Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24-11-2024 00:20
Behavioral task
behavioral1
Sample
7e491917a08bebbcc0b2d1ddfa1f99c3d41cde96cd2cbb801d0c0c839fcf1e18.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
7e491917a08bebbcc0b2d1ddfa1f99c3d41cde96cd2cbb801d0c0c839fcf1e18.exe
-
Size
97KB
-
MD5
d38bdfb25e383f1d740af9fb7e8c534f
-
SHA1
1632f2af56a65b178799c35703d3540893f3c0c1
-
SHA256
7e491917a08bebbcc0b2d1ddfa1f99c3d41cde96cd2cbb801d0c0c839fcf1e18
-
SHA512
a35a90462741fd2811f281fe467e9791c40c2f8339f55bf931dbdc5ddccc4dccf3e74c012ff77a593de513285e913bcc54a8df64e4efed608a62bb0eeff5d21f
-
SSDEEP
3072:8hOmTsF93UYfwC6GIout0fmCiiiXA6mzgz:8cm4FmowdHoSgWrXUgz
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 56 IoCs
Processes:
resource yara_rule behavioral1/memory/1968-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2524-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2148-22-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2148-23-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2408-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1048-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2124-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2856-66-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2856-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2584-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2432-108-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2432-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2644-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2952-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2952-126-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2952-125-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/112-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2960-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3008-157-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3008-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3008-161-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1368-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2332-186-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2100-192-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2332-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2100-196-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/640-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2244-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1068-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1068-229-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2452-246-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2804-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1372-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1960-318-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/1960-317-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2688-330-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2148-329-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2084-350-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2084-349-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2920-382-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/568-409-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2980-450-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2568-480-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/988-491-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1772-497-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1736-543-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/628-580-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3064-601-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2796-616-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2328-655-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1920-808-0x0000000077680000-0x000000007777A000-memory.dmp family_blackmoon behavioral1/memory/1196-925-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1920-1069-0x0000000077560000-0x000000007767F000-memory.dmp family_blackmoon behavioral1/memory/1920-19282-0x0000000077560000-0x000000007767F000-memory.dmp family_blackmoon behavioral1/memory/1920-20410-0x0000000077560000-0x000000007767F000-memory.dmp family_blackmoon behavioral1/memory/1920-29567-0x0000000077560000-0x000000007767F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
frxrfll.exebtnthh.exedjpjj.exelffxflr.exe7bbtbh.exe1vjpv.exerrlxrfl.exenhnnhn.exe7bnbbn.exeppdvd.exelflxlrf.exenhhhbn.exettntnt.exevpjvp.exerlxfffl.exebbntbh.exethtthn.exerlxrxrx.exexrlrflx.exebthttt.exejdpvv.exelfflxfr.exeflxxlxx.exetbthbh.exe3pvdp.exeddjjd.exe7xrxxxf.exejjpvv.exe1ddvd.exelfrlfxf.exehbnnnn.exevjdjp.exelxrxxxl.exexrfrxlx.exetnbhbh.exe7pvdp.exejvjpv.exefrfxffl.exefxfflxl.exe7tbtbb.exenhbhtn.exejjpdj.exerrxrrrf.exe9tnnbh.exehthhbh.exevvjjp.exe9llxlxf.exe1lfrxxl.exebtbhbt.exejdvjv.exe7xlrxll.exebntbhh.exehtttbb.exevppvv.exe5ppdp.exerrrxxlf.exebbnhbn.exehhnhnt.exevvjvj.exe1fflrxx.exelfxfrxl.exebttnhh.exennhtth.exejddvv.exepid Process 2524 frxrfll.exe 2148 btnthh.exe 2408 djpjj.exe 1048 lffxflr.exe 2124 7bbtbh.exe 2864 1vjpv.exe 2856 rrlxrfl.exe 2700 nhnnhn.exe 2608 7bnbbn.exe 2584 ppdvd.exe 2660 lflxlrf.exe 2432 nhhhbn.exe 2644 ttntnt.exe 2952 vpjvp.exe 112 rlxfffl.exe 2776 bbntbh.exe 2960 thtthn.exe 3008 rlxrxrx.exe 1368 xrlrflx.exe 2996 bthttt.exe 2332 jdpvv.exe 2100 lfflxfr.exe 640 flxxlxx.exe 2244 tbthbh.exe 1360 3pvdp.exe 1068 ddjjd.exe 1540 7xrxxxf.exe 2452 jjpvv.exe 2428 1ddvd.exe 2804 lfrlfxf.exe 2164 hbnnnn.exe 1192 vjdjp.exe 1856 lxrxxxl.exe 1372 xrfrxlx.exe 1680 tnbhbh.exe 1572 7pvdp.exe 2924 jvjpv.exe 2148 frfxffl.exe 1960 fxfflxl.exe 2192 7tbtbb.exe 2688 nhbhtn.exe 2844 jjpdj.exe 2912 rrxrrrf.exe 2084 9tnnbh.exe 2932 hthhbh.exe 2016 vvjjp.exe 2696 9llxlxf.exe 2600 1lfrxxl.exe 2584 btbhbt.exe 2920 jdvjv.exe 2588 7xlrxll.exe 2800 bntbhh.exe 2136 htttbb.exe 2952 vppvv.exe 568 5ppdp.exe 300 rrrxxlf.exe 2944 bbnhbn.exe 324 hhnhnt.exe 2960 vvjvj.exe 1752 1fflrxx.exe 2980 lfxfrxl.exe 2336 bttnhh.exe 2200 nnhtth.exe 2104 jddvv.exe -
Processes:
resource yara_rule behavioral1/memory/1968-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1968-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000012118-7.dat upx behavioral1/memory/2524-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000001945b-14.dat upx behavioral1/memory/2148-22-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000019465-24.dat upx behavioral1/files/0x000700000001946a-34.dat upx behavioral1/memory/1048-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2408-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1048-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001947d-41.dat upx behavioral1/files/0x0006000000019485-52.dat upx behavioral1/memory/2124-51-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000194d7-59.dat upx behavioral1/files/0x00080000000194df-69.dat upx behavioral1/memory/2856-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000800000001950e-77.dat upx behavioral1/files/0x0005000000019d8c-84.dat upx behavioral1/memory/2584-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019f58-93.dat upx behavioral1/memory/2584-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019f6e-101.dat upx behavioral1/files/0x000500000001a06a-109.dat upx behavioral1/memory/2432-107-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a074-119.dat upx behavioral1/memory/2644-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a0ab-128.dat upx behavioral1/memory/2952-127-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a301-139.dat upx behavioral1/memory/2776-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/112-137-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a32f-145.dat upx behavioral1/files/0x000500000001a438-152.dat upx behavioral1/memory/2960-153-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3008-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a43f-162.dat upx behavioral1/files/0x000500000001a442-170.dat upx behavioral1/memory/1368-171-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a443-179.dat upx behavioral1/memory/2100-192-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x000500000001a444-189.dat upx behavioral1/memory/2332-187-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a471-197.dat upx behavioral1/memory/2100-196-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/640-205-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a491-204.dat upx behavioral1/memory/2244-212-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a496-213.dat upx behavioral1/files/0x000500000001a4a0-221.dat upx behavioral1/memory/1068-222-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4a6-230.dat upx behavioral1/files/0x0008000000019433-238.dat upx behavioral1/memory/2452-246-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4b7-245.dat upx behavioral1/files/0x000500000001a4c1-253.dat upx behavioral1/memory/2804-254-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2804-263-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4c2-262.dat upx behavioral1/files/0x000500000001a4c4-270.dat upx behavioral1/memory/1372-289-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2084-350-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2084-348-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2844-356-0x00000000001B0000-0x00000000001D7000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
lrllflx.exeffrlfll.exeffffrxf.exennbhtb.exebbnhnn.exe1rrrrxf.exevvdjp.exe1llffxf.exepjvvd.exebhbhth.exefxlrlrf.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrllflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrlfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffffrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rrrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1llffxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrlrf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7e491917a08bebbcc0b2d1ddfa1f99c3d41cde96cd2cbb801d0c0c839fcf1e18.exefrxrfll.exebtnthh.exedjpjj.exelffxflr.exe7bbtbh.exe1vjpv.exerrlxrfl.exenhnnhn.exe7bnbbn.exeppdvd.exelflxlrf.exenhhhbn.exettntnt.exevpjvp.exerlxfffl.exedescription pid Process procid_target PID 1968 wrote to memory of 2524 1968 7e491917a08bebbcc0b2d1ddfa1f99c3d41cde96cd2cbb801d0c0c839fcf1e18.exe 30 PID 1968 wrote to memory of 2524 1968 7e491917a08bebbcc0b2d1ddfa1f99c3d41cde96cd2cbb801d0c0c839fcf1e18.exe 30 PID 1968 wrote to memory of 2524 1968 7e491917a08bebbcc0b2d1ddfa1f99c3d41cde96cd2cbb801d0c0c839fcf1e18.exe 30 PID 1968 wrote to memory of 2524 1968 7e491917a08bebbcc0b2d1ddfa1f99c3d41cde96cd2cbb801d0c0c839fcf1e18.exe 30 PID 2524 wrote to memory of 2148 2524 frxrfll.exe 31 PID 2524 wrote to memory of 2148 2524 frxrfll.exe 31 PID 2524 wrote to memory of 2148 2524 frxrfll.exe 31 PID 2524 wrote to memory of 2148 2524 frxrfll.exe 31 PID 2148 wrote to memory of 2408 2148 btnthh.exe 32 PID 2148 wrote to memory of 2408 2148 btnthh.exe 32 PID 2148 wrote to memory of 2408 2148 btnthh.exe 32 PID 2148 wrote to memory of 2408 2148 btnthh.exe 32 PID 2408 wrote to memory of 1048 2408 djpjj.exe 33 PID 2408 wrote to memory of 1048 2408 djpjj.exe 33 PID 2408 wrote to memory of 1048 2408 djpjj.exe 33 PID 2408 wrote to memory of 1048 2408 djpjj.exe 33 PID 1048 wrote to memory of 2124 1048 lffxflr.exe 34 PID 1048 wrote to memory of 2124 1048 lffxflr.exe 34 PID 1048 wrote to memory of 2124 1048 lffxflr.exe 34 PID 1048 wrote to memory of 2124 1048 lffxflr.exe 34 PID 2124 wrote to memory of 2864 2124 7bbtbh.exe 35 PID 2124 wrote to memory of 2864 2124 7bbtbh.exe 35 PID 2124 wrote to memory of 2864 2124 7bbtbh.exe 35 PID 2124 wrote to memory of 2864 2124 7bbtbh.exe 35 PID 2864 wrote to memory of 2856 2864 1vjpv.exe 36 PID 2864 wrote to memory of 2856 2864 1vjpv.exe 36 PID 2864 wrote to memory of 2856 2864 1vjpv.exe 36 PID 2864 wrote to memory of 2856 2864 1vjpv.exe 36 PID 2856 wrote to memory of 2700 2856 rrlxrfl.exe 37 PID 2856 wrote to memory of 2700 2856 rrlxrfl.exe 37 PID 2856 wrote to memory of 2700 2856 rrlxrfl.exe 37 PID 2856 wrote to memory of 2700 2856 rrlxrfl.exe 37 PID 2700 wrote to memory of 2608 2700 nhnnhn.exe 38 PID 2700 wrote to memory of 2608 2700 nhnnhn.exe 38 PID 2700 wrote to memory of 2608 2700 nhnnhn.exe 38 PID 2700 wrote to memory of 2608 2700 nhnnhn.exe 38 PID 2608 wrote to memory of 2584 2608 7bnbbn.exe 39 PID 2608 wrote to memory of 2584 2608 7bnbbn.exe 39 PID 2608 wrote to memory of 2584 2608 7bnbbn.exe 39 PID 2608 wrote to memory of 2584 2608 7bnbbn.exe 39 PID 2584 wrote to memory of 2660 2584 ppdvd.exe 40 PID 2584 wrote to memory of 2660 2584 ppdvd.exe 40 PID 2584 wrote to memory of 2660 2584 ppdvd.exe 40 PID 2584 wrote to memory of 2660 2584 ppdvd.exe 40 PID 2660 wrote to memory of 2432 2660 lflxlrf.exe 41 PID 2660 wrote to memory of 2432 2660 lflxlrf.exe 41 PID 2660 wrote to memory of 2432 2660 lflxlrf.exe 41 PID 2660 wrote to memory of 2432 2660 lflxlrf.exe 41 PID 2432 wrote to memory of 2644 2432 nhhhbn.exe 42 PID 2432 wrote to memory of 2644 2432 nhhhbn.exe 42 PID 2432 wrote to memory of 2644 2432 nhhhbn.exe 42 PID 2432 wrote to memory of 2644 2432 nhhhbn.exe 42 PID 2644 wrote to memory of 2952 2644 ttntnt.exe 43 PID 2644 wrote to memory of 2952 2644 ttntnt.exe 43 PID 2644 wrote to memory of 2952 2644 ttntnt.exe 43 PID 2644 wrote to memory of 2952 2644 ttntnt.exe 43 PID 2952 wrote to memory of 112 2952 vpjvp.exe 44 PID 2952 wrote to memory of 112 2952 vpjvp.exe 44 PID 2952 wrote to memory of 112 2952 vpjvp.exe 44 PID 2952 wrote to memory of 112 2952 vpjvp.exe 44 PID 112 wrote to memory of 2776 112 rlxfffl.exe 45 PID 112 wrote to memory of 2776 112 rlxfffl.exe 45 PID 112 wrote to memory of 2776 112 rlxfffl.exe 45 PID 112 wrote to memory of 2776 112 rlxfffl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e491917a08bebbcc0b2d1ddfa1f99c3d41cde96cd2cbb801d0c0c839fcf1e18.exe"C:\Users\Admin\AppData\Local\Temp\7e491917a08bebbcc0b2d1ddfa1f99c3d41cde96cd2cbb801d0c0c839fcf1e18.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\frxrfll.exec:\frxrfll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\btnthh.exec:\btnthh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\djpjj.exec:\djpjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\lffxflr.exec:\lffxflr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\7bbtbh.exec:\7bbtbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\1vjpv.exec:\1vjpv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\rrlxrfl.exec:\rrlxrfl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\nhnnhn.exec:\nhnnhn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\7bnbbn.exec:\7bnbbn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\ppdvd.exec:\ppdvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\lflxlrf.exec:\lflxlrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\nhhhbn.exec:\nhhhbn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\ttntnt.exec:\ttntnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\vpjvp.exec:\vpjvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\rlxfffl.exec:\rlxfffl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:112 -
\??\c:\bbntbh.exec:\bbntbh.exe17⤵
- Executes dropped EXE
PID:2776 -
\??\c:\thtthn.exec:\thtthn.exe18⤵
- Executes dropped EXE
PID:2960 -
\??\c:\rlxrxrx.exec:\rlxrxrx.exe19⤵
- Executes dropped EXE
PID:3008 -
\??\c:\xrlrflx.exec:\xrlrflx.exe20⤵
- Executes dropped EXE
PID:1368 -
\??\c:\bthttt.exec:\bthttt.exe21⤵
- Executes dropped EXE
PID:2996 -
\??\c:\jdpvv.exec:\jdpvv.exe22⤵
- Executes dropped EXE
PID:2332 -
\??\c:\lfflxfr.exec:\lfflxfr.exe23⤵
- Executes dropped EXE
PID:2100 -
\??\c:\flxxlxx.exec:\flxxlxx.exe24⤵
- Executes dropped EXE
PID:640 -
\??\c:\tbthbh.exec:\tbthbh.exe25⤵
- Executes dropped EXE
PID:2244 -
\??\c:\3pvdp.exec:\3pvdp.exe26⤵
- Executes dropped EXE
PID:1360 -
\??\c:\ddjjd.exec:\ddjjd.exe27⤵
- Executes dropped EXE
PID:1068 -
\??\c:\7xrxxxf.exec:\7xrxxxf.exe28⤵
- Executes dropped EXE
PID:1540 -
\??\c:\jjpvv.exec:\jjpvv.exe29⤵
- Executes dropped EXE
PID:2452 -
\??\c:\1ddvd.exec:\1ddvd.exe30⤵
- Executes dropped EXE
PID:2428 -
\??\c:\lfrlfxf.exec:\lfrlfxf.exe31⤵
- Executes dropped EXE
PID:2804 -
\??\c:\hbnnnn.exec:\hbnnnn.exe32⤵
- Executes dropped EXE
PID:2164 -
\??\c:\vjdjp.exec:\vjdjp.exe33⤵
- Executes dropped EXE
PID:1192 -
\??\c:\lxrxxxl.exec:\lxrxxxl.exe34⤵
- Executes dropped EXE
PID:1856 -
\??\c:\xrfrxlx.exec:\xrfrxlx.exe35⤵
- Executes dropped EXE
PID:1372 -
\??\c:\tnbhbh.exec:\tnbhbh.exe36⤵
- Executes dropped EXE
PID:1680 -
\??\c:\7pvdp.exec:\7pvdp.exe37⤵
- Executes dropped EXE
PID:1572 -
\??\c:\jvjpv.exec:\jvjpv.exe38⤵
- Executes dropped EXE
PID:2924 -
\??\c:\frfxffl.exec:\frfxffl.exe39⤵
- Executes dropped EXE
PID:2148 -
\??\c:\fxfflxl.exec:\fxfflxl.exe40⤵
- Executes dropped EXE
PID:1960 -
\??\c:\7tbtbb.exec:\7tbtbb.exe41⤵
- Executes dropped EXE
PID:2192 -
\??\c:\nhbhtn.exec:\nhbhtn.exe42⤵
- Executes dropped EXE
PID:2688 -
\??\c:\jjpdj.exec:\jjpdj.exe43⤵
- Executes dropped EXE
PID:2844 -
\??\c:\rrxrrrf.exec:\rrxrrrf.exe44⤵
- Executes dropped EXE
PID:2912 -
\??\c:\9tnnbh.exec:\9tnnbh.exe45⤵
- Executes dropped EXE
PID:2084 -
\??\c:\hthhbh.exec:\hthhbh.exe46⤵
- Executes dropped EXE
PID:2932 -
\??\c:\vvjjp.exec:\vvjjp.exe47⤵
- Executes dropped EXE
PID:2016 -
\??\c:\9llxlxf.exec:\9llxlxf.exe48⤵
- Executes dropped EXE
PID:2696 -
\??\c:\1lfrxxl.exec:\1lfrxxl.exe49⤵
- Executes dropped EXE
PID:2600 -
\??\c:\btbhbt.exec:\btbhbt.exe50⤵
- Executes dropped EXE
PID:2584 -
\??\c:\jdvjv.exec:\jdvjv.exe51⤵
- Executes dropped EXE
PID:2920 -
\??\c:\7xlrxll.exec:\7xlrxll.exe52⤵
- Executes dropped EXE
PID:2588 -
\??\c:\bntbhh.exec:\bntbhh.exe53⤵
- Executes dropped EXE
PID:2800 -
\??\c:\htttbb.exec:\htttbb.exe54⤵
- Executes dropped EXE
PID:2136 -
\??\c:\vppvv.exec:\vppvv.exe55⤵
- Executes dropped EXE
PID:2952 -
\??\c:\5ppdp.exec:\5ppdp.exe56⤵
- Executes dropped EXE
PID:568 -
\??\c:\rrrxxlf.exec:\rrrxxlf.exe57⤵
- Executes dropped EXE
PID:300 -
\??\c:\bbnhbn.exec:\bbnhbn.exe58⤵
- Executes dropped EXE
PID:2944 -
\??\c:\hhnhnt.exec:\hhnhnt.exe59⤵
- Executes dropped EXE
PID:324 -
\??\c:\vvjvj.exec:\vvjvj.exe60⤵
- Executes dropped EXE
PID:2960 -
\??\c:\1fflrxx.exec:\1fflrxx.exe61⤵
- Executes dropped EXE
PID:1752 -
\??\c:\lfxfrxl.exec:\lfxfrxl.exe62⤵
- Executes dropped EXE
PID:2980 -
\??\c:\bttnhh.exec:\bttnhh.exe63⤵
- Executes dropped EXE
PID:2336 -
\??\c:\nnhtth.exec:\nnhtth.exe64⤵
- Executes dropped EXE
PID:2200 -
\??\c:\jddvv.exec:\jddvv.exe65⤵
- Executes dropped EXE
PID:2104 -
\??\c:\1pjpv.exec:\1pjpv.exe66⤵PID:2484
-
\??\c:\7fflxrx.exec:\7fflxrx.exe67⤵PID:576
-
\??\c:\fxlrrlf.exec:\fxlrrlf.exe68⤵PID:1904
-
\??\c:\nhnnnn.exec:\nhnnnn.exe69⤵PID:2568
-
\??\c:\hhhhnt.exec:\hhhhnt.exe70⤵PID:1204
-
\??\c:\jjdjp.exec:\jjdjp.exe71⤵PID:988
-
\??\c:\dvjjj.exec:\dvjjj.exe72⤵PID:1772
-
\??\c:\1xxrfrf.exec:\1xxrfrf.exe73⤵PID:1556
-
\??\c:\bbnbnt.exec:\bbnbnt.exe74⤵PID:2284
-
\??\c:\nhnhhb.exec:\nhnhhb.exe75⤵PID:1088
-
\??\c:\pppjp.exec:\pppjp.exe76⤵PID:840
-
\??\c:\9dddp.exec:\9dddp.exe77⤵PID:2448
-
\??\c:\xrfrxfx.exec:\xrfrxfx.exe78⤵PID:2196
-
\??\c:\9rrlxxf.exec:\9rrlxxf.exe79⤵PID:2128
-
\??\c:\lrfxfrl.exec:\lrfxfrl.exe80⤵PID:2172
-
\??\c:\3thhnn.exec:\3thhnn.exe81⤵PID:1736
-
\??\c:\jpdpv.exec:\jpdpv.exe82⤵PID:2540
-
\??\c:\vvvdv.exec:\vvvdv.exe83⤵PID:1372
-
\??\c:\5fllrxl.exec:\5fllrxl.exe84⤵PID:2060
-
\??\c:\rfrrxxl.exec:\rfrrxxl.exe85⤵PID:1704
-
\??\c:\fxfxrll.exec:\fxfxrll.exe86⤵PID:2524
-
\??\c:\hbnbht.exec:\hbnbht.exe87⤵PID:2924
-
\??\c:\btnnhn.exec:\btnnhn.exe88⤵PID:2768
-
\??\c:\vjpvj.exec:\vjpvj.exe89⤵PID:628
-
\??\c:\lffxlxr.exec:\lffxlxr.exe90⤵PID:2840
-
\??\c:\fxlrlrf.exec:\fxlrlrf.exe91⤵
- System Location Discovery: System Language Discovery
PID:2868 -
\??\c:\tttbtt.exec:\tttbtt.exe92⤵PID:3064
-
\??\c:\tnhhnt.exec:\tnhhnt.exe93⤵PID:2876
-
\??\c:\5vvpd.exec:\5vvpd.exe94⤵PID:2852
-
\??\c:\3dpjp.exec:\3dpjp.exe95⤵PID:2796
-
\??\c:\llflxfx.exec:\llflxfx.exe96⤵PID:2744
-
\??\c:\xxxlrfl.exec:\xxxlrfl.exe97⤵PID:2788
-
\??\c:\3btntb.exec:\3btntb.exe98⤵PID:2628
-
\??\c:\hhntnn.exec:\hhntnn.exe99⤵PID:2312
-
\??\c:\vvpdd.exec:\vvpdd.exe100⤵PID:2328
-
\??\c:\dvppv.exec:\dvppv.exe101⤵PID:2432
-
\??\c:\llfrflx.exec:\llfrflx.exe102⤵PID:2888
-
\??\c:\flflxfr.exec:\flflxfr.exe103⤵PID:1272
-
\??\c:\tnhhnb.exec:\tnhhnb.exe104⤵PID:1336
-
\??\c:\bbtbhn.exec:\bbtbhn.exe105⤵PID:2812
-
\??\c:\vpjvd.exec:\vpjvd.exe106⤵PID:2900
-
\??\c:\5dpdp.exec:\5dpdp.exe107⤵PID:2784
-
\??\c:\xlxrrrx.exec:\xlxrrrx.exe108⤵PID:1848
-
\??\c:\5xfxlrf.exec:\5xfxlrf.exe109⤵PID:316
-
\??\c:\bbhnbn.exec:\bbhnbn.exe110⤵PID:3008
-
\??\c:\pdpjv.exec:\pdpjv.exe111⤵PID:2988
-
\??\c:\ddvvd.exec:\ddvvd.exe112⤵PID:2240
-
\??\c:\lllrrxr.exec:\lllrrxr.exe113⤵PID:2132
-
\??\c:\xxlxfrl.exec:\xxlxfrl.exe114⤵PID:2332
-
\??\c:\hhnnnt.exec:\hhnnnt.exe115⤵PID:1580
-
\??\c:\ntnnht.exec:\ntnnht.exe116⤵PID:2484
-
\??\c:\jdvjp.exec:\jdvjp.exe117⤵PID:1072
-
\??\c:\pvjpp.exec:\pvjpp.exe118⤵PID:1904
-
\??\c:\ffxfllx.exec:\ffxfllx.exe119⤵PID:2568
-
\??\c:\rrfxrrf.exec:\rrfxrrf.exe120⤵PID:1544
-
\??\c:\1nhhnn.exec:\1nhhnn.exe121⤵PID:1748
-
\??\c:\btnthh.exec:\btnthh.exe122⤵PID:596
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-