Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-11-2024 19:20
Static task
static1
Behavioral task
behavioral1
Sample
07bde9f23ecbe291e0a6ecd5b43f7fbd34088f99cad95eb6a38480537fffe2cd.exe
Resource
win7-20240903-en
General
-
Target
07bde9f23ecbe291e0a6ecd5b43f7fbd34088f99cad95eb6a38480537fffe2cd.exe
-
Size
454KB
-
MD5
9bdb9371d4f5c81e0ef03e158e84187a
-
SHA1
141c1d690291866191ac63c41781e05f2c9c5b8e
-
SHA256
07bde9f23ecbe291e0a6ecd5b43f7fbd34088f99cad95eb6a38480537fffe2cd
-
SHA512
0d245da98d0686a80f3b988a64b56828bf7bb164c2e6ec3ea025affa7fdeb7b148f7964eb3ab8bc77896d419bece48d37e470fc67fea749b9c0a396743c57121
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbecr:q7Tc2NYHUrAwfMp3CDm
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 45 IoCs
Processes:
resource yara_rule behavioral1/memory/2428-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1664-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2132-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1764-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/820-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1432-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1892-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1548-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/744-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2428-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1792-301-0x00000000778E0000-0x00000000779FF000-memory.dmp family_blackmoon behavioral1/memory/852-401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-408-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-428-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1136-442-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/740-455-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/652-494-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/652-501-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/656-514-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2036-576-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1612-595-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-739-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-770-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2532-809-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2500-825-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2480-894-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2904-907-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2016-1073-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1752-1110-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1584-1124-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2788-1180-0x00000000001C0000-0x00000000001EA000-memory.dmp family_blackmoon behavioral1/memory/2136-1241-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2096-1290-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
rlxrflx.exe5bthbh.exejddjd.exehhtbhh.exedvpvv.exe1lrrxxf.exelxrlxxr.exeffxfrxf.exerrxfrxl.exexrrxlrl.exellflxll.exejdvdp.exelrxfxxr.exe1pjjp.exetbbtbb.exellxxflx.exebttbhh.exerxfrflx.exennhnbt.exe9vjpd.exennhnbh.exexrxlxfr.exe5fflfrf.exeffxrffr.exelllxfrf.exebttbnh.exellfrlrf.exe9jvdp.exexxrfxxf.exeppvjp.exeffxxlrf.exeppvpv.exe1pjdd.exehhbhbn.exelrxllrf.exebbthbb.exejpjvd.exeffrflrl.exerlxfrrx.exenhtbbb.exenbtthh.exedvvpv.exerlxxfxl.exenthbbt.exebnbnbh.exedvppv.exevjvvd.exellflxfr.exebthtnn.exe9hhnhh.exepjjvd.exe9rllrll.exexrlrxfl.exenhttbh.exedvdpv.exedpjpd.exelflrffl.exebbnhtt.exe5htbbh.exe3ddvd.exerrrrflf.exe3nbhtb.exe3bntbh.exejdpdv.exepid process 1664 rlxrflx.exe 2216 5bthbh.exe 2544 jddjd.exe 2132 hhtbhh.exe 2756 dvpvv.exe 2864 1lrrxxf.exe 2732 lxrlxxr.exe 2636 ffxfrxf.exe 2780 rrxfrxl.exe 2624 xrrxlrl.exe 2224 llflxll.exe 1536 jdvdp.exe 1764 lrxfxxr.exe 2856 1pjjp.exe 820 tbbtbb.exe 1432 llxxflx.exe 1724 bttbhh.exe 1400 rxfrflx.exe 2128 nnhnbt.exe 2512 9vjpd.exe 2236 nnhnbh.exe 1892 xrxlxfr.exe 904 5fflfrf.exe 1516 ffxrffr.exe 1624 lllxfrf.exe 1548 bttbnh.exe 2804 llfrlrf.exe 2500 9jvdp.exe 896 xxrfxxf.exe 744 ppvjp.exe 2104 ffxxlrf.exe 2428 ppvpv.exe 1792 1pjdd.exe 1716 hhbhbn.exe 2968 lrxllrf.exe 2316 bbthbb.exe 2704 jpjvd.exe 2964 ffrflrl.exe 2744 rlxfrrx.exe 2748 nhtbbb.exe 2740 nbtthh.exe 2776 dvvpv.exe 2860 rlxxfxl.exe 2612 nthbbt.exe 2644 bnbnbh.exe 2896 dvppv.exe 1968 vjvvd.exe 852 llflxfr.exe 2852 bthtnn.exe 1760 9hhnhh.exe 2856 pjjvd.exe 2672 9rllrll.exe 820 xrlrxfl.exe 1136 nhttbh.exe 1972 dvdpv.exe 740 dpjpd.exe 2948 lflrffl.exe 2916 bbnhtt.exe 2212 5htbbh.exe 2496 3ddvd.exe 1264 rrrrflf.exe 352 3nbhtb.exe 652 3bntbh.exe 304 jdpdv.exe -
Processes:
resource yara_rule behavioral1/memory/2428-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1432-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/820-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1432-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1400-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-166-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2512-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1892-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1516-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1548-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/896-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/744-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-301-0x00000000778E0000-0x00000000779FF000-memory.dmp upx behavioral1/memory/2704-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/852-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/820-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/740-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-468-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/652-494-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/656-514-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1312-551-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-576-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-595-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-602-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-645-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-695-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-732-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-739-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/904-771-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/856-812-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-825-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-894-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/3056-927-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1820-965-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-996-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-1017-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/408-1030-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-1073-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1584-1124-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/2788-1180-0x00000000001C0000-0x00000000001EA000-memory.dmp upx behavioral1/memory/2236-1297-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
rlrfxxl.exevvjdd.exexfxrxlf.exevppjv.exentnhtt.exe7htttn.exe9nbhnn.exenbnntt.exettbnbn.exexlrrrxx.exelxrfrxl.exelrlfllx.exeffrflrl.exe7nnbnn.exedvpvp.exehhbhbh.exepppdp.exexrxlxfr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrfxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxrxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7htttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrrrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrfrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlfllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrflrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nnbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxlxfr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
07bde9f23ecbe291e0a6ecd5b43f7fbd34088f99cad95eb6a38480537fffe2cd.exerlxrflx.exe5bthbh.exejddjd.exehhtbhh.exedvpvv.exe1lrrxxf.exelxrlxxr.exeffxfrxf.exerrxfrxl.exexrrxlrl.exellflxll.exejdvdp.exelrxfxxr.exe1pjjp.exetbbtbb.exedescription pid process target process PID 2428 wrote to memory of 1664 2428 07bde9f23ecbe291e0a6ecd5b43f7fbd34088f99cad95eb6a38480537fffe2cd.exe rlxrflx.exe PID 2428 wrote to memory of 1664 2428 07bde9f23ecbe291e0a6ecd5b43f7fbd34088f99cad95eb6a38480537fffe2cd.exe rlxrflx.exe PID 2428 wrote to memory of 1664 2428 07bde9f23ecbe291e0a6ecd5b43f7fbd34088f99cad95eb6a38480537fffe2cd.exe rlxrflx.exe PID 2428 wrote to memory of 1664 2428 07bde9f23ecbe291e0a6ecd5b43f7fbd34088f99cad95eb6a38480537fffe2cd.exe rlxrflx.exe PID 1664 wrote to memory of 2216 1664 rlxrflx.exe 5bthbh.exe PID 1664 wrote to memory of 2216 1664 rlxrflx.exe 5bthbh.exe PID 1664 wrote to memory of 2216 1664 rlxrflx.exe 5bthbh.exe PID 1664 wrote to memory of 2216 1664 rlxrflx.exe 5bthbh.exe PID 2216 wrote to memory of 2544 2216 5bthbh.exe jddjd.exe PID 2216 wrote to memory of 2544 2216 5bthbh.exe jddjd.exe PID 2216 wrote to memory of 2544 2216 5bthbh.exe jddjd.exe PID 2216 wrote to memory of 2544 2216 5bthbh.exe jddjd.exe PID 2544 wrote to memory of 2132 2544 jddjd.exe hhtbhh.exe PID 2544 wrote to memory of 2132 2544 jddjd.exe hhtbhh.exe PID 2544 wrote to memory of 2132 2544 jddjd.exe hhtbhh.exe PID 2544 wrote to memory of 2132 2544 jddjd.exe hhtbhh.exe PID 2132 wrote to memory of 2756 2132 hhtbhh.exe dvpvv.exe PID 2132 wrote to memory of 2756 2132 hhtbhh.exe dvpvv.exe PID 2132 wrote to memory of 2756 2132 hhtbhh.exe dvpvv.exe PID 2132 wrote to memory of 2756 2132 hhtbhh.exe dvpvv.exe PID 2756 wrote to memory of 2864 2756 dvpvv.exe 1lrrxxf.exe PID 2756 wrote to memory of 2864 2756 dvpvv.exe 1lrrxxf.exe PID 2756 wrote to memory of 2864 2756 dvpvv.exe 1lrrxxf.exe PID 2756 wrote to memory of 2864 2756 dvpvv.exe 1lrrxxf.exe PID 2864 wrote to memory of 2732 2864 1lrrxxf.exe lxrlxxr.exe PID 2864 wrote to memory of 2732 2864 1lrrxxf.exe lxrlxxr.exe PID 2864 wrote to memory of 2732 2864 1lrrxxf.exe lxrlxxr.exe PID 2864 wrote to memory of 2732 2864 1lrrxxf.exe lxrlxxr.exe PID 2732 wrote to memory of 2636 2732 lxrlxxr.exe ffxfrxf.exe PID 2732 wrote to memory of 2636 2732 lxrlxxr.exe ffxfrxf.exe PID 2732 wrote to memory of 2636 2732 lxrlxxr.exe ffxfrxf.exe PID 2732 wrote to memory of 2636 2732 lxrlxxr.exe ffxfrxf.exe PID 2636 wrote to memory of 2780 2636 ffxfrxf.exe rrxfrxl.exe PID 2636 wrote to memory of 2780 2636 ffxfrxf.exe rrxfrxl.exe PID 2636 wrote to memory of 2780 2636 ffxfrxf.exe rrxfrxl.exe PID 2636 wrote to memory of 2780 2636 ffxfrxf.exe rrxfrxl.exe PID 2780 wrote to memory of 2624 2780 rrxfrxl.exe xrrxlrl.exe PID 2780 wrote to memory of 2624 2780 rrxfrxl.exe xrrxlrl.exe PID 2780 wrote to memory of 2624 2780 rrxfrxl.exe xrrxlrl.exe PID 2780 wrote to memory of 2624 2780 rrxfrxl.exe xrrxlrl.exe PID 2624 wrote to memory of 2224 2624 xrrxlrl.exe llflxll.exe PID 2624 wrote to memory of 2224 2624 xrrxlrl.exe llflxll.exe PID 2624 wrote to memory of 2224 2624 xrrxlrl.exe llflxll.exe PID 2624 wrote to memory of 2224 2624 xrrxlrl.exe llflxll.exe PID 2224 wrote to memory of 1536 2224 llflxll.exe jdvdp.exe PID 2224 wrote to memory of 1536 2224 llflxll.exe jdvdp.exe PID 2224 wrote to memory of 1536 2224 llflxll.exe jdvdp.exe PID 2224 wrote to memory of 1536 2224 llflxll.exe jdvdp.exe PID 1536 wrote to memory of 1764 1536 jdvdp.exe lrxfxxr.exe PID 1536 wrote to memory of 1764 1536 jdvdp.exe lrxfxxr.exe PID 1536 wrote to memory of 1764 1536 jdvdp.exe lrxfxxr.exe PID 1536 wrote to memory of 1764 1536 jdvdp.exe lrxfxxr.exe PID 1764 wrote to memory of 2856 1764 lrxfxxr.exe 1pjjp.exe PID 1764 wrote to memory of 2856 1764 lrxfxxr.exe 1pjjp.exe PID 1764 wrote to memory of 2856 1764 lrxfxxr.exe 1pjjp.exe PID 1764 wrote to memory of 2856 1764 lrxfxxr.exe 1pjjp.exe PID 2856 wrote to memory of 820 2856 1pjjp.exe tbbtbb.exe PID 2856 wrote to memory of 820 2856 1pjjp.exe tbbtbb.exe PID 2856 wrote to memory of 820 2856 1pjjp.exe tbbtbb.exe PID 2856 wrote to memory of 820 2856 1pjjp.exe tbbtbb.exe PID 820 wrote to memory of 1432 820 tbbtbb.exe llxxflx.exe PID 820 wrote to memory of 1432 820 tbbtbb.exe llxxflx.exe PID 820 wrote to memory of 1432 820 tbbtbb.exe llxxflx.exe PID 820 wrote to memory of 1432 820 tbbtbb.exe llxxflx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\07bde9f23ecbe291e0a6ecd5b43f7fbd34088f99cad95eb6a38480537fffe2cd.exe"C:\Users\Admin\AppData\Local\Temp\07bde9f23ecbe291e0a6ecd5b43f7fbd34088f99cad95eb6a38480537fffe2cd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\rlxrflx.exec:\rlxrflx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\5bthbh.exec:\5bthbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\jddjd.exec:\jddjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\hhtbhh.exec:\hhtbhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\dvpvv.exec:\dvpvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\1lrrxxf.exec:\1lrrxxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\lxrlxxr.exec:\lxrlxxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\ffxfrxf.exec:\ffxfrxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\rrxfrxl.exec:\rrxfrxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\xrrxlrl.exec:\xrrxlrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\llflxll.exec:\llflxll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\jdvdp.exec:\jdvdp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\lrxfxxr.exec:\lrxfxxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\1pjjp.exec:\1pjjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\tbbtbb.exec:\tbbtbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:820 -
\??\c:\llxxflx.exec:\llxxflx.exe17⤵
- Executes dropped EXE
PID:1432 -
\??\c:\bttbhh.exec:\bttbhh.exe18⤵
- Executes dropped EXE
PID:1724 -
\??\c:\rxfrflx.exec:\rxfrflx.exe19⤵
- Executes dropped EXE
PID:1400 -
\??\c:\nnhnbt.exec:\nnhnbt.exe20⤵
- Executes dropped EXE
PID:2128 -
\??\c:\9vjpd.exec:\9vjpd.exe21⤵
- Executes dropped EXE
PID:2512 -
\??\c:\nnhnbh.exec:\nnhnbh.exe22⤵
- Executes dropped EXE
PID:2236 -
\??\c:\xrxlxfr.exec:\xrxlxfr.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1892 -
\??\c:\5fflfrf.exec:\5fflfrf.exe24⤵
- Executes dropped EXE
PID:904 -
\??\c:\ffxrffr.exec:\ffxrffr.exe25⤵
- Executes dropped EXE
PID:1516 -
\??\c:\lllxfrf.exec:\lllxfrf.exe26⤵
- Executes dropped EXE
PID:1624 -
\??\c:\bttbnh.exec:\bttbnh.exe27⤵
- Executes dropped EXE
PID:1548 -
\??\c:\llfrlrf.exec:\llfrlrf.exe28⤵
- Executes dropped EXE
PID:2804 -
\??\c:\9jvdp.exec:\9jvdp.exe29⤵
- Executes dropped EXE
PID:2500 -
\??\c:\xxrfxxf.exec:\xxrfxxf.exe30⤵
- Executes dropped EXE
PID:896 -
\??\c:\ppvjp.exec:\ppvjp.exe31⤵
- Executes dropped EXE
PID:744 -
\??\c:\ffxxlrf.exec:\ffxxlrf.exe32⤵
- Executes dropped EXE
PID:2104 -
\??\c:\ppvpv.exec:\ppvpv.exe33⤵
- Executes dropped EXE
PID:2428 -
\??\c:\1pjdd.exec:\1pjdd.exe34⤵
- Executes dropped EXE
PID:1792 -
\??\c:\flflrrf.exec:\flflrrf.exe35⤵PID:2216
-
\??\c:\hhbhbn.exec:\hhbhbn.exe36⤵
- Executes dropped EXE
PID:1716 -
\??\c:\lrxllrf.exec:\lrxllrf.exe37⤵
- Executes dropped EXE
PID:2968 -
\??\c:\bbthbb.exec:\bbthbb.exe38⤵
- Executes dropped EXE
PID:2316 -
\??\c:\jpjvd.exec:\jpjvd.exe39⤵
- Executes dropped EXE
PID:2704 -
\??\c:\ffrflrl.exec:\ffrflrl.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2964 -
\??\c:\rlxfrrx.exec:\rlxfrrx.exe41⤵
- Executes dropped EXE
PID:2744 -
\??\c:\nhtbbb.exec:\nhtbbb.exe42⤵
- Executes dropped EXE
PID:2748 -
\??\c:\nbtthh.exec:\nbtthh.exe43⤵
- Executes dropped EXE
PID:2740 -
\??\c:\dvvpv.exec:\dvvpv.exe44⤵
- Executes dropped EXE
PID:2776 -
\??\c:\rlxxfxl.exec:\rlxxfxl.exe45⤵
- Executes dropped EXE
PID:2860 -
\??\c:\nthbbt.exec:\nthbbt.exe46⤵
- Executes dropped EXE
PID:2612 -
\??\c:\bnbnbh.exec:\bnbnbh.exe47⤵
- Executes dropped EXE
PID:2644 -
\??\c:\dvppv.exec:\dvppv.exe48⤵
- Executes dropped EXE
PID:2896 -
\??\c:\vjvvd.exec:\vjvvd.exe49⤵
- Executes dropped EXE
PID:1968 -
\??\c:\llflxfr.exec:\llflxfr.exe50⤵
- Executes dropped EXE
PID:852 -
\??\c:\bthtnn.exec:\bthtnn.exe51⤵
- Executes dropped EXE
PID:2852 -
\??\c:\9hhnhh.exec:\9hhnhh.exe52⤵
- Executes dropped EXE
PID:1760 -
\??\c:\pjjvd.exec:\pjjvd.exe53⤵
- Executes dropped EXE
PID:2856 -
\??\c:\9rllrll.exec:\9rllrll.exe54⤵
- Executes dropped EXE
PID:2672 -
\??\c:\xrlrxfl.exec:\xrlrxfl.exe55⤵
- Executes dropped EXE
PID:820 -
\??\c:\nhttbh.exec:\nhttbh.exe56⤵
- Executes dropped EXE
PID:1136 -
\??\c:\dvdpv.exec:\dvdpv.exe57⤵
- Executes dropped EXE
PID:1972 -
\??\c:\dpjpd.exec:\dpjpd.exe58⤵
- Executes dropped EXE
PID:740 -
\??\c:\lflrffl.exec:\lflrffl.exe59⤵
- Executes dropped EXE
PID:2948 -
\??\c:\bbnhtt.exec:\bbnhtt.exe60⤵
- Executes dropped EXE
PID:2916 -
\??\c:\5htbbh.exec:\5htbbh.exe61⤵
- Executes dropped EXE
PID:2212 -
\??\c:\3ddvd.exec:\3ddvd.exe62⤵
- Executes dropped EXE
PID:2496 -
\??\c:\rrrrflf.exec:\rrrrflf.exe63⤵
- Executes dropped EXE
PID:1264 -
\??\c:\3nbhtb.exec:\3nbhtb.exe64⤵
- Executes dropped EXE
PID:352 -
\??\c:\3bntbh.exec:\3bntbh.exe65⤵
- Executes dropped EXE
PID:652 -
\??\c:\jdpdv.exec:\jdpdv.exe66⤵
- Executes dropped EXE
PID:304 -
\??\c:\xxlrxfl.exec:\xxlrxfl.exe67⤵PID:656
-
\??\c:\nhtntt.exec:\nhtntt.exe68⤵PID:1012
-
\??\c:\bbhnnb.exec:\bbhnnb.exe69⤵PID:2288
-
\??\c:\vpdjj.exec:\vpdjj.exe70⤵PID:1652
-
\??\c:\rlflflr.exec:\rlflflr.exe71⤵PID:2376
-
\??\c:\1xrxfff.exec:\1xrxfff.exe72⤵PID:2500
-
\??\c:\ntnthb.exec:\ntnthb.exe73⤵PID:316
-
\??\c:\vpjvv.exec:\vpjvv.exe74⤵PID:1312
-
\??\c:\flrlxfr.exec:\flrlxfr.exe75⤵PID:800
-
\??\c:\1lflrrx.exec:\1lflrrx.exe76⤵PID:3028
-
\??\c:\tbtbhn.exec:\tbtbhn.exe77⤵PID:2036
-
\??\c:\dvpvd.exec:\dvpvd.exe78⤵PID:2220
-
\??\c:\flflxxf.exec:\flflxxf.exe79⤵PID:3040
-
\??\c:\xlxfrxf.exec:\xlxfrxf.exe80⤵PID:1612
-
\??\c:\hbntnt.exec:\hbntnt.exe81⤵PID:2556
-
\??\c:\vjjpd.exec:\vjjpd.exe82⤵PID:2316
-
\??\c:\ffflrxr.exec:\ffflrxr.exe83⤵PID:2480
-
\??\c:\1lxxllr.exec:\1lxxllr.exe84⤵PID:2964
-
\??\c:\nnnthn.exec:\nnnthn.exe85⤵PID:2888
-
\??\c:\djdjd.exec:\djdjd.exe86⤵PID:2748
-
\??\c:\lllrflf.exec:\lllrflf.exe87⤵PID:2740
-
\??\c:\lrlrlrr.exec:\lrlrlrr.exe88⤵PID:2776
-
\??\c:\nnbhnt.exec:\nnbhnt.exe89⤵PID:2632
-
\??\c:\1dvpj.exec:\1dvpj.exe90⤵PID:1744
-
\??\c:\rlfrxrf.exec:\rlfrxrf.exe91⤵PID:3048
-
\??\c:\lxlfllx.exec:\lxlfllx.exe92⤵PID:1524
-
\??\c:\tttnhn.exec:\tttnhn.exe93⤵PID:1872
-
\??\c:\9dppv.exec:\9dppv.exe94⤵PID:1480
-
\??\c:\xxrxflf.exec:\xxrxflf.exe95⤵PID:1740
-
\??\c:\rlfrxxl.exec:\rlfrxxl.exe96⤵PID:1760
-
\??\c:\nhbnth.exec:\nhbnth.exe97⤵PID:2856
-
\??\c:\ddvjv.exec:\ddvjv.exe98⤵PID:2672
-
\??\c:\1pjvd.exec:\1pjvd.exe99⤵PID:1808
-
\??\c:\3rfflff.exec:\3rfflff.exe100⤵PID:2920
-
\??\c:\hbtbtt.exec:\hbtbtt.exe101⤵PID:1944
-
\??\c:\1nhthn.exec:\1nhthn.exe102⤵PID:2940
-
\??\c:\vjvvv.exec:\vjvvv.exe103⤵PID:2708
-
\??\c:\1rllrxl.exec:\1rllrxl.exe104⤵PID:2468
-
\??\c:\hbbnhh.exec:\hbbnhh.exe105⤵PID:2504
-
\??\c:\1ttbhh.exec:\1ttbhh.exe106⤵PID:2244
-
\??\c:\9dvvj.exec:\9dvvj.exe107⤵PID:1596
-
\??\c:\xrlxffl.exec:\xrlxffl.exe108⤵PID:2792
-
\??\c:\xrflxfl.exec:\xrflxfl.exe109⤵PID:904
-
\??\c:\nnhnbh.exec:\nnhnbh.exe110⤵PID:596
-
\??\c:\vpjjv.exec:\vpjjv.exe111⤵PID:1624
-
\??\c:\vpvdj.exec:\vpvdj.exe112⤵PID:1036
-
\??\c:\lfxxrxl.exec:\lfxxrxl.exe113⤵PID:1336
-
\??\c:\tthtbh.exec:\tthtbh.exe114⤵PID:2532
-
\??\c:\3dppd.exec:\3dppd.exe115⤵PID:856
-
\??\c:\dpppv.exec:\dpppv.exe116⤵PID:2500
-
\??\c:\xrlrfxr.exec:\xrlrfxr.exe117⤵PID:688
-
\??\c:\nhnntt.exec:\nhnntt.exe118⤵PID:744
-
\??\c:\jvpvd.exec:\jvpvd.exe119⤵PID:2428
-
\??\c:\llflxrl.exec:\llflxrl.exe120⤵PID:3028
-
\??\c:\fxxfrfx.exec:\fxxfrfx.exe121⤵PID:2036
-
\??\c:\hbtbhh.exec:\hbtbhh.exe122⤵PID:1604
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-