Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 19:54
Behavioral task
behavioral1
Sample
13c96d1e32de79d2a280712f67183e62f8dfd1b18e2fc609ed8e9da9a0e556e1.exe
Resource
win7-20240903-en
General
-
Target
13c96d1e32de79d2a280712f67183e62f8dfd1b18e2fc609ed8e9da9a0e556e1.exe
-
Size
332KB
-
MD5
f66e32ae53325232d1d14d721fbc2f6b
-
SHA1
0686dc81ac94ace7db64d89e7eff3c847f01f036
-
SHA256
13c96d1e32de79d2a280712f67183e62f8dfd1b18e2fc609ed8e9da9a0e556e1
-
SHA512
55cff182fdfcd5c58a40fb92fcd91f8a7f91f749c109e4e14a1e0ae39896ff236eb3c386b00acbf520be2ab9970be8c99cfbeaaa1e2c3572358193f4b7177fde
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeR:R4wFHoSHYHUrAwfMp3CDR
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 51 IoCs
Processes:
resource yara_rule behavioral1/memory/1192-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2480-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1192-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2096-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/864-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/864-25-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2732-366-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/828-320-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2696-312-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1792-308-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2324-300-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2328-288-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2084-287-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2188-253-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2444-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2444-246-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2204-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3044-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1952-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1952-200-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2936-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2936-170-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1352-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1720-146-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1064-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1064-123-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/2792-113-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1520-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2580-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2580-90-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2872-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2008-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2656-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2748-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2000-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2000-40-0x0000000001B80000-0x0000000001BA7000-memory.dmp family_blackmoon behavioral1/memory/2064-421-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1312-483-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1444-524-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2336-536-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2824-584-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1640-669-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1244-864-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/768-1016-0x00000000775F0000-0x00000000776EA000-memory.dmp family_blackmoon behavioral1/memory/768-1015-0x00000000776F0000-0x000000007780F000-memory.dmp family_blackmoon behavioral1/memory/1568-1038-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/1976-1109-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/856-1134-0x00000000003D0000-0x00000000003F7000-memory.dmp family_blackmoon behavioral1/memory/1252-1139-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1836-1194-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/948-1208-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
llxrflx.exe0846244.exedddjv.exenbnntt.exe60224.exennnhbb.exe424640.exelfxrrxx.exe202840.exem8446.exe26286.exepvvjp.exe482402.exepjdvd.exe048062.exexxllrlx.exe5pjvd.exe248088.exe0664028.exelllxfrf.exe4682882.exethntht.exe5bnbth.exexfxxffl.exerlxlffr.exe26068.exe1lrfxlr.exerxrffrf.exe8262808.exe4420224.exe6046806.exe2000284.exe00420.exefrlfrxx.exe7nhhth.exehbthth.exerxrrfrx.exec220864.exerrxrfxr.exew86280.exe60842.exe04822.exe3lfllxr.exexxlrxxf.exedjjdd.exexrrlxlx.exek82802.exexrffrxl.exe1nnthn.exe882028.exe4404242.exerxrfffx.exenhtthb.exe04280.exerxrxlrr.exepjddj.exehbbbbt.exeppvpd.exe008262.exe48246.exe048406.exe04282.exe7tnbnt.exe48006.exepid process 1192 llxrflx.exe 864 0846244.exe 2096 dddjv.exe 2000 nbnntt.exe 2748 60224.exe 2656 nnnhbb.exe 2008 424640.exe 2872 lfxrrxx.exe 2596 202840.exe 2580 m8446.exe 2056 26286.exe 1520 pvvjp.exe 2792 482402.exe 1064 pjdvd.exe 2620 048062.exe 620 xxllrlx.exe 1720 5pjvd.exe 1208 248088.exe 1352 0664028.exe 2936 lllxfrf.exe 2064 4682882.exe 2268 thntht.exe 2052 5bnbth.exe 1952 xfxxffl.exe 3044 rlxlffr.exe 2204 26068.exe 1544 1lrfxlr.exe 1388 rxrffrf.exe 2964 8262808.exe 2444 4420224.exe 2188 6046806.exe 1656 2000284.exe 1760 00420.exe 1396 frlfrxx.exe 2492 7nhhth.exe 2084 hbthth.exe 2328 rxrrfrx.exe 2324 c220864.exe 2316 rrxrfxr.exe 1792 w86280.exe 2696 60842.exe 828 04822.exe 2760 3lfllxr.exe 2668 xxlrxxf.exe 2780 djjdd.exe 2872 xrrlxlx.exe 2552 k82802.exe 2600 xrffrxl.exe 2580 1nnthn.exe 2544 882028.exe 2732 4404242.exe 2036 rxrfffx.exe 2004 nhtthb.exe 1852 04280.exe 1572 rxrxlrr.exe 2800 pjddj.exe 2672 hbbbbt.exe 1708 ppvpd.exe 1776 008262.exe 2064 48246.exe 2104 048406.exe 2912 04282.exe 2124 7tnbnt.exe 848 48006.exe -
Processes:
resource yara_rule behavioral1/memory/2480-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1192-10-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\llxrflx.exe upx behavioral1/memory/2480-8-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\0846244.exe upx behavioral1/memory/864-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1192-16-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nbnntt.exe upx behavioral1/memory/2096-31-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\dddjv.exe upx behavioral1/memory/864-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2732-366-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2696-312-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2324-300-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2328-288-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2084-287-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\2000284.exe upx behavioral1/memory/2188-253-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\6046806.exe upx behavioral1/memory/2444-250-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\4420224.exe upx \??\c:\8262808.exe upx \??\c:\rxrffrf.exe upx \??\c:\1lrfxlr.exe upx behavioral1/memory/2204-220-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\26068.exe upx behavioral1/memory/3044-207-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rlxlffr.exe upx \??\c:\xfxxffl.exe upx behavioral1/memory/1952-204-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\5bnbth.exe upx \??\c:\thntht.exe upx \??\c:\4682882.exe upx behavioral1/memory/2936-174-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\lllxfrf.exe upx behavioral1/memory/1352-160-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\0664028.exe upx \??\c:\248088.exe upx behavioral1/memory/1720-146-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\5pjvd.exe upx \??\c:\xxllrlx.exe upx \??\c:\048062.exe upx behavioral1/memory/1064-127-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1064-123-0x00000000002A0000-0x00000000002C7000-memory.dmp upx \??\c:\pjdvd.exe upx behavioral1/memory/2792-113-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\482402.exe upx behavioral1/memory/1520-110-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pvvjp.exe upx \??\c:\26286.exe upx behavioral1/memory/2580-94-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\m8446.exe upx \??\c:\202840.exe upx behavioral1/memory/2872-78-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\lfxrrxx.exe upx behavioral1/memory/2008-65-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\424640.exe upx behavioral1/memory/2656-61-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nnnhbb.exe upx behavioral1/memory/2748-48-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\60224.exe upx behavioral1/memory/2000-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2800-395-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2064-421-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
m4044.exe826862.exei260468.exe9rlffxl.exebbthth.exeddvdp.exelllxlrx.exellrfxxr.exeddpjp.exe00886.exe642244.exeflrxrxr.exe608068.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language m4044.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 826862.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language i260468.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rlffxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbthth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllxlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 00886.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 642244.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrxrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 608068.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
13c96d1e32de79d2a280712f67183e62f8dfd1b18e2fc609ed8e9da9a0e556e1.exellxrflx.exe0846244.exedddjv.exenbnntt.exe60224.exennnhbb.exe424640.exelfxrrxx.exe202840.exem8446.exe26286.exepvvjp.exe482402.exepjdvd.exe048062.exedescription pid process target process PID 2480 wrote to memory of 1192 2480 13c96d1e32de79d2a280712f67183e62f8dfd1b18e2fc609ed8e9da9a0e556e1.exe llxrflx.exe PID 2480 wrote to memory of 1192 2480 13c96d1e32de79d2a280712f67183e62f8dfd1b18e2fc609ed8e9da9a0e556e1.exe llxrflx.exe PID 2480 wrote to memory of 1192 2480 13c96d1e32de79d2a280712f67183e62f8dfd1b18e2fc609ed8e9da9a0e556e1.exe llxrflx.exe PID 2480 wrote to memory of 1192 2480 13c96d1e32de79d2a280712f67183e62f8dfd1b18e2fc609ed8e9da9a0e556e1.exe llxrflx.exe PID 1192 wrote to memory of 864 1192 llxrflx.exe 0846244.exe PID 1192 wrote to memory of 864 1192 llxrflx.exe 0846244.exe PID 1192 wrote to memory of 864 1192 llxrflx.exe 0846244.exe PID 1192 wrote to memory of 864 1192 llxrflx.exe 0846244.exe PID 864 wrote to memory of 2096 864 0846244.exe dddjv.exe PID 864 wrote to memory of 2096 864 0846244.exe dddjv.exe PID 864 wrote to memory of 2096 864 0846244.exe dddjv.exe PID 864 wrote to memory of 2096 864 0846244.exe dddjv.exe PID 2096 wrote to memory of 2000 2096 dddjv.exe nbnntt.exe PID 2096 wrote to memory of 2000 2096 dddjv.exe nbnntt.exe PID 2096 wrote to memory of 2000 2096 dddjv.exe nbnntt.exe PID 2096 wrote to memory of 2000 2096 dddjv.exe nbnntt.exe PID 2000 wrote to memory of 2748 2000 nbnntt.exe 60224.exe PID 2000 wrote to memory of 2748 2000 nbnntt.exe 60224.exe PID 2000 wrote to memory of 2748 2000 nbnntt.exe 60224.exe PID 2000 wrote to memory of 2748 2000 nbnntt.exe 60224.exe PID 2748 wrote to memory of 2656 2748 60224.exe nnnhbb.exe PID 2748 wrote to memory of 2656 2748 60224.exe nnnhbb.exe PID 2748 wrote to memory of 2656 2748 60224.exe nnnhbb.exe PID 2748 wrote to memory of 2656 2748 60224.exe nnnhbb.exe PID 2656 wrote to memory of 2008 2656 nnnhbb.exe 424640.exe PID 2656 wrote to memory of 2008 2656 nnnhbb.exe 424640.exe PID 2656 wrote to memory of 2008 2656 nnnhbb.exe 424640.exe PID 2656 wrote to memory of 2008 2656 nnnhbb.exe 424640.exe PID 2008 wrote to memory of 2872 2008 424640.exe lfxrrxx.exe PID 2008 wrote to memory of 2872 2008 424640.exe lfxrrxx.exe PID 2008 wrote to memory of 2872 2008 424640.exe lfxrrxx.exe PID 2008 wrote to memory of 2872 2008 424640.exe lfxrrxx.exe PID 2872 wrote to memory of 2596 2872 lfxrrxx.exe 202840.exe PID 2872 wrote to memory of 2596 2872 lfxrrxx.exe 202840.exe PID 2872 wrote to memory of 2596 2872 lfxrrxx.exe 202840.exe PID 2872 wrote to memory of 2596 2872 lfxrrxx.exe 202840.exe PID 2596 wrote to memory of 2580 2596 202840.exe m8446.exe PID 2596 wrote to memory of 2580 2596 202840.exe m8446.exe PID 2596 wrote to memory of 2580 2596 202840.exe m8446.exe PID 2596 wrote to memory of 2580 2596 202840.exe m8446.exe PID 2580 wrote to memory of 2056 2580 m8446.exe 26286.exe PID 2580 wrote to memory of 2056 2580 m8446.exe 26286.exe PID 2580 wrote to memory of 2056 2580 m8446.exe 26286.exe PID 2580 wrote to memory of 2056 2580 m8446.exe 26286.exe PID 2056 wrote to memory of 1520 2056 26286.exe pvvjp.exe PID 2056 wrote to memory of 1520 2056 26286.exe pvvjp.exe PID 2056 wrote to memory of 1520 2056 26286.exe pvvjp.exe PID 2056 wrote to memory of 1520 2056 26286.exe pvvjp.exe PID 1520 wrote to memory of 2792 1520 pvvjp.exe 482402.exe PID 1520 wrote to memory of 2792 1520 pvvjp.exe 482402.exe PID 1520 wrote to memory of 2792 1520 pvvjp.exe 482402.exe PID 1520 wrote to memory of 2792 1520 pvvjp.exe 482402.exe PID 2792 wrote to memory of 1064 2792 482402.exe pjdvd.exe PID 2792 wrote to memory of 1064 2792 482402.exe pjdvd.exe PID 2792 wrote to memory of 1064 2792 482402.exe pjdvd.exe PID 2792 wrote to memory of 1064 2792 482402.exe pjdvd.exe PID 1064 wrote to memory of 2620 1064 pjdvd.exe 048062.exe PID 1064 wrote to memory of 2620 1064 pjdvd.exe 048062.exe PID 1064 wrote to memory of 2620 1064 pjdvd.exe 048062.exe PID 1064 wrote to memory of 2620 1064 pjdvd.exe 048062.exe PID 2620 wrote to memory of 620 2620 048062.exe xxllrlx.exe PID 2620 wrote to memory of 620 2620 048062.exe xxllrlx.exe PID 2620 wrote to memory of 620 2620 048062.exe xxllrlx.exe PID 2620 wrote to memory of 620 2620 048062.exe xxllrlx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\13c96d1e32de79d2a280712f67183e62f8dfd1b18e2fc609ed8e9da9a0e556e1.exe"C:\Users\Admin\AppData\Local\Temp\13c96d1e32de79d2a280712f67183e62f8dfd1b18e2fc609ed8e9da9a0e556e1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\llxrflx.exec:\llxrflx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
\??\c:\0846244.exec:\0846244.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\dddjv.exec:\dddjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\nbnntt.exec:\nbnntt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\60224.exec:\60224.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\nnnhbb.exec:\nnnhbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\424640.exec:\424640.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\lfxrrxx.exec:\lfxrrxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\202840.exec:\202840.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\m8446.exec:\m8446.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\26286.exec:\26286.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\pvvjp.exec:\pvvjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\482402.exec:\482402.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\pjdvd.exec:\pjdvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
\??\c:\048062.exec:\048062.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\xxllrlx.exec:\xxllrlx.exe17⤵
- Executes dropped EXE
PID:620 -
\??\c:\5pjvd.exec:\5pjvd.exe18⤵
- Executes dropped EXE
PID:1720 -
\??\c:\248088.exec:\248088.exe19⤵
- Executes dropped EXE
PID:1208 -
\??\c:\0664028.exec:\0664028.exe20⤵
- Executes dropped EXE
PID:1352 -
\??\c:\lllxfrf.exec:\lllxfrf.exe21⤵
- Executes dropped EXE
PID:2936 -
\??\c:\4682882.exec:\4682882.exe22⤵
- Executes dropped EXE
PID:2064 -
\??\c:\thntht.exec:\thntht.exe23⤵
- Executes dropped EXE
PID:2268 -
\??\c:\5bnbth.exec:\5bnbth.exe24⤵
- Executes dropped EXE
PID:2052 -
\??\c:\xfxxffl.exec:\xfxxffl.exe25⤵
- Executes dropped EXE
PID:1952 -
\??\c:\rlxlffr.exec:\rlxlffr.exe26⤵
- Executes dropped EXE
PID:3044 -
\??\c:\26068.exec:\26068.exe27⤵
- Executes dropped EXE
PID:2204 -
\??\c:\1lrfxlr.exec:\1lrfxlr.exe28⤵
- Executes dropped EXE
PID:1544 -
\??\c:\rxrffrf.exec:\rxrffrf.exe29⤵
- Executes dropped EXE
PID:1388 -
\??\c:\8262808.exec:\8262808.exe30⤵
- Executes dropped EXE
PID:2964 -
\??\c:\4420224.exec:\4420224.exe31⤵
- Executes dropped EXE
PID:2444 -
\??\c:\6046806.exec:\6046806.exe32⤵
- Executes dropped EXE
PID:2188 -
\??\c:\2000284.exec:\2000284.exe33⤵
- Executes dropped EXE
PID:1656 -
\??\c:\00420.exec:\00420.exe34⤵
- Executes dropped EXE
PID:1760 -
\??\c:\frlfrxx.exec:\frlfrxx.exe35⤵
- Executes dropped EXE
PID:1396 -
\??\c:\7nhhth.exec:\7nhhth.exe36⤵
- Executes dropped EXE
PID:2492 -
\??\c:\hbthth.exec:\hbthth.exe37⤵
- Executes dropped EXE
PID:2084 -
\??\c:\rxrrfrx.exec:\rxrrfrx.exe38⤵
- Executes dropped EXE
PID:2328 -
\??\c:\c220864.exec:\c220864.exe39⤵
- Executes dropped EXE
PID:2324 -
\??\c:\rrxrfxr.exec:\rrxrfxr.exe40⤵
- Executes dropped EXE
PID:2316 -
\??\c:\w86280.exec:\w86280.exe41⤵
- Executes dropped EXE
PID:1792 -
\??\c:\60842.exec:\60842.exe42⤵
- Executes dropped EXE
PID:2696 -
\??\c:\04822.exec:\04822.exe43⤵
- Executes dropped EXE
PID:828 -
\??\c:\3lfllxr.exec:\3lfllxr.exe44⤵
- Executes dropped EXE
PID:2760 -
\??\c:\xxlrxxf.exec:\xxlrxxf.exe45⤵
- Executes dropped EXE
PID:2668 -
\??\c:\djjdd.exec:\djjdd.exe46⤵
- Executes dropped EXE
PID:2780 -
\??\c:\xrrlxlx.exec:\xrrlxlx.exe47⤵
- Executes dropped EXE
PID:2872 -
\??\c:\k82802.exec:\k82802.exe48⤵
- Executes dropped EXE
PID:2552 -
\??\c:\xrffrxl.exec:\xrffrxl.exe49⤵
- Executes dropped EXE
PID:2600 -
\??\c:\1nnthn.exec:\1nnthn.exe50⤵
- Executes dropped EXE
PID:2580 -
\??\c:\882028.exec:\882028.exe51⤵
- Executes dropped EXE
PID:2544 -
\??\c:\4404242.exec:\4404242.exe52⤵
- Executes dropped EXE
PID:2732 -
\??\c:\rxrfffx.exec:\rxrfffx.exe53⤵
- Executes dropped EXE
PID:2036 -
\??\c:\nhtthb.exec:\nhtthb.exe54⤵
- Executes dropped EXE
PID:2004 -
\??\c:\04280.exec:\04280.exe55⤵
- Executes dropped EXE
PID:1852 -
\??\c:\rxrxlrr.exec:\rxrxlrr.exe56⤵
- Executes dropped EXE
PID:1572 -
\??\c:\pjddj.exec:\pjddj.exe57⤵
- Executes dropped EXE
PID:2800 -
\??\c:\hbbbbt.exec:\hbbbbt.exe58⤵
- Executes dropped EXE
PID:2672 -
\??\c:\ppvpd.exec:\ppvpd.exe59⤵
- Executes dropped EXE
PID:1708 -
\??\c:\008262.exec:\008262.exe60⤵
- Executes dropped EXE
PID:1776 -
\??\c:\48246.exec:\48246.exe61⤵
- Executes dropped EXE
PID:2064 -
\??\c:\048406.exec:\048406.exe62⤵
- Executes dropped EXE
PID:2104 -
\??\c:\04282.exec:\04282.exe63⤵
- Executes dropped EXE
PID:2912 -
\??\c:\7tnbnt.exec:\7tnbnt.exe64⤵
- Executes dropped EXE
PID:2124 -
\??\c:\48006.exec:\48006.exe65⤵
- Executes dropped EXE
PID:848 -
\??\c:\086624.exec:\086624.exe66⤵PID:1132
-
\??\c:\228620.exec:\228620.exe67⤵PID:1488
-
\??\c:\jvppd.exec:\jvppd.exe68⤵PID:3024
-
\??\c:\lflrlxl.exec:\lflrlxl.exe69⤵PID:1664
-
\??\c:\0044862.exec:\0044862.exe70⤵PID:1672
-
\??\c:\00806.exec:\00806.exe71⤵PID:1448
-
\??\c:\rfxfrrx.exec:\rfxfrrx.exe72⤵PID:2608
-
\??\c:\0488446.exec:\0488446.exe73⤵PID:2900
-
\??\c:\jjdjp.exec:\jjdjp.exe74⤵PID:1312
-
\??\c:\684404.exec:\684404.exe75⤵PID:1944
-
\??\c:\rfxfrrx.exec:\rfxfrrx.exe76⤵PID:3008
-
\??\c:\fffrlfr.exec:\fffrlfr.exe77⤵PID:1864
-
\??\c:\hbtbbt.exec:\hbtbbt.exe78⤵PID:1356
-
\??\c:\3lrlrrf.exec:\3lrlrrf.exe79⤵PID:564
-
\??\c:\ddpjp.exec:\ddpjp.exe80⤵
- System Location Discovery: System Language Discovery
PID:1240 -
\??\c:\5dvpp.exec:\5dvpp.exe81⤵PID:1444
-
\??\c:\264806.exec:\264806.exe82⤵PID:1192
-
\??\c:\vvvvd.exec:\vvvvd.exe83⤵PID:2336
-
\??\c:\8220864.exec:\8220864.exe84⤵PID:2040
-
\??\c:\bnbttn.exec:\bnbttn.exe85⤵PID:2408
-
\??\c:\0080880.exec:\0080880.exe86⤵PID:2096
-
\??\c:\826028.exec:\826028.exe87⤵PID:236
-
\??\c:\dvdjp.exec:\dvdjp.exe88⤵PID:2780
-
\??\c:\bbttht.exec:\bbttht.exe89⤵PID:2836
-
\??\c:\u602060.exec:\u602060.exe90⤵PID:2676
-
\??\c:\nnnbbh.exec:\nnnbbh.exe91⤵PID:2588
-
\??\c:\7flxflx.exec:\7flxflx.exe92⤵PID:2824
-
\??\c:\0402064.exec:\0402064.exe93⤵PID:1304
-
\??\c:\826228.exec:\826228.exe94⤵PID:1684
-
\??\c:\hhbhht.exec:\hhbhht.exe95⤵PID:2012
-
\??\c:\9nnntb.exec:\9nnntb.exe96⤵PID:2420
-
\??\c:\llrfrxl.exec:\llrfrxl.exe97⤵PID:1520
-
\??\c:\tthbbb.exec:\tthbbb.exe98⤵PID:2784
-
\??\c:\vjvvd.exec:\vjvvd.exe99⤵PID:2320
-
\??\c:\40068.exec:\40068.exe100⤵PID:1064
-
\??\c:\jdpjp.exec:\jdpjp.exe101⤵PID:2036
-
\??\c:\lxflfff.exec:\lxflfff.exe102⤵PID:844
-
\??\c:\jvdpd.exec:\jvdpd.exe103⤵PID:2004
-
\??\c:\xxrfrfr.exec:\xxrfrfr.exe104⤵PID:2128
-
\??\c:\88208.exec:\88208.exe105⤵PID:1572
-
\??\c:\vdjjj.exec:\vdjjj.exe106⤵PID:1208
-
\??\c:\hbbntb.exec:\hbbntb.exe107⤵PID:1052
-
\??\c:\w02462.exec:\w02462.exe108⤵PID:3040
-
\??\c:\26062.exec:\26062.exe109⤵PID:1640
-
\??\c:\ffxxllx.exec:\ffxxllx.exe110⤵PID:1648
-
\??\c:\2804248.exec:\2804248.exe111⤵PID:2104
-
\??\c:\480626.exec:\480626.exe112⤵PID:2108
-
\??\c:\5lxfrrx.exec:\5lxfrrx.exe113⤵PID:2152
-
\??\c:\820620.exec:\820620.exe114⤵PID:3048
-
\??\c:\06602.exec:\06602.exe115⤵PID:1020
-
\??\c:\06688.exec:\06688.exe116⤵PID:1880
-
\??\c:\fxlrxff.exec:\fxlrxff.exe117⤵PID:1548
-
\??\c:\48626.exec:\48626.exe118⤵PID:1784
-
\??\c:\xrflrxf.exec:\xrflrxf.exe119⤵PID:1672
-
\??\c:\lrfxxxx.exec:\lrfxxxx.exe120⤵PID:1712
-
\??\c:\m4446.exec:\m4446.exe121⤵PID:2608
-
\??\c:\xxrxflf.exec:\xxrxflf.exe122⤵PID:544
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-