Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-11-2024 16:08
Behavioral task
behavioral1
Sample
d6daa0ae8a42440d9ad2a1daff2f2f296aca817e0a6e11f341af7b5a0017595a.exe
Resource
win7-20240903-en
General
-
Target
d6daa0ae8a42440d9ad2a1daff2f2f296aca817e0a6e11f341af7b5a0017595a.exe
-
Size
78KB
-
MD5
36fe4429aa9fe723066f85d27d8134f9
-
SHA1
118a2801451743b606ea3addc5a81a70bc34e7cc
-
SHA256
d6daa0ae8a42440d9ad2a1daff2f2f296aca817e0a6e11f341af7b5a0017595a
-
SHA512
dfb518201b9e7c2caa108ced5641eeb85d44ce0458e0b3596fc6b02f8104da88f5fafc8bfe0105547a323665e962621a5814932c2edd53426dff4e19d15eca1d
-
SSDEEP
1536:xvQBeOGtrYS3srx93UBWfwC6Ggnouy82F13w1rCJtzx8/p7kew:xhOmTsF93UYfwC6GIout03LzGFw
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 55 IoCs
Processes:
resource yara_rule behavioral1/memory/2960-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2132-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2852-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2496-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1592-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1128-55-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2924-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1128-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2920-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2880-92-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2636-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2644-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1356-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1356-124-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1480-135-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1996-147-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2016-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2404-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1412-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2208-210-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2208-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2860-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2860-220-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1536-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2188-264-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2416-306-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1556-315-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1556-322-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/472-335-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/264-342-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2628-387-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2636-394-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2636-401-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/1972-414-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1944-427-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1608-454-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2668-496-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2444-503-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1600-522-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1600-524-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1048-550-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2228-557-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2292-585-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2292-584-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/1584-598-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1556-605-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2692-625-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2732-631-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2816-645-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/3012-690-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2576-688-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1288-770-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2184-846-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2184-845-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2988-871-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
rxxxflx.exenbnhnh.exeffxlrxr.exe9htthb.exennhbbh.exevpppd.exexrlflrf.exellfrxlr.exebbbntn.exe1ddjv.exerlflrrf.exenhttbh.exettntbb.exe5xxlrrr.exelxrxxxx.exe7vjjv.exelrrxlxl.exeffrfxfx.exetnbntn.exeppppv.exe3rllrrf.exelrllllf.exettnntt.exejjjdv.exefrlfxfr.exellrfflf.exetnhntb.exejdjpp.exepjdjj.exefrxlffl.exebbnbnn.exevdvjd.exejdvdj.exelfxfffx.exe9xflflx.exetnbhnt.exevvjjp.exedvpvv.exexrrfrfr.exexrlrxfx.exe3hhnbb.exeddjvd.exedjvvd.exelfrrxxr.exexrfxrfr.exe3tnbhh.exeddvdj.exefffxxlf.exefxflrxl.exenhthnt.exejdvdj.exepppvv.exe5ffxlrf.exellfxlfl.exebbbhbn.exetbnthh.exevpppd.exe9ppjp.exexxxlxlr.exe9nhntn.exe1tthbh.exe1ppjp.exe9xrxlrf.exerlllrxx.exepid Process 2132 rxxxflx.exe 2852 nbnhnh.exe 2496 ffxlrxr.exe 1592 9htthb.exe 1128 nnhbbh.exe 2776 vpppd.exe 2924 xrlflrf.exe 2920 llfrxlr.exe 2880 bbbntn.exe 2636 1ddjv.exe 2644 rlflrrf.exe 1356 nhttbh.exe 1480 ttntbb.exe 1996 5xxlrrr.exe 2016 lxrxxxx.exe 2404 7vjjv.exe 1072 lrrxlxl.exe 1412 ffrfxfx.exe 544 tnbntn.exe 2876 ppppv.exe 2208 3rllrrf.exe 2860 lrllllf.exe 1136 ttnntt.exe 1536 jjjdv.exe 1180 frlfxfr.exe 552 llrfflf.exe 2188 tnhntb.exe 868 jdjpp.exe 1628 pjdjj.exe 2356 frxlffl.exe 2492 bbnbnn.exe 2416 vdvjd.exe 2004 jdvdj.exe 1556 lfxfffx.exe 3032 9xflflx.exe 472 tnbhnt.exe 264 vvjjp.exe 764 dvpvv.exe 1128 xrrfrfr.exe 2740 xrlrxfx.exe 2252 3hhnbb.exe 2872 ddjvd.exe 2920 djvvd.exe 2628 lfrrxxr.exe 2624 xrfxrfr.exe 2636 3tnbhh.exe 3008 ddvdj.exe 1972 fffxxlf.exe 1356 fxflrxl.exe 1944 nhthnt.exe 1512 jdvdj.exe 1668 pppvv.exe 1712 5ffxlrf.exe 1608 llfxlfl.exe 840 bbbhbn.exe 1424 tbnthh.exe 1412 vpppd.exe 2620 9ppjp.exe 2428 xxxlxlr.exe 2668 9nhntn.exe 2444 1tthbh.exe 2860 1ppjp.exe 900 9xrxlrf.exe 1600 rlllrxx.exe -
Processes:
resource yara_rule behavioral1/memory/2960-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000012117-5.dat upx behavioral1/memory/2960-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2132-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016855-19.dat upx behavioral1/memory/2132-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016c62-27.dat upx behavioral1/memory/2852-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016c84-36.dat upx behavioral1/memory/1592-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2496-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1592-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016cd1-45.dat upx behavioral1/memory/1128-55-0x00000000001B0000-0x00000000001D7000-memory.dmp upx behavioral1/files/0x0007000000016cfc-59.dat upx behavioral1/memory/2776-58-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000016d25-66.dat upx behavioral1/memory/2924-69-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1128-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2920-78-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d36-76.dat upx behavioral1/files/0x00060000000173fc-85.dat upx behavioral1/files/0x0006000000017472-95.dat upx behavioral1/memory/2880-92-0x00000000001B0000-0x00000000001D7000-memory.dmp upx behavioral1/memory/2636-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017487-104.dat upx behavioral1/memory/2636-103-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x00060000000174a2-113.dat upx behavioral1/memory/1356-115-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2644-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1356-126-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017525-125.dat upx behavioral1/files/0x0014000000018663-134.dat upx behavioral1/memory/1996-136-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1480-135-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1996-140-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/1996-147-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000d00000001866e-146.dat upx behavioral1/memory/2016-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018687-155.dat upx behavioral1/memory/2404-164-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018792-165.dat upx behavioral1/files/0x0006000000018c1a-173.dat upx behavioral1/memory/1412-174-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1412-185-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018c26-184.dat upx behavioral1/files/0x0006000000018f53-193.dat upx behavioral1/files/0x000600000001903b-202.dat upx behavioral1/memory/2876-201-0x0000000000260000-0x0000000000287000-memory.dmp upx behavioral1/files/0x00060000000190ce-213.dat upx behavioral1/memory/2208-212-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2860-222-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000190e0-221.dat upx behavioral1/memory/1136-230-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x00050000000191d4-232.dat upx behavioral1/files/0x00050000000191ff-240.dat upx behavioral1/memory/1536-239-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019244-256.dat upx behavioral1/files/0x000500000001922c-249.dat upx behavioral1/memory/2188-264-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019256-266.dat upx behavioral1/files/0x00090000000164c8-273.dat upx behavioral1/files/0x0005000000019259-282.dat upx behavioral1/files/0x0005000000019263-290.dat upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
dvpdp.exe1vppp.exevvpjp.exennbnbh.exerlxlrxl.exe3xrflxl.exefxrrxxl.exepdvdj.exepjdjp.exehhttbn.exe3lfflxf.exetnttbh.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxlrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xrflxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhttbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lfflxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnttbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d6daa0ae8a42440d9ad2a1daff2f2f296aca817e0a6e11f341af7b5a0017595a.exerxxxflx.exenbnhnh.exeffxlrxr.exe9htthb.exennhbbh.exevpppd.exexrlflrf.exellfrxlr.exebbbntn.exe1ddjv.exerlflrrf.exenhttbh.exettntbb.exe5xxlrrr.exelxrxxxx.exedescription pid Process procid_target PID 2960 wrote to memory of 2132 2960 d6daa0ae8a42440d9ad2a1daff2f2f296aca817e0a6e11f341af7b5a0017595a.exe 30 PID 2960 wrote to memory of 2132 2960 d6daa0ae8a42440d9ad2a1daff2f2f296aca817e0a6e11f341af7b5a0017595a.exe 30 PID 2960 wrote to memory of 2132 2960 d6daa0ae8a42440d9ad2a1daff2f2f296aca817e0a6e11f341af7b5a0017595a.exe 30 PID 2960 wrote to memory of 2132 2960 d6daa0ae8a42440d9ad2a1daff2f2f296aca817e0a6e11f341af7b5a0017595a.exe 30 PID 2132 wrote to memory of 2852 2132 rxxxflx.exe 31 PID 2132 wrote to memory of 2852 2132 rxxxflx.exe 31 PID 2132 wrote to memory of 2852 2132 rxxxflx.exe 31 PID 2132 wrote to memory of 2852 2132 rxxxflx.exe 31 PID 2852 wrote to memory of 2496 2852 nbnhnh.exe 32 PID 2852 wrote to memory of 2496 2852 nbnhnh.exe 32 PID 2852 wrote to memory of 2496 2852 nbnhnh.exe 32 PID 2852 wrote to memory of 2496 2852 nbnhnh.exe 32 PID 2496 wrote to memory of 1592 2496 ffxlrxr.exe 33 PID 2496 wrote to memory of 1592 2496 ffxlrxr.exe 33 PID 2496 wrote to memory of 1592 2496 ffxlrxr.exe 33 PID 2496 wrote to memory of 1592 2496 ffxlrxr.exe 33 PID 1592 wrote to memory of 1128 1592 9htthb.exe 34 PID 1592 wrote to memory of 1128 1592 9htthb.exe 34 PID 1592 wrote to memory of 1128 1592 9htthb.exe 34 PID 1592 wrote to memory of 1128 1592 9htthb.exe 34 PID 1128 wrote to memory of 2776 1128 nnhbbh.exe 35 PID 1128 wrote to memory of 2776 1128 nnhbbh.exe 35 PID 1128 wrote to memory of 2776 1128 nnhbbh.exe 35 PID 1128 wrote to memory of 2776 1128 nnhbbh.exe 35 PID 2776 wrote to memory of 2924 2776 vpppd.exe 36 PID 2776 wrote to memory of 2924 2776 vpppd.exe 36 PID 2776 wrote to memory of 2924 2776 vpppd.exe 36 PID 2776 wrote to memory of 2924 2776 vpppd.exe 36 PID 2924 wrote to memory of 2920 2924 xrlflrf.exe 37 PID 2924 wrote to memory of 2920 2924 xrlflrf.exe 37 PID 2924 wrote to memory of 2920 2924 xrlflrf.exe 37 PID 2924 wrote to memory of 2920 2924 xrlflrf.exe 37 PID 2920 wrote to memory of 2880 2920 llfrxlr.exe 38 PID 2920 wrote to memory of 2880 2920 llfrxlr.exe 38 PID 2920 wrote to memory of 2880 2920 llfrxlr.exe 38 PID 2920 wrote to memory of 2880 2920 llfrxlr.exe 38 PID 2880 wrote to memory of 2636 2880 bbbntn.exe 39 PID 2880 wrote to memory of 2636 2880 bbbntn.exe 39 PID 2880 wrote to memory of 2636 2880 bbbntn.exe 39 PID 2880 wrote to memory of 2636 2880 bbbntn.exe 39 PID 2636 wrote to memory of 2644 2636 1ddjv.exe 40 PID 2636 wrote to memory of 2644 2636 1ddjv.exe 40 PID 2636 wrote to memory of 2644 2636 1ddjv.exe 40 PID 2636 wrote to memory of 2644 2636 1ddjv.exe 40 PID 2644 wrote to memory of 1356 2644 rlflrrf.exe 41 PID 2644 wrote to memory of 1356 2644 rlflrrf.exe 41 PID 2644 wrote to memory of 1356 2644 rlflrrf.exe 41 PID 2644 wrote to memory of 1356 2644 rlflrrf.exe 41 PID 1356 wrote to memory of 1480 1356 nhttbh.exe 42 PID 1356 wrote to memory of 1480 1356 nhttbh.exe 42 PID 1356 wrote to memory of 1480 1356 nhttbh.exe 42 PID 1356 wrote to memory of 1480 1356 nhttbh.exe 42 PID 1480 wrote to memory of 1996 1480 ttntbb.exe 43 PID 1480 wrote to memory of 1996 1480 ttntbb.exe 43 PID 1480 wrote to memory of 1996 1480 ttntbb.exe 43 PID 1480 wrote to memory of 1996 1480 ttntbb.exe 43 PID 1996 wrote to memory of 2016 1996 5xxlrrr.exe 44 PID 1996 wrote to memory of 2016 1996 5xxlrrr.exe 44 PID 1996 wrote to memory of 2016 1996 5xxlrrr.exe 44 PID 1996 wrote to memory of 2016 1996 5xxlrrr.exe 44 PID 2016 wrote to memory of 2404 2016 lxrxxxx.exe 45 PID 2016 wrote to memory of 2404 2016 lxrxxxx.exe 45 PID 2016 wrote to memory of 2404 2016 lxrxxxx.exe 45 PID 2016 wrote to memory of 2404 2016 lxrxxxx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\d6daa0ae8a42440d9ad2a1daff2f2f296aca817e0a6e11f341af7b5a0017595a.exe"C:\Users\Admin\AppData\Local\Temp\d6daa0ae8a42440d9ad2a1daff2f2f296aca817e0a6e11f341af7b5a0017595a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\rxxxflx.exec:\rxxxflx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\nbnhnh.exec:\nbnhnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\ffxlrxr.exec:\ffxlrxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\9htthb.exec:\9htthb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
\??\c:\nnhbbh.exec:\nnhbbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
\??\c:\vpppd.exec:\vpppd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\xrlflrf.exec:\xrlflrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\llfrxlr.exec:\llfrxlr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\bbbntn.exec:\bbbntn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\1ddjv.exec:\1ddjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\rlflrrf.exec:\rlflrrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\nhttbh.exec:\nhttbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
\??\c:\ttntbb.exec:\ttntbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
\??\c:\5xxlrrr.exec:\5xxlrrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\lxrxxxx.exec:\lxrxxxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\7vjjv.exec:\7vjjv.exe17⤵
- Executes dropped EXE
PID:2404 -
\??\c:\lrrxlxl.exec:\lrrxlxl.exe18⤵
- Executes dropped EXE
PID:1072 -
\??\c:\ffrfxfx.exec:\ffrfxfx.exe19⤵
- Executes dropped EXE
PID:1412 -
\??\c:\tnbntn.exec:\tnbntn.exe20⤵
- Executes dropped EXE
PID:544 -
\??\c:\ppppv.exec:\ppppv.exe21⤵
- Executes dropped EXE
PID:2876 -
\??\c:\3rllrrf.exec:\3rllrrf.exe22⤵
- Executes dropped EXE
PID:2208 -
\??\c:\lrllllf.exec:\lrllllf.exe23⤵
- Executes dropped EXE
PID:2860 -
\??\c:\ttnntt.exec:\ttnntt.exe24⤵
- Executes dropped EXE
PID:1136 -
\??\c:\jjjdv.exec:\jjjdv.exe25⤵
- Executes dropped EXE
PID:1536 -
\??\c:\frlfxfr.exec:\frlfxfr.exe26⤵
- Executes dropped EXE
PID:1180 -
\??\c:\llrfflf.exec:\llrfflf.exe27⤵
- Executes dropped EXE
PID:552 -
\??\c:\tnhntb.exec:\tnhntb.exe28⤵
- Executes dropped EXE
PID:2188 -
\??\c:\jdjpp.exec:\jdjpp.exe29⤵
- Executes dropped EXE
PID:868 -
\??\c:\pjdjj.exec:\pjdjj.exe30⤵
- Executes dropped EXE
PID:1628 -
\??\c:\frxlffl.exec:\frxlffl.exe31⤵
- Executes dropped EXE
PID:2356 -
\??\c:\bbnbnn.exec:\bbnbnn.exe32⤵
- Executes dropped EXE
PID:2492 -
\??\c:\vdvjd.exec:\vdvjd.exe33⤵
- Executes dropped EXE
PID:2416 -
\??\c:\jdvdj.exec:\jdvdj.exe34⤵
- Executes dropped EXE
PID:2004 -
\??\c:\lfxfffx.exec:\lfxfffx.exe35⤵
- Executes dropped EXE
PID:1556 -
\??\c:\9xflflx.exec:\9xflflx.exe36⤵
- Executes dropped EXE
PID:3032 -
\??\c:\tnbhnt.exec:\tnbhnt.exe37⤵
- Executes dropped EXE
PID:472 -
\??\c:\vvjjp.exec:\vvjjp.exe38⤵
- Executes dropped EXE
PID:264 -
\??\c:\dvpvv.exec:\dvpvv.exe39⤵
- Executes dropped EXE
PID:764 -
\??\c:\xrrfrfr.exec:\xrrfrfr.exe40⤵
- Executes dropped EXE
PID:1128 -
\??\c:\xrlrxfx.exec:\xrlrxfx.exe41⤵
- Executes dropped EXE
PID:2740 -
\??\c:\3hhnbb.exec:\3hhnbb.exe42⤵
- Executes dropped EXE
PID:2252 -
\??\c:\ddjvd.exec:\ddjvd.exe43⤵
- Executes dropped EXE
PID:2872 -
\??\c:\djvvd.exec:\djvvd.exe44⤵
- Executes dropped EXE
PID:2920 -
\??\c:\lfrrxxr.exec:\lfrrxxr.exe45⤵
- Executes dropped EXE
PID:2628 -
\??\c:\xrfxrfr.exec:\xrfxrfr.exe46⤵
- Executes dropped EXE
PID:2624 -
\??\c:\3tnbhh.exec:\3tnbhh.exe47⤵
- Executes dropped EXE
PID:2636 -
\??\c:\ddvdj.exec:\ddvdj.exe48⤵
- Executes dropped EXE
PID:3008 -
\??\c:\fffxxlf.exec:\fffxxlf.exe49⤵
- Executes dropped EXE
PID:1972 -
\??\c:\fxflrxl.exec:\fxflrxl.exe50⤵
- Executes dropped EXE
PID:1356 -
\??\c:\nhthnt.exec:\nhthnt.exe51⤵
- Executes dropped EXE
PID:1944 -
\??\c:\jdvdj.exec:\jdvdj.exe52⤵
- Executes dropped EXE
PID:1512 -
\??\c:\pppvv.exec:\pppvv.exe53⤵
- Executes dropped EXE
PID:1668 -
\??\c:\5ffxlrf.exec:\5ffxlrf.exe54⤵
- Executes dropped EXE
PID:1712 -
\??\c:\llfxlfl.exec:\llfxlfl.exe55⤵
- Executes dropped EXE
PID:1608 -
\??\c:\bbbhbn.exec:\bbbhbn.exe56⤵
- Executes dropped EXE
PID:840 -
\??\c:\tbnthh.exec:\tbnthh.exe57⤵
- Executes dropped EXE
PID:1424 -
\??\c:\vpppd.exec:\vpppd.exe58⤵
- Executes dropped EXE
PID:1412 -
\??\c:\9ppjp.exec:\9ppjp.exe59⤵
- Executes dropped EXE
PID:2620 -
\??\c:\xxxlxlr.exec:\xxxlxlr.exe60⤵
- Executes dropped EXE
PID:2428 -
\??\c:\9nhntn.exec:\9nhntn.exe61⤵
- Executes dropped EXE
PID:2668 -
\??\c:\1tthbh.exec:\1tthbh.exe62⤵
- Executes dropped EXE
PID:2444 -
\??\c:\1ppjp.exec:\1ppjp.exe63⤵
- Executes dropped EXE
PID:2860 -
\??\c:\9xrxlrf.exec:\9xrxlrf.exe64⤵
- Executes dropped EXE
PID:900 -
\??\c:\rlllrxx.exec:\rlllrxx.exe65⤵
- Executes dropped EXE
PID:1600 -
\??\c:\nhttbb.exec:\nhttbb.exe66⤵PID:2284
-
\??\c:\3jjvp.exec:\3jjvp.exe67⤵PID:2228
-
\??\c:\9pdpp.exec:\9pdpp.exe68⤵PID:2340
-
\??\c:\lfxffrx.exec:\lfxffrx.exe69⤵PID:1048
-
\??\c:\7rllrrf.exec:\7rllrrf.exe70⤵PID:1888
-
\??\c:\hbnthh.exec:\hbnthh.exe71⤵PID:2184
-
\??\c:\3dddj.exec:\3dddj.exe72⤵PID:376
-
\??\c:\djpjj.exec:\djpjj.exe73⤵PID:2916
-
\??\c:\3xllllx.exec:\3xllllx.exe74⤵PID:2292
-
\??\c:\rlfrxxf.exec:\rlfrxxf.exe75⤵PID:2412
-
\??\c:\9tnhnn.exec:\9tnhnn.exe76⤵PID:1584
-
\??\c:\7dvjj.exec:\7dvjj.exe77⤵PID:1556
-
\??\c:\dpjdp.exec:\dpjdp.exe78⤵PID:2288
-
\??\c:\ffxllrf.exec:\ffxllrf.exe79⤵PID:540
-
\??\c:\fxflrxf.exec:\fxflrxf.exe80⤵PID:2692
-
\??\c:\hntbtt.exec:\hntbtt.exe81⤵PID:2732
-
\??\c:\dpvdp.exec:\dpvdp.exe82⤵PID:2840
-
\??\c:\pjpvv.exec:\pjpvv.exe83⤵PID:2816
-
\??\c:\xlfrxlr.exec:\xlfrxlr.exe84⤵PID:2924
-
\??\c:\ffrfxff.exec:\ffrfxff.exe85⤵PID:2700
-
\??\c:\nhhbth.exec:\nhhbth.exe86⤵PID:2752
-
\??\c:\3pppd.exec:\3pppd.exe87⤵PID:2576
-
\??\c:\vppdp.exec:\vppdp.exe88⤵PID:2992
-
\??\c:\fxrrflx.exec:\fxrrflx.exe89⤵PID:2344
-
\??\c:\1xrxxfl.exec:\1xrxxfl.exe90⤵PID:3012
-
\??\c:\nhthtt.exec:\nhthtt.exe91⤵PID:828
-
\??\c:\bthhth.exec:\bthhth.exe92⤵PID:2324
-
\??\c:\vvvpd.exec:\vvvpd.exe93⤵PID:1848
-
\??\c:\1pddv.exec:\1pddv.exe94⤵PID:2380
-
\??\c:\xxrxlxl.exec:\xxrxlxl.exe95⤵PID:352
-
\??\c:\rffxxxl.exec:\rffxxxl.exe96⤵PID:1060
-
\??\c:\nnnbtb.exec:\nnnbtb.exe97⤵PID:1184
-
\??\c:\ntttnt.exec:\ntttnt.exe98⤵PID:2388
-
\??\c:\3ppjv.exec:\3ppjv.exe99⤵PID:1744
-
\??\c:\vvvvj.exec:\vvvvj.exe100⤵PID:1188
-
\??\c:\xlflxfr.exec:\xlflxfr.exe101⤵PID:2896
-
\??\c:\ffxfxxr.exec:\ffxfxxr.exe102⤵PID:2868
-
\??\c:\bbthnt.exec:\bbthnt.exe103⤵PID:1288
-
\??\c:\tnttbb.exec:\tnttbb.exe104⤵PID:2208
-
\??\c:\pdvdj.exec:\pdvdj.exe105⤵
- System Location Discovery: System Language Discovery
PID:2864 -
\??\c:\3vvvp.exec:\3vvvp.exe106⤵PID:788
-
\??\c:\xrlflrf.exec:\xrlflrf.exe107⤵PID:1228
-
\??\c:\fflxllr.exec:\fflxllr.exe108⤵PID:1536
-
\??\c:\tbhtnh.exec:\tbhtnh.exe109⤵PID:892
-
\??\c:\7nbnth.exec:\7nbnth.exe110⤵PID:2420
-
\??\c:\jdvdp.exec:\jdvdp.exe111⤵PID:2216
-
\??\c:\ddvdj.exec:\ddvdj.exe112⤵PID:684
-
\??\c:\llfxrfx.exec:\llfxrfx.exe113⤵PID:968
-
\??\c:\9xlllrl.exec:\9xlllrl.exe114⤵PID:1888
-
\??\c:\lrlrxrf.exec:\lrlrxrf.exe115⤵PID:2184
-
\??\c:\3nttbb.exec:\3nttbb.exe116⤵PID:1660
-
\??\c:\7pjjp.exec:\7pjjp.exe117⤵PID:2492
-
\??\c:\7vddp.exec:\7vddp.exe118⤵PID:2416
-
\??\c:\3dpvj.exec:\3dpvj.exe119⤵PID:2988
-
\??\c:\xxxflxf.exec:\xxxflxf.exe120⤵PID:1588
-
\??\c:\3btbtb.exec:\3btbtb.exe121⤵PID:2152
-
\??\c:\hhbnhh.exec:\hhbnhh.exe122⤵PID:3028
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-