Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
23-11-2024 04:00
Behavioral task
behavioral1
Sample
414544bf9d6d4f8f475e6209f028fee379caa1752659ce5996d521a50119a51d.exe
Resource
win7-20241023-en
General
-
Target
414544bf9d6d4f8f475e6209f028fee379caa1752659ce5996d521a50119a51d.exe
-
Size
88KB
-
MD5
b335a746c82b1ce3728cab35dc3b1e64
-
SHA1
a8091ef3d90b56035109605127d618063f88afdf
-
SHA256
414544bf9d6d4f8f475e6209f028fee379caa1752659ce5996d521a50119a51d
-
SHA512
357c1783a91ebc7cafe5188dafa5888f4bbc9c7c406c30484aee71e046acfd3ab2a7e651c2276b33c14cd6bcb8f8f731be6b1a6321287af6e930ffb1b153855b
-
SSDEEP
1536:9vQBeOGtrYS3srx93UBWfwC6Ggnouy8yaVskCzYBbKd+XsWgADf1tE7hW1AI:9hOmTsF93UYfwC6GIoutyaVszyKd+XYE
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 59 IoCs
Processes:
resource yara_rule behavioral1/memory/2360-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2520-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2080-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2520-27-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2172-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1984-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2896-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2324-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2796-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2744-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/920-117-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/920-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2984-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1528-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1704-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3060-155-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1344-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2192-182-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2192-179-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2312-199-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1020-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2576-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2500-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2500-258-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/304-267-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2540-284-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2500-286-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2916-328-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2820-336-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/2820-335-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/2912-358-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2704-361-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2020-410-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2872-417-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2228-442-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2280-455-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1020-479-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1940-488-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1496-524-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1956-543-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/400-558-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2512-562-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2612-576-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2828-599-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2828-600-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1588-643-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/1844-784-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1272-834-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1700-982-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2160-1002-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/708-1008-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/2028-1023-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2624-1068-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2900-1110-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1936-1136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1636-1262-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1792-1300-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2176-1306-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/1500-1441-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
88842.exec240228.exejdjjv.exe5dpjv.exexrlfffl.exehbnntn.exe04846.exe3nhhhn.exe8624466.exerfxllrr.exe1lflrrx.exevjvdd.exebtntbb.exe64008.exe3ntnhb.exe7vjvv.exe3jdvp.exei604000.exevpvjv.exexxlrfxr.exepdppd.exe6044044.exexrxxxrr.exexrflrlr.exe088888.exe4682228.exetntbhb.exes6406.exe3btbhb.exe880062.exes4426.exeg8006.exe824884.exe3rrflll.exec480606.exerrrxfxx.exe5dddj.exebtbtbb.exettnnnn.exee64060.exe22402.exevpjvd.exe6606264.exefxllrrf.exelfrxxrx.exebntthh.exevpjpp.exexlxrrrr.exe822682.exethhttb.exerflflll.exe2462884.exe6224808.exe7dvpv.exe480622.exe8268406.exefxxlxrr.exedpvdj.exe9tnnnn.exepjpvd.exee40004.exeppjjp.exelllfffl.exe7frxlfx.exepid Process 2080 88842.exe 2520 c240228.exe 2172 jdjjv.exe 1984 5dpjv.exe 2896 xrlfffl.exe 788 hbnntn.exe 2324 04846.exe 2796 3nhhhn.exe 2928 8624466.exe 2768 rfxllrr.exe 2744 1lflrrx.exe 920 vjvdd.exe 2984 btntbb.exe 1528 64008.exe 1704 3ntnhb.exe 3060 7vjvv.exe 1344 3jdvp.exe 1436 i604000.exe 2192 vpvjv.exe 1700 xxlrfxr.exe 2312 pdppd.exe 1020 6044044.exe 2332 xrxxxrr.exe 960 xrflrlr.exe 1036 088888.exe 2576 4682228.exe 2060 tntbhb.exe 2500 s6406.exe 304 3btbhb.exe 884 880062.exe 2540 s4426.exe 580 g8006.exe 1604 824884.exe 1272 3rrflll.exe 2636 c480606.exe 2968 rrrxfxx.exe 2804 5dddj.exe 2916 btbtbb.exe 2820 ttnnnn.exe 788 e64060.exe 2812 22402.exe 2912 vpjvd.exe 2704 6606264.exe 2864 fxllrrf.exe 2136 lfrxxrx.exe 2508 bntthh.exe 1388 vpjpp.exe 2432 xlxrrrr.exe 3040 822682.exe 2020 thhttb.exe 2872 rflflll.exe 1680 2462884.exe 2116 6224808.exe 1344 7dvpv.exe 2228 480622.exe 1912 8268406.exe 2280 fxxlxrr.exe 2320 dpvdj.exe 2448 9tnnnn.exe 444 pjpvd.exe 1020 e40004.exe 2580 ppjjp.exe 1940 lllfffl.exe 1040 7frxlfx.exe -
Processes:
resource yara_rule behavioral1/memory/2360-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000d000000012280-5.dat upx behavioral1/memory/2080-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2360-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000900000001755b-16.dat upx behavioral1/memory/2520-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2080-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000186e7-28.dat upx behavioral1/memory/2172-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2172-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000186f1-38.dat upx behavioral1/files/0x00060000000186f4-45.dat upx behavioral1/memory/1984-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2896-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018704-55.dat upx behavioral1/files/0x0006000000018739-63.dat upx behavioral1/memory/2324-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2324-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018744-74.dat upx behavioral1/files/0x00070000000193c4-82.dat upx behavioral1/memory/2928-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2796-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193df-92.dat upx behavioral1/files/0x0005000000019451-101.dat upx behavioral1/files/0x0005000000019458-109.dat upx behavioral1/memory/2744-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194a9-119.dat upx behavioral1/memory/920-120-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2984-128-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194b9-129.dat upx behavioral1/files/0x00050000000194c9-137.dat upx behavioral1/memory/1528-136-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194ee-146.dat upx behavioral1/memory/1704-145-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194f1-153.dat upx behavioral1/memory/3060-155-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019502-164.dat upx behavioral1/memory/1344-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019509-171.dat upx behavioral1/memory/2192-182-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001950e-181.dat upx behavioral1/files/0x0005000000019512-189.dat upx behavioral1/files/0x000500000001957e-198.dat upx behavioral1/memory/2312-199-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1020-208-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001958e-207.dat upx behavioral1/files/0x00050000000195ab-216.dat upx behavioral1/files/0x00050000000195f0-224.dat upx behavioral1/files/0x0005000000019621-232.dat upx behavioral1/memory/2576-240-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019623-241.dat upx behavioral1/files/0x0005000000019624-249.dat upx behavioral1/memory/2500-257-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019625-259.dat upx behavioral1/memory/304-267-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019627-268.dat upx behavioral1/files/0x0005000000019629-276.dat upx behavioral1/memory/2540-284-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001962b-285.dat upx behavioral1/memory/1604-294-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2820-335-0x0000000000430000-0x0000000000457000-memory.dmp upx behavioral1/memory/2812-346-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2704-361-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2020-410-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
088888.exe628448.exevpjvd.exe26062.exe0046002.exexrllxfr.exee68882.exee40004.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 088888.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 628448.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26062.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0046002.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrllxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e68882.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e40004.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
414544bf9d6d4f8f475e6209f028fee379caa1752659ce5996d521a50119a51d.exe88842.exec240228.exejdjjv.exe5dpjv.exexrlfffl.exehbnntn.exe04846.exe3nhhhn.exe8624466.exerfxllrr.exe1lflrrx.exevjvdd.exebtntbb.exe64008.exe3ntnhb.exedescription pid Process procid_target PID 2360 wrote to memory of 2080 2360 414544bf9d6d4f8f475e6209f028fee379caa1752659ce5996d521a50119a51d.exe 31 PID 2360 wrote to memory of 2080 2360 414544bf9d6d4f8f475e6209f028fee379caa1752659ce5996d521a50119a51d.exe 31 PID 2360 wrote to memory of 2080 2360 414544bf9d6d4f8f475e6209f028fee379caa1752659ce5996d521a50119a51d.exe 31 PID 2360 wrote to memory of 2080 2360 414544bf9d6d4f8f475e6209f028fee379caa1752659ce5996d521a50119a51d.exe 31 PID 2080 wrote to memory of 2520 2080 88842.exe 32 PID 2080 wrote to memory of 2520 2080 88842.exe 32 PID 2080 wrote to memory of 2520 2080 88842.exe 32 PID 2080 wrote to memory of 2520 2080 88842.exe 32 PID 2520 wrote to memory of 2172 2520 c240228.exe 33 PID 2520 wrote to memory of 2172 2520 c240228.exe 33 PID 2520 wrote to memory of 2172 2520 c240228.exe 33 PID 2520 wrote to memory of 2172 2520 c240228.exe 33 PID 2172 wrote to memory of 1984 2172 jdjjv.exe 34 PID 2172 wrote to memory of 1984 2172 jdjjv.exe 34 PID 2172 wrote to memory of 1984 2172 jdjjv.exe 34 PID 2172 wrote to memory of 1984 2172 jdjjv.exe 34 PID 1984 wrote to memory of 2896 1984 5dpjv.exe 35 PID 1984 wrote to memory of 2896 1984 5dpjv.exe 35 PID 1984 wrote to memory of 2896 1984 5dpjv.exe 35 PID 1984 wrote to memory of 2896 1984 5dpjv.exe 35 PID 2896 wrote to memory of 788 2896 xrlfffl.exe 36 PID 2896 wrote to memory of 788 2896 xrlfffl.exe 36 PID 2896 wrote to memory of 788 2896 xrlfffl.exe 36 PID 2896 wrote to memory of 788 2896 xrlfffl.exe 36 PID 788 wrote to memory of 2324 788 hbnntn.exe 37 PID 788 wrote to memory of 2324 788 hbnntn.exe 37 PID 788 wrote to memory of 2324 788 hbnntn.exe 37 PID 788 wrote to memory of 2324 788 hbnntn.exe 37 PID 2324 wrote to memory of 2796 2324 04846.exe 38 PID 2324 wrote to memory of 2796 2324 04846.exe 38 PID 2324 wrote to memory of 2796 2324 04846.exe 38 PID 2324 wrote to memory of 2796 2324 04846.exe 38 PID 2796 wrote to memory of 2928 2796 3nhhhn.exe 39 PID 2796 wrote to memory of 2928 2796 3nhhhn.exe 39 PID 2796 wrote to memory of 2928 2796 3nhhhn.exe 39 PID 2796 wrote to memory of 2928 2796 3nhhhn.exe 39 PID 2928 wrote to memory of 2768 2928 8624466.exe 40 PID 2928 wrote to memory of 2768 2928 8624466.exe 40 PID 2928 wrote to memory of 2768 2928 8624466.exe 40 PID 2928 wrote to memory of 2768 2928 8624466.exe 40 PID 2768 wrote to memory of 2744 2768 rfxllrr.exe 41 PID 2768 wrote to memory of 2744 2768 rfxllrr.exe 41 PID 2768 wrote to memory of 2744 2768 rfxllrr.exe 41 PID 2768 wrote to memory of 2744 2768 rfxllrr.exe 41 PID 2744 wrote to memory of 920 2744 1lflrrx.exe 42 PID 2744 wrote to memory of 920 2744 1lflrrx.exe 42 PID 2744 wrote to memory of 920 2744 1lflrrx.exe 42 PID 2744 wrote to memory of 920 2744 1lflrrx.exe 42 PID 920 wrote to memory of 2984 920 vjvdd.exe 43 PID 920 wrote to memory of 2984 920 vjvdd.exe 43 PID 920 wrote to memory of 2984 920 vjvdd.exe 43 PID 920 wrote to memory of 2984 920 vjvdd.exe 43 PID 2984 wrote to memory of 1528 2984 btntbb.exe 44 PID 2984 wrote to memory of 1528 2984 btntbb.exe 44 PID 2984 wrote to memory of 1528 2984 btntbb.exe 44 PID 2984 wrote to memory of 1528 2984 btntbb.exe 44 PID 1528 wrote to memory of 1704 1528 64008.exe 45 PID 1528 wrote to memory of 1704 1528 64008.exe 45 PID 1528 wrote to memory of 1704 1528 64008.exe 45 PID 1528 wrote to memory of 1704 1528 64008.exe 45 PID 1704 wrote to memory of 3060 1704 3ntnhb.exe 46 PID 1704 wrote to memory of 3060 1704 3ntnhb.exe 46 PID 1704 wrote to memory of 3060 1704 3ntnhb.exe 46 PID 1704 wrote to memory of 3060 1704 3ntnhb.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\414544bf9d6d4f8f475e6209f028fee379caa1752659ce5996d521a50119a51d.exe"C:\Users\Admin\AppData\Local\Temp\414544bf9d6d4f8f475e6209f028fee379caa1752659ce5996d521a50119a51d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\88842.exec:\88842.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\c240228.exec:\c240228.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\jdjjv.exec:\jdjjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\5dpjv.exec:\5dpjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\xrlfffl.exec:\xrlfffl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\hbnntn.exec:\hbnntn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:788 -
\??\c:\04846.exec:\04846.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\3nhhhn.exec:\3nhhhn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\8624466.exec:\8624466.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\rfxllrr.exec:\rfxllrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\1lflrrx.exec:\1lflrrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\vjvdd.exec:\vjvdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
\??\c:\btntbb.exec:\btntbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\64008.exec:\64008.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\3ntnhb.exec:\3ntnhb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\7vjvv.exec:\7vjvv.exe17⤵
- Executes dropped EXE
PID:3060 -
\??\c:\3jdvp.exec:\3jdvp.exe18⤵
- Executes dropped EXE
PID:1344 -
\??\c:\i604000.exec:\i604000.exe19⤵
- Executes dropped EXE
PID:1436 -
\??\c:\vpvjv.exec:\vpvjv.exe20⤵
- Executes dropped EXE
PID:2192 -
\??\c:\xxlrfxr.exec:\xxlrfxr.exe21⤵
- Executes dropped EXE
PID:1700 -
\??\c:\pdppd.exec:\pdppd.exe22⤵
- Executes dropped EXE
PID:2312 -
\??\c:\6044044.exec:\6044044.exe23⤵
- Executes dropped EXE
PID:1020 -
\??\c:\xrxxxrr.exec:\xrxxxrr.exe24⤵
- Executes dropped EXE
PID:2332 -
\??\c:\xrflrlr.exec:\xrflrlr.exe25⤵
- Executes dropped EXE
PID:960 -
\??\c:\088888.exec:\088888.exe26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1036 -
\??\c:\4682228.exec:\4682228.exe27⤵
- Executes dropped EXE
PID:2576 -
\??\c:\tntbhb.exec:\tntbhb.exe28⤵
- Executes dropped EXE
PID:2060 -
\??\c:\s6406.exec:\s6406.exe29⤵
- Executes dropped EXE
PID:2500 -
\??\c:\3btbhb.exec:\3btbhb.exe30⤵
- Executes dropped EXE
PID:304 -
\??\c:\880062.exec:\880062.exe31⤵
- Executes dropped EXE
PID:884 -
\??\c:\s4426.exec:\s4426.exe32⤵
- Executes dropped EXE
PID:2540 -
\??\c:\g8006.exec:\g8006.exe33⤵
- Executes dropped EXE
PID:580 -
\??\c:\824884.exec:\824884.exe34⤵
- Executes dropped EXE
PID:1604 -
\??\c:\3rrflll.exec:\3rrflll.exe35⤵
- Executes dropped EXE
PID:1272 -
\??\c:\c480606.exec:\c480606.exe36⤵
- Executes dropped EXE
PID:2636 -
\??\c:\rrrxfxx.exec:\rrrxfxx.exe37⤵
- Executes dropped EXE
PID:2968 -
\??\c:\5dddj.exec:\5dddj.exe38⤵
- Executes dropped EXE
PID:2804 -
\??\c:\btbtbb.exec:\btbtbb.exe39⤵
- Executes dropped EXE
PID:2916 -
\??\c:\ttnnnn.exec:\ttnnnn.exe40⤵
- Executes dropped EXE
PID:2820 -
\??\c:\e64060.exec:\e64060.exe41⤵
- Executes dropped EXE
PID:788 -
\??\c:\22402.exec:\22402.exe42⤵
- Executes dropped EXE
PID:2812 -
\??\c:\vpjvd.exec:\vpjvd.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2912 -
\??\c:\6606264.exec:\6606264.exe44⤵
- Executes dropped EXE
PID:2704 -
\??\c:\fxllrrf.exec:\fxllrrf.exe45⤵
- Executes dropped EXE
PID:2864 -
\??\c:\lfrxxrx.exec:\lfrxxrx.exe46⤵
- Executes dropped EXE
PID:2136 -
\??\c:\bntthh.exec:\bntthh.exe47⤵
- Executes dropped EXE
PID:2508 -
\??\c:\vpjpp.exec:\vpjpp.exe48⤵
- Executes dropped EXE
PID:1388 -
\??\c:\xlxrrrr.exec:\xlxrrrr.exe49⤵
- Executes dropped EXE
PID:2432 -
\??\c:\822682.exec:\822682.exe50⤵
- Executes dropped EXE
PID:3040 -
\??\c:\thhttb.exec:\thhttb.exe51⤵
- Executes dropped EXE
PID:2020 -
\??\c:\rflflll.exec:\rflflll.exe52⤵
- Executes dropped EXE
PID:2872 -
\??\c:\2462884.exec:\2462884.exe53⤵
- Executes dropped EXE
PID:1680 -
\??\c:\6224808.exec:\6224808.exe54⤵
- Executes dropped EXE
PID:2116 -
\??\c:\7dvpv.exec:\7dvpv.exe55⤵
- Executes dropped EXE
PID:1344 -
\??\c:\480622.exec:\480622.exe56⤵
- Executes dropped EXE
PID:2228 -
\??\c:\8268406.exec:\8268406.exe57⤵
- Executes dropped EXE
PID:1912 -
\??\c:\fxxlxrr.exec:\fxxlxrr.exe58⤵
- Executes dropped EXE
PID:2280 -
\??\c:\dpvdj.exec:\dpvdj.exe59⤵
- Executes dropped EXE
PID:2320 -
\??\c:\9tnnnn.exec:\9tnnnn.exe60⤵
- Executes dropped EXE
PID:2448 -
\??\c:\pjpvd.exec:\pjpvd.exe61⤵
- Executes dropped EXE
PID:444 -
\??\c:\e40004.exec:\e40004.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1020 -
\??\c:\ppjjp.exec:\ppjjp.exe63⤵
- Executes dropped EXE
PID:2580 -
\??\c:\lllfffl.exec:\lllfffl.exe64⤵
- Executes dropped EXE
PID:1940 -
\??\c:\7frxlfx.exec:\7frxlfx.exe65⤵
- Executes dropped EXE
PID:1040 -
\??\c:\pjvjv.exec:\pjvjv.exe66⤵PID:820
-
\??\c:\tnbbtt.exec:\tnbbtt.exe67⤵PID:1560
-
\??\c:\ttnhth.exec:\ttnhth.exe68⤵PID:2064
-
\??\c:\bnhhbh.exec:\bnhhbh.exe69⤵PID:1496
-
\??\c:\226800.exec:\226800.exe70⤵PID:1012
-
\??\c:\nhntbb.exec:\nhntbb.exe71⤵PID:572
-
\??\c:\82624.exec:\82624.exe72⤵PID:1956
-
\??\c:\fxrfllr.exec:\fxrfllr.exe73⤵PID:2000
-
\??\c:\2640224.exec:\2640224.exe74⤵PID:320
-
\??\c:\3tbbnn.exec:\3tbbnn.exe75⤵PID:400
-
\??\c:\7thnbt.exec:\7thnbt.exe76⤵PID:2512
-
\??\c:\82402.exec:\82402.exe77⤵PID:1908
-
\??\c:\vvppd.exec:\vvppd.exe78⤵PID:2612
-
\??\c:\2208686.exec:\2208686.exe79⤵PID:2152
-
\??\c:\2088442.exec:\2088442.exe80⤵PID:2800
-
\??\c:\nnbhnn.exec:\nnbhnn.exe81⤵PID:2828
-
\??\c:\5bttth.exec:\5bttth.exe82⤵PID:2840
-
\??\c:\3pdjv.exec:\3pdjv.exe83⤵PID:780
-
\??\c:\w66048.exec:\w66048.exe84⤵PID:2720
-
\??\c:\rfrrxrf.exec:\rfrrxrf.exe85⤵PID:2860
-
\??\c:\00808.exec:\00808.exe86⤵PID:2924
-
\??\c:\26402.exec:\26402.exe87⤵PID:2340
-
\??\c:\c862468.exec:\c862468.exe88⤵PID:1588
-
\??\c:\60680.exec:\60680.exe89⤵PID:2456
-
\??\c:\u048406.exec:\u048406.exe90⤵PID:2680
-
\??\c:\26646.exec:\26646.exe91⤵PID:3052
-
\??\c:\jjjpj.exec:\jjjpj.exe92⤵PID:2992
-
\??\c:\1btbhn.exec:\1btbhn.exe93⤵PID:908
-
\??\c:\82062.exec:\82062.exe94⤵PID:1440
-
\??\c:\a8402.exec:\a8402.exe95⤵PID:3028
-
\??\c:\i246400.exec:\i246400.exe96⤵PID:1680
-
\??\c:\2880028.exec:\2880028.exe97⤵PID:2116
-
\??\c:\o868446.exec:\o868446.exe98⤵PID:1344
-
\??\c:\lrrllrx.exec:\lrrllrx.exe99⤵PID:1296
-
\??\c:\jppdj.exec:\jppdj.exe100⤵PID:1912
-
\??\c:\llrxrfr.exec:\llrxrfr.exe101⤵PID:2192
-
\??\c:\c088068.exec:\c088068.exe102⤵PID:1072
-
\??\c:\280802.exec:\280802.exe103⤵PID:640
-
\??\c:\u428006.exec:\u428006.exe104⤵PID:864
-
\??\c:\c684666.exec:\c684666.exe105⤵PID:1692
-
\??\c:\rlfflll.exec:\rlfflll.exe106⤵PID:2580
-
\??\c:\i640622.exec:\i640622.exe107⤵PID:1940
-
\??\c:\dvpjp.exec:\dvpjp.exe108⤵PID:1820
-
\??\c:\o040288.exec:\o040288.exe109⤵PID:888
-
\??\c:\llrxxrx.exec:\llrxxrx.exe110⤵PID:2776
-
\??\c:\ffxfxxx.exec:\ffxfxxx.exe111⤵PID:1844
-
\??\c:\nhbhnn.exec:\nhbhnn.exe112⤵PID:1612
-
\??\c:\thttbh.exec:\thttbh.exe113⤵PID:1012
-
\??\c:\4244068.exec:\4244068.exe114⤵PID:2400
-
\??\c:\9fxrrrf.exec:\9fxrrrf.exe115⤵PID:1956
-
\??\c:\00802.exec:\00802.exe116⤵PID:2596
-
\??\c:\tnbtnt.exec:\tnbtnt.exe117⤵PID:1512
-
\??\c:\jpjjj.exec:\jpjjj.exe118⤵PID:1608
-
\??\c:\dpvvv.exec:\dpvvv.exe119⤵PID:1272
-
\??\c:\1nbhtt.exec:\1nbhtt.exe120⤵PID:1908
-
\??\c:\a8880.exec:\a8880.exe121⤵PID:2440
-
\??\c:\nhbbnh.exec:\nhbbnh.exe122⤵PID:2152
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-