Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2024 16:25
Static task
static1
Behavioral task
behavioral1
Sample
ee2cd552202dfeaf289b4135085782adab6e332c195284c32543f16a762a4ff3.exe
Resource
win7-20241010-en
General
-
Target
ee2cd552202dfeaf289b4135085782adab6e332c195284c32543f16a762a4ff3.exe
-
Size
245KB
-
MD5
bf2695c48bf77c994421e0592f2d2953
-
SHA1
71abe1c2be83a5402a3bdeb9f13c12475ac3f903
-
SHA256
ee2cd552202dfeaf289b4135085782adab6e332c195284c32543f16a762a4ff3
-
SHA512
b5c8d482dda726c8dee89bf8d14f975d6b046019684acc38870fab911a83451257027b239efc3bba22c18221cc8074933c63f9135deb13682818e41d9f741dc8
-
SSDEEP
6144:n3C9BRo7tvnJ9oEz2Eu9XgcVyDOoZU0wGiv/U:n3C9ytvnV2NQAo20wGivs
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 27 IoCs
Processes:
resource yara_rule behavioral2/memory/4772-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4772-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4936-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1496-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3568-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4840-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2000-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/864-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/864-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2052-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2284-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2632-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4824-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2444-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3996-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1216-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2400-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3928-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4792-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1936-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3408-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4908-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1932-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4284-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4584-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4976-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1684-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
rfxrlxr.exepvjvd.exejppdv.exe1llfxfx.exerlfrrlr.exe3vvdv.exe1xxrlrl.exe3jjdv.exexrfrrll.exejpdvv.exe5lxrlxl.exenhnhbn.exefxfrlrl.exenttntn.exeppjvp.exe9lxxlrl.exe7bnhth.exedjdpp.exe9xfrxxr.exe7nhnbh.exefxxrrlr.exerfxxrlf.exebthbnh.exepjpjp.exexflfllr.exe1btnhb.exelflfxxx.exeflrrlfx.exedvppj.exerffxrlf.exethbbth.exeppdpv.exe1lfxlfx.exehbbnbt.exevjjdv.exejdvdp.exe3xrfrrf.exe5nthbh.exe5htnhh.exe5jvjv.exexlfrlfr.exebtnhtn.exethbnhb.exe5jjjd.exellxrrlf.exefxxfxxl.exehtbbbt.exe9jdpd.exerfxflfx.exentbbtt.exehhbtnt.exejddpj.exenbnhtn.exevjvjd.exe1jpjj.exerrrfrrr.exennntnh.exe5vpdv.exe5xxrlxf.exehtbtnn.exevvvvv.exelfxxffx.exeflrrlfx.exehntnbb.exepid process 3568 rfxrlxr.exe 4936 pvjvd.exe 1496 jppdv.exe 4840 1llfxfx.exe 2000 rlfrrlr.exe 4176 3vvdv.exe 3544 1xxrlrl.exe 864 3jjdv.exe 2052 xrfrrll.exe 2284 jpdvv.exe 2632 5lxrlxl.exe 4824 nhnhbn.exe 2444 fxfrlrl.exe 3996 nttntn.exe 1216 ppjvp.exe 2400 9lxxlrl.exe 3928 7bnhth.exe 4792 djdpp.exe 1936 9xfrxxr.exe 2248 7nhnbh.exe 3408 fxxrrlr.exe 4908 rfxxrlf.exe 4056 bthbnh.exe 1916 pjpjp.exe 1932 xflfllr.exe 4980 1btnhb.exe 4284 lflfxxx.exe 4584 flrrlfx.exe 4976 dvppj.exe 1684 rffxrlf.exe 1716 thbbth.exe 4104 ppdpv.exe 384 1lfxlfx.exe 2596 hbbnbt.exe 3456 vjjdv.exe 1424 jdvdp.exe 4144 3xrfrrf.exe 980 5nthbh.exe 4880 5htnhh.exe 1104 5jvjv.exe 4396 xlfrlfr.exe 4868 btnhtn.exe 4440 thbnhb.exe 3520 5jjjd.exe 3596 llxrrlf.exe 3388 fxxfxxl.exe 3476 htbbbt.exe 4552 9jdpd.exe 4464 rfxflfx.exe 4612 ntbbtt.exe 4840 hhbtnt.exe 3224 jddpj.exe 2000 nbnhtn.exe 756 vjvjd.exe 2804 1jpjj.exe 4952 rrrfrrr.exe 3448 nnntnh.exe 864 5vpdv.exe 5076 5xxrlxf.exe 1628 htbtnn.exe 2008 vvvvv.exe 872 lfxxffx.exe 1188 flrrlfx.exe 1516 hntnbb.exe -
Processes:
resource yara_rule behavioral2/memory/4772-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4772-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3568-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3568-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4936-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1496-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3568-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4840-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4840-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4840-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2000-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2000-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2000-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4176-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3544-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3544-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3544-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/864-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/864-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/864-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2052-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2052-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2052-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2284-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2632-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4824-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2444-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3996-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1216-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2400-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3928-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4792-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1936-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3408-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4908-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1932-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4284-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4584-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4976-207-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1684-212-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
xrrlrrx.exe9fffxff.exejpdvv.exepjdvv.exe1tbtbt.exetnbhhb.exebhnnbb.exentbhhn.exe5lrlrrx.exeflfxrrl.exepdjvj.exebbhhbh.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrlrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9fffxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tbtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lrlrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhhbh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ee2cd552202dfeaf289b4135085782adab6e332c195284c32543f16a762a4ff3.exerfxrlxr.exepvjvd.exejppdv.exe1llfxfx.exerlfrrlr.exe3vvdv.exe1xxrlrl.exe3jjdv.exexrfrrll.exejpdvv.exe5lxrlxl.exenhnhbn.exefxfrlrl.exenttntn.exeppjvp.exe9lxxlrl.exe7bnhth.exedjdpp.exe9xfrxxr.exe7nhnbh.exefxxrrlr.exedescription pid process target process PID 4772 wrote to memory of 3568 4772 ee2cd552202dfeaf289b4135085782adab6e332c195284c32543f16a762a4ff3.exe rfxrlxr.exe PID 4772 wrote to memory of 3568 4772 ee2cd552202dfeaf289b4135085782adab6e332c195284c32543f16a762a4ff3.exe rfxrlxr.exe PID 4772 wrote to memory of 3568 4772 ee2cd552202dfeaf289b4135085782adab6e332c195284c32543f16a762a4ff3.exe rfxrlxr.exe PID 3568 wrote to memory of 4936 3568 rfxrlxr.exe pvjvd.exe PID 3568 wrote to memory of 4936 3568 rfxrlxr.exe pvjvd.exe PID 3568 wrote to memory of 4936 3568 rfxrlxr.exe pvjvd.exe PID 4936 wrote to memory of 1496 4936 pvjvd.exe jppdv.exe PID 4936 wrote to memory of 1496 4936 pvjvd.exe jppdv.exe PID 4936 wrote to memory of 1496 4936 pvjvd.exe jppdv.exe PID 1496 wrote to memory of 4840 1496 jppdv.exe 1llfxfx.exe PID 1496 wrote to memory of 4840 1496 jppdv.exe 1llfxfx.exe PID 1496 wrote to memory of 4840 1496 jppdv.exe 1llfxfx.exe PID 4840 wrote to memory of 2000 4840 1llfxfx.exe rlfrrlr.exe PID 4840 wrote to memory of 2000 4840 1llfxfx.exe rlfrrlr.exe PID 4840 wrote to memory of 2000 4840 1llfxfx.exe rlfrrlr.exe PID 2000 wrote to memory of 4176 2000 rlfrrlr.exe 3vvdv.exe PID 2000 wrote to memory of 4176 2000 rlfrrlr.exe 3vvdv.exe PID 2000 wrote to memory of 4176 2000 rlfrrlr.exe 3vvdv.exe PID 4176 wrote to memory of 3544 4176 3vvdv.exe 1xxrlrl.exe PID 4176 wrote to memory of 3544 4176 3vvdv.exe 1xxrlrl.exe PID 4176 wrote to memory of 3544 4176 3vvdv.exe 1xxrlrl.exe PID 3544 wrote to memory of 864 3544 1xxrlrl.exe 3jjdv.exe PID 3544 wrote to memory of 864 3544 1xxrlrl.exe 3jjdv.exe PID 3544 wrote to memory of 864 3544 1xxrlrl.exe 3jjdv.exe PID 864 wrote to memory of 2052 864 3jjdv.exe xrfrrll.exe PID 864 wrote to memory of 2052 864 3jjdv.exe xrfrrll.exe PID 864 wrote to memory of 2052 864 3jjdv.exe xrfrrll.exe PID 2052 wrote to memory of 2284 2052 xrfrrll.exe jpdvv.exe PID 2052 wrote to memory of 2284 2052 xrfrrll.exe jpdvv.exe PID 2052 wrote to memory of 2284 2052 xrfrrll.exe jpdvv.exe PID 2284 wrote to memory of 2632 2284 jpdvv.exe 5lxrlxl.exe PID 2284 wrote to memory of 2632 2284 jpdvv.exe 5lxrlxl.exe PID 2284 wrote to memory of 2632 2284 jpdvv.exe 5lxrlxl.exe PID 2632 wrote to memory of 4824 2632 5lxrlxl.exe nhnhbn.exe PID 2632 wrote to memory of 4824 2632 5lxrlxl.exe nhnhbn.exe PID 2632 wrote to memory of 4824 2632 5lxrlxl.exe nhnhbn.exe PID 4824 wrote to memory of 2444 4824 nhnhbn.exe fxfrlrl.exe PID 4824 wrote to memory of 2444 4824 nhnhbn.exe fxfrlrl.exe PID 4824 wrote to memory of 2444 4824 nhnhbn.exe fxfrlrl.exe PID 2444 wrote to memory of 3996 2444 fxfrlrl.exe nttntn.exe PID 2444 wrote to memory of 3996 2444 fxfrlrl.exe nttntn.exe PID 2444 wrote to memory of 3996 2444 fxfrlrl.exe nttntn.exe PID 3996 wrote to memory of 1216 3996 nttntn.exe ppjvp.exe PID 3996 wrote to memory of 1216 3996 nttntn.exe ppjvp.exe PID 3996 wrote to memory of 1216 3996 nttntn.exe ppjvp.exe PID 1216 wrote to memory of 2400 1216 ppjvp.exe 9lxxlrl.exe PID 1216 wrote to memory of 2400 1216 ppjvp.exe 9lxxlrl.exe PID 1216 wrote to memory of 2400 1216 ppjvp.exe 9lxxlrl.exe PID 2400 wrote to memory of 3928 2400 9lxxlrl.exe 7bnhth.exe PID 2400 wrote to memory of 3928 2400 9lxxlrl.exe 7bnhth.exe PID 2400 wrote to memory of 3928 2400 9lxxlrl.exe 7bnhth.exe PID 3928 wrote to memory of 4792 3928 7bnhth.exe djdpp.exe PID 3928 wrote to memory of 4792 3928 7bnhth.exe djdpp.exe PID 3928 wrote to memory of 4792 3928 7bnhth.exe djdpp.exe PID 4792 wrote to memory of 1936 4792 djdpp.exe 9xfrxxr.exe PID 4792 wrote to memory of 1936 4792 djdpp.exe 9xfrxxr.exe PID 4792 wrote to memory of 1936 4792 djdpp.exe 9xfrxxr.exe PID 1936 wrote to memory of 2248 1936 9xfrxxr.exe 7nhnbh.exe PID 1936 wrote to memory of 2248 1936 9xfrxxr.exe 7nhnbh.exe PID 1936 wrote to memory of 2248 1936 9xfrxxr.exe 7nhnbh.exe PID 2248 wrote to memory of 3408 2248 7nhnbh.exe fxxrrlr.exe PID 2248 wrote to memory of 3408 2248 7nhnbh.exe fxxrrlr.exe PID 2248 wrote to memory of 3408 2248 7nhnbh.exe fxxrrlr.exe PID 3408 wrote to memory of 4908 3408 fxxrrlr.exe rfxxrlf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee2cd552202dfeaf289b4135085782adab6e332c195284c32543f16a762a4ff3.exe"C:\Users\Admin\AppData\Local\Temp\ee2cd552202dfeaf289b4135085782adab6e332c195284c32543f16a762a4ff3.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4772 -
\??\c:\rfxrlxr.exec:\rfxrlxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
\??\c:\pvjvd.exec:\pvjvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\jppdv.exec:\jppdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\1llfxfx.exec:\1llfxfx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
\??\c:\rlfrrlr.exec:\rlfrrlr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\3vvdv.exec:\3vvdv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
\??\c:\1xxrlrl.exec:\1xxrlrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
\??\c:\3jjdv.exec:\3jjdv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\xrfrrll.exec:\xrfrrll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\jpdvv.exec:\jpdvv.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\5lxrlxl.exec:\5lxrlxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\nhnhbn.exec:\nhnhbn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
\??\c:\fxfrlrl.exec:\fxfrlrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\nttntn.exec:\nttntn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
\??\c:\ppjvp.exec:\ppjvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\9lxxlrl.exec:\9lxxlrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\7bnhth.exec:\7bnhth.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
\??\c:\djdpp.exec:\djdpp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
\??\c:\9xfrxxr.exec:\9xfrxxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\7nhnbh.exec:\7nhnbh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\fxxrrlr.exec:\fxxrrlr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
\??\c:\rfxxrlf.exec:\rfxxrlf.exe23⤵
- Executes dropped EXE
PID:4908 -
\??\c:\bthbnh.exec:\bthbnh.exe24⤵
- Executes dropped EXE
PID:4056 -
\??\c:\pjpjp.exec:\pjpjp.exe25⤵
- Executes dropped EXE
PID:1916 -
\??\c:\xflfllr.exec:\xflfllr.exe26⤵
- Executes dropped EXE
PID:1932 -
\??\c:\1btnhb.exec:\1btnhb.exe27⤵
- Executes dropped EXE
PID:4980 -
\??\c:\lflfxxx.exec:\lflfxxx.exe28⤵
- Executes dropped EXE
PID:4284 -
\??\c:\flrrlfx.exec:\flrrlfx.exe29⤵
- Executes dropped EXE
PID:4584 -
\??\c:\dvppj.exec:\dvppj.exe30⤵
- Executes dropped EXE
PID:4976 -
\??\c:\rffxrlf.exec:\rffxrlf.exe31⤵
- Executes dropped EXE
PID:1684 -
\??\c:\thbbth.exec:\thbbth.exe32⤵
- Executes dropped EXE
PID:1716 -
\??\c:\ppdpv.exec:\ppdpv.exe33⤵
- Executes dropped EXE
PID:4104 -
\??\c:\1lfxlfx.exec:\1lfxlfx.exe34⤵
- Executes dropped EXE
PID:384 -
\??\c:\hbbnbt.exec:\hbbnbt.exe35⤵
- Executes dropped EXE
PID:2596 -
\??\c:\vjjdv.exec:\vjjdv.exe36⤵
- Executes dropped EXE
PID:3456 -
\??\c:\jdvdp.exec:\jdvdp.exe37⤵
- Executes dropped EXE
PID:1424 -
\??\c:\3xrfrrf.exec:\3xrfrrf.exe38⤵
- Executes dropped EXE
PID:4144 -
\??\c:\5nthbh.exec:\5nthbh.exe39⤵
- Executes dropped EXE
PID:980 -
\??\c:\5htnhh.exec:\5htnhh.exe40⤵
- Executes dropped EXE
PID:4880 -
\??\c:\5jvjv.exec:\5jvjv.exe41⤵
- Executes dropped EXE
PID:1104 -
\??\c:\xlfrlfr.exec:\xlfrlfr.exe42⤵
- Executes dropped EXE
PID:4396 -
\??\c:\btnhtn.exec:\btnhtn.exe43⤵
- Executes dropped EXE
PID:4868 -
\??\c:\thbnhb.exec:\thbnhb.exe44⤵
- Executes dropped EXE
PID:4440 -
\??\c:\5jjjd.exec:\5jjjd.exe45⤵
- Executes dropped EXE
PID:3520 -
\??\c:\llxrrlf.exec:\llxrrlf.exe46⤵
- Executes dropped EXE
PID:3596 -
\??\c:\fxxfxxl.exec:\fxxfxxl.exe47⤵
- Executes dropped EXE
PID:3388 -
\??\c:\htbbbt.exec:\htbbbt.exe48⤵
- Executes dropped EXE
PID:3476 -
\??\c:\9jdpd.exec:\9jdpd.exe49⤵
- Executes dropped EXE
PID:4552 -
\??\c:\rfxflfx.exec:\rfxflfx.exe50⤵
- Executes dropped EXE
PID:4464 -
\??\c:\ntbbtt.exec:\ntbbtt.exe51⤵
- Executes dropped EXE
PID:4612 -
\??\c:\hhbtnt.exec:\hhbtnt.exe52⤵
- Executes dropped EXE
PID:4840 -
\??\c:\jddpj.exec:\jddpj.exe53⤵
- Executes dropped EXE
PID:3224 -
\??\c:\nbnhtn.exec:\nbnhtn.exe54⤵
- Executes dropped EXE
PID:2000 -
\??\c:\vjvjd.exec:\vjvjd.exe55⤵
- Executes dropped EXE
PID:756 -
\??\c:\1jpjj.exec:\1jpjj.exe56⤵
- Executes dropped EXE
PID:2804 -
\??\c:\rrrfrrr.exec:\rrrfrrr.exe57⤵
- Executes dropped EXE
PID:4952 -
\??\c:\nnntnh.exec:\nnntnh.exe58⤵
- Executes dropped EXE
PID:3448 -
\??\c:\5vpdv.exec:\5vpdv.exe59⤵
- Executes dropped EXE
PID:864 -
\??\c:\5xxrlxf.exec:\5xxrlxf.exe60⤵
- Executes dropped EXE
PID:5076 -
\??\c:\htbtnn.exec:\htbtnn.exe61⤵
- Executes dropped EXE
PID:1628 -
\??\c:\vvvvv.exec:\vvvvv.exe62⤵
- Executes dropped EXE
PID:2008 -
\??\c:\lfxxffx.exec:\lfxxffx.exe63⤵
- Executes dropped EXE
PID:872 -
\??\c:\flrrlfx.exec:\flrrlfx.exe64⤵
- Executes dropped EXE
PID:1188 -
\??\c:\hntnbb.exec:\hntnbb.exe65⤵
- Executes dropped EXE
PID:1516 -
\??\c:\ddjdd.exec:\ddjdd.exe66⤵PID:4572
-
\??\c:\1vddd.exec:\1vddd.exe67⤵PID:1984
-
\??\c:\3xrlllr.exec:\3xrlllr.exe68⤵PID:1648
-
\??\c:\hnhbhh.exec:\hnhbhh.exe69⤵PID:4860
-
\??\c:\jjjdv.exec:\jjjdv.exe70⤵PID:2400
-
\??\c:\rllxxrl.exec:\rllxxrl.exe71⤵PID:3488
-
\??\c:\1rrfxfx.exec:\1rrfxfx.exe72⤵PID:4792
-
\??\c:\bhhbnh.exec:\bhhbnh.exe73⤵PID:1196
-
\??\c:\ppjjd.exec:\ppjjd.exe74⤵PID:2988
-
\??\c:\pvjdp.exec:\pvjdp.exe75⤵PID:4604
-
\??\c:\7rxxlrx.exec:\7rxxlrx.exe76⤵PID:4180
-
\??\c:\5hhnhh.exec:\5hhnhh.exe77⤵PID:4808
-
\??\c:\3hhbbh.exec:\3hhbbh.exe78⤵PID:1900
-
\??\c:\3pppp.exec:\3pppp.exe79⤵PID:3116
-
\??\c:\lffxxrl.exec:\lffxxrl.exe80⤵PID:5044
-
\??\c:\1lxxxfx.exec:\1lxxxfx.exe81⤵PID:3192
-
\??\c:\thnhbh.exec:\thnhbh.exe82⤵PID:1004
-
\??\c:\pjdvv.exec:\pjdvv.exe83⤵
- System Location Discovery: System Language Discovery
PID:2844 -
\??\c:\fxfrlfl.exec:\fxfrlfl.exe84⤵PID:4236
-
\??\c:\nbttnt.exec:\nbttnt.exe85⤵PID:2180
-
\??\c:\hbhbbb.exec:\hbhbbb.exe86⤵PID:1620
-
\??\c:\dvjdv.exec:\dvjdv.exe87⤵PID:1676
-
\??\c:\1rfxllx.exec:\1rfxllx.exe88⤵PID:1812
-
\??\c:\rrrrllx.exec:\rrrrllx.exe89⤵PID:5000
-
\??\c:\hbbtnh.exec:\hbbtnh.exe90⤵PID:4104
-
\??\c:\jdvpj.exec:\jdvpj.exe91⤵PID:3824
-
\??\c:\xlrrllf.exec:\xlrrllf.exe92⤵PID:3688
-
\??\c:\bbnnbb.exec:\bbnnbb.exe93⤵PID:3088
-
\??\c:\jpjdv.exec:\jpjdv.exe94⤵PID:1424
-
\??\c:\dppjd.exec:\dppjd.exe95⤵PID:4144
-
\??\c:\lllfxxl.exec:\lllfxxl.exe96⤵PID:3268
-
\??\c:\rlflxxr.exec:\rlflxxr.exe97⤵PID:4880
-
\??\c:\bbbtnh.exec:\bbbtnh.exe98⤵PID:1104
-
\??\c:\vvpjv.exec:\vvpjv.exe99⤵PID:4016
-
\??\c:\llfxrlf.exec:\llfxrlf.exe100⤵PID:4448
-
\??\c:\lffrlxr.exec:\lffrlxr.exe101⤵PID:4836
-
\??\c:\thnnth.exec:\thnnth.exe102⤵PID:3496
-
\??\c:\jvpjv.exec:\jvpjv.exe103⤵PID:2776
-
\??\c:\ppjjv.exec:\ppjjv.exe104⤵PID:4936
-
\??\c:\rllxfxr.exec:\rllxfxr.exe105⤵PID:2140
-
\??\c:\lfffxlx.exec:\lfffxlx.exe106⤵PID:2088
-
\??\c:\ththht.exec:\ththht.exe107⤵PID:2652
-
\??\c:\nbthnn.exec:\nbthnn.exe108⤵PID:3460
-
\??\c:\vjpjp.exec:\vjpjp.exe109⤵PID:2192
-
\??\c:\xllxxrl.exec:\xllxxrl.exe110⤵PID:3224
-
\??\c:\flxxllf.exec:\flxxllf.exe111⤵PID:2000
-
\??\c:\hntbnn.exec:\hntbnn.exe112⤵PID:756
-
\??\c:\nttttn.exec:\nttttn.exe113⤵PID:3544
-
\??\c:\pvvjd.exec:\pvvjd.exe114⤵PID:1788
-
\??\c:\3rfxrxr.exec:\3rfxrxr.exe115⤵PID:2188
-
\??\c:\5bhttn.exec:\5bhttn.exe116⤵PID:864
-
\??\c:\tthbth.exec:\tthbth.exe117⤵PID:3304
-
\??\c:\9jpdp.exec:\9jpdp.exe118⤵PID:2600
-
\??\c:\vjppv.exec:\vjppv.exe119⤵PID:1628
-
\??\c:\3flfxrl.exec:\3flfxrl.exe120⤵PID:4024
-
\??\c:\5nnnbb.exec:\5nnnbb.exe121⤵PID:3756
-
\??\c:\hhthtb.exec:\hhthtb.exe122⤵PID:3616
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-