xrlxlfr.exec:\xrlxlfr.exe116⤵PID:1620
-
\??\c:\0484662.exec:\0484662.exe117⤵PID:852
-
\??\c:\pdpvd.exec:\pdpvd.exe118⤵PID:816
-
\??\c:\3pdvv.exec:\3pdvv.exe119⤵PID:1064
-
\??\c:\268022.exec:\268022.exe120⤵PID:2700
-
\??\c:\844402.exec:\844402.exe121⤵PID:2956
-
\??\c:\vpvpd.exec:\vpvpd.exe122⤵PID:2016
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-