Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24-11-2024 15:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d8b7c84fce5ecafc40e0d3f27958f4af51998543c46478efd4f63e801d5380cb.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
d8b7c84fce5ecafc40e0d3f27958f4af51998543c46478efd4f63e801d5380cb.exe
-
Size
455KB
-
MD5
8b20675963df36c04f1917d26c491614
-
SHA1
4cd4a85b76dcedfb3e1f6286cbd400b1cf1bc22f
-
SHA256
d8b7c84fce5ecafc40e0d3f27958f4af51998543c46478efd4f63e801d5380cb
-
SHA512
6908029fa66341c70a58da031a2b75a7b1f1efb231702daa0cf54c892064093f4ed19fd7e4da0430603194a4b9edccf54a5b459a1b0de56ac28653cb1267463a
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeE:q7Tc2NYHUrAwfMp3CDE
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/2120-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2528-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2452-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/444-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2464-112-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2464-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/340-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1916-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1748-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/316-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1520-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/692-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1876-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2528-317-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1924-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3052-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-473-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1144-492-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/348-519-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-719-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2232-744-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/644-812-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2556-849-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1860-1019-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1712 rflxxrl.exe 2528 nhnnbh.exe 2452 vpvpp.exe 444 vjvvv.exe 2824 3rfffxf.exe 2712 7tbbbb.exe 2764 7dpjd.exe 2704 3xfxrrl.exe 2716 9btntn.exe 2680 dvpjd.exe 2464 rffxrll.exe 340 hbnttb.exe 2976 lxrlxrf.exe 1916 5hnnhn.exe 2672 dvjpp.exe 1748 frffffl.exe 1676 tthnbb.exe 3004 nbbttt.exe 316 3vdvv.exe 2072 9fxxrlr.exe 836 ttbnbt.exe 408 pdpvv.exe 1540 rrxxxrr.exe 348 bntttn.exe 2644 pjpvd.exe 1520 xlfrrll.exe 2520 btntbb.exe 692 9dvdd.exe 1876 7pvpv.exe 2500 7htbhn.exe 2308 jvjdd.exe 2324 rfrrxrr.exe 2528 ttbhtt.exe 1924 thbbbt.exe 2452 jpdvv.exe 2128 bbbtbb.exe 3052 jvjjp.exe 2824 lfrrfff.exe 2720 xrffffl.exe 3044 pjpjj.exe 2944 vpppp.exe 2600 5rfflll.exe 2716 7bnntn.exe 2348 vpddd.exe 1132 jppjj.exe 1828 rfrrxxf.exe 2928 7nnhhh.exe 2984 dpjjj.exe 2976 dpddd.exe 2780 lxflfxl.exe 1388 3hbhnn.exe 2672 jdppp.exe 2012 vpvdd.exe 3016 9frrlff.exe 3020 tnbhhn.exe 676 thtntn.exe 2060 pdjjd.exe 2516 xrllrxx.exe 568 9lfffff.exe 1144 7hbtbb.exe 448 1btnnn.exe 2588 jvdpv.exe 1968 xlfflfx.exe 348 nbhttt.exe -
resource yara_rule behavioral1/memory/2120-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/444-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/444-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/340-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1916-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/316-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1520-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/692-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1876-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1924-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-473-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-499-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/348-519-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/884-562-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-600-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-662-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1868-687-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-751-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-779-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-850-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-881-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-889-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1136-939-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1868-964-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1860-1019-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/816-1044-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-1087-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-1094-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-1155-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlxrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllfffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrfflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bnnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1httbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nhntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2120 wrote to memory of 1712 2120 d8b7c84fce5ecafc40e0d3f27958f4af51998543c46478efd4f63e801d5380cb.exe 30 PID 2120 wrote to memory of 1712 2120 d8b7c84fce5ecafc40e0d3f27958f4af51998543c46478efd4f63e801d5380cb.exe 30 PID 2120 wrote to memory of 1712 2120 d8b7c84fce5ecafc40e0d3f27958f4af51998543c46478efd4f63e801d5380cb.exe 30 PID 2120 wrote to memory of 1712 2120 d8b7c84fce5ecafc40e0d3f27958f4af51998543c46478efd4f63e801d5380cb.exe 30 PID 1712 wrote to memory of 2528 1712 rflxxrl.exe 31 PID 1712 wrote to memory of 2528 1712 rflxxrl.exe 31 PID 1712 wrote to memory of 2528 1712 rflxxrl.exe 31 PID 1712 wrote to memory of 2528 1712 rflxxrl.exe 31 PID 2528 wrote to memory of 2452 2528 nhnnbh.exe 32 PID 2528 wrote to memory of 2452 2528 nhnnbh.exe 32 PID 2528 wrote to memory of 2452 2528 nhnnbh.exe 32 PID 2528 wrote to memory of 2452 2528 nhnnbh.exe 32 PID 2452 wrote to memory of 444 2452 vpvpp.exe 33 PID 2452 wrote to memory of 444 2452 vpvpp.exe 33 PID 2452 wrote to memory of 444 2452 vpvpp.exe 33 PID 2452 wrote to memory of 444 2452 vpvpp.exe 33 PID 444 wrote to memory of 2824 444 vjvvv.exe 34 PID 444 wrote to memory of 2824 444 vjvvv.exe 34 PID 444 wrote to memory of 2824 444 vjvvv.exe 34 PID 444 wrote to memory of 2824 444 vjvvv.exe 34 PID 2824 wrote to memory of 2712 2824 3rfffxf.exe 35 PID 2824 wrote to memory of 2712 2824 3rfffxf.exe 35 PID 2824 wrote to memory of 2712 2824 3rfffxf.exe 35 PID 2824 wrote to memory of 2712 2824 3rfffxf.exe 35 PID 2712 wrote to memory of 2764 2712 7tbbbb.exe 36 PID 2712 wrote to memory of 2764 2712 7tbbbb.exe 36 PID 2712 wrote to memory of 2764 2712 7tbbbb.exe 36 PID 2712 wrote to memory of 2764 2712 7tbbbb.exe 36 PID 2764 wrote to memory of 2704 2764 7dpjd.exe 37 PID 2764 wrote to memory of 2704 2764 7dpjd.exe 37 PID 2764 wrote to memory of 2704 2764 7dpjd.exe 37 PID 2764 wrote to memory of 2704 2764 7dpjd.exe 37 PID 2704 wrote to memory of 2716 2704 3xfxrrl.exe 38 PID 2704 wrote to memory of 2716 2704 3xfxrrl.exe 38 PID 2704 wrote to memory of 2716 2704 3xfxrrl.exe 38 PID 2704 wrote to memory of 2716 2704 3xfxrrl.exe 38 PID 2716 wrote to memory of 2680 2716 9btntn.exe 39 PID 2716 wrote to memory of 2680 2716 9btntn.exe 39 PID 2716 wrote to memory of 2680 2716 9btntn.exe 39 PID 2716 wrote to memory of 2680 2716 9btntn.exe 39 PID 2680 wrote to memory of 2464 2680 dvpjd.exe 40 PID 2680 wrote to memory of 2464 2680 dvpjd.exe 40 PID 2680 wrote to memory of 2464 2680 dvpjd.exe 40 PID 2680 wrote to memory of 2464 2680 dvpjd.exe 40 PID 2464 wrote to memory of 340 2464 rffxrll.exe 41 PID 2464 wrote to memory of 340 2464 rffxrll.exe 41 PID 2464 wrote to memory of 340 2464 rffxrll.exe 41 PID 2464 wrote to memory of 340 2464 rffxrll.exe 41 PID 340 wrote to memory of 2976 340 hbnttb.exe 42 PID 340 wrote to memory of 2976 340 hbnttb.exe 42 PID 340 wrote to memory of 2976 340 hbnttb.exe 42 PID 340 wrote to memory of 2976 340 hbnttb.exe 42 PID 2976 wrote to memory of 1916 2976 lxrlxrf.exe 43 PID 2976 wrote to memory of 1916 2976 lxrlxrf.exe 43 PID 2976 wrote to memory of 1916 2976 lxrlxrf.exe 43 PID 2976 wrote to memory of 1916 2976 lxrlxrf.exe 43 PID 1916 wrote to memory of 2672 1916 5hnnhn.exe 44 PID 1916 wrote to memory of 2672 1916 5hnnhn.exe 44 PID 1916 wrote to memory of 2672 1916 5hnnhn.exe 44 PID 1916 wrote to memory of 2672 1916 5hnnhn.exe 44 PID 2672 wrote to memory of 1748 2672 dvjpp.exe 45 PID 2672 wrote to memory of 1748 2672 dvjpp.exe 45 PID 2672 wrote to memory of 1748 2672 dvjpp.exe 45 PID 2672 wrote to memory of 1748 2672 dvjpp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\d8b7c84fce5ecafc40e0d3f27958f4af51998543c46478efd4f63e801d5380cb.exe"C:\Users\Admin\AppData\Local\Temp\d8b7c84fce5ecafc40e0d3f27958f4af51998543c46478efd4f63e801d5380cb.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\rflxxrl.exec:\rflxxrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\nhnnbh.exec:\nhnnbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\vpvpp.exec:\vpvpp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\vjvvv.exec:\vjvvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:444 -
\??\c:\3rfffxf.exec:\3rfffxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\7tbbbb.exec:\7tbbbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\7dpjd.exec:\7dpjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\3xfxrrl.exec:\3xfxrrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\9btntn.exec:\9btntn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\dvpjd.exec:\dvpjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\rffxrll.exec:\rffxrll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\hbnttb.exec:\hbnttb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:340 -
\??\c:\lxrlxrf.exec:\lxrlxrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\5hnnhn.exec:\5hnnhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\dvjpp.exec:\dvjpp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\frffffl.exec:\frffffl.exe17⤵
- Executes dropped EXE
PID:1748 -
\??\c:\tthnbb.exec:\tthnbb.exe18⤵
- Executes dropped EXE
PID:1676 -
\??\c:\nbbttt.exec:\nbbttt.exe19⤵
- Executes dropped EXE
PID:3004 -
\??\c:\3vdvv.exec:\3vdvv.exe20⤵
- Executes dropped EXE
PID:316 -
\??\c:\9fxxrlr.exec:\9fxxrlr.exe21⤵
- Executes dropped EXE
PID:2072 -
\??\c:\ttbnbt.exec:\ttbnbt.exe22⤵
- Executes dropped EXE
PID:836 -
\??\c:\pdpvv.exec:\pdpvv.exe23⤵
- Executes dropped EXE
PID:408 -
\??\c:\rrxxxrr.exec:\rrxxxrr.exe24⤵
- Executes dropped EXE
PID:1540 -
\??\c:\bntttn.exec:\bntttn.exe25⤵
- Executes dropped EXE
PID:348 -
\??\c:\pjpvd.exec:\pjpvd.exe26⤵
- Executes dropped EXE
PID:2644 -
\??\c:\xlfrrll.exec:\xlfrrll.exe27⤵
- Executes dropped EXE
PID:1520 -
\??\c:\btntbb.exec:\btntbb.exe28⤵
- Executes dropped EXE
PID:2520 -
\??\c:\9dvdd.exec:\9dvdd.exe29⤵
- Executes dropped EXE
PID:692 -
\??\c:\7pvpv.exec:\7pvpv.exe30⤵
- Executes dropped EXE
PID:1876 -
\??\c:\7htbhn.exec:\7htbhn.exe31⤵
- Executes dropped EXE
PID:2500 -
\??\c:\jvjdd.exec:\jvjdd.exe32⤵
- Executes dropped EXE
PID:2308 -
\??\c:\rfrrxrr.exec:\rfrrxrr.exe33⤵
- Executes dropped EXE
PID:2324 -
\??\c:\ttbhtt.exec:\ttbhtt.exe34⤵
- Executes dropped EXE
PID:2528 -
\??\c:\thbbbt.exec:\thbbbt.exe35⤵
- Executes dropped EXE
PID:1924 -
\??\c:\jpdvv.exec:\jpdvv.exe36⤵
- Executes dropped EXE
PID:2452 -
\??\c:\bbbtbb.exec:\bbbtbb.exe37⤵
- Executes dropped EXE
PID:2128 -
\??\c:\jvjjp.exec:\jvjjp.exe38⤵
- Executes dropped EXE
PID:3052 -
\??\c:\lfrrfff.exec:\lfrrfff.exe39⤵
- Executes dropped EXE
PID:2824 -
\??\c:\xrffffl.exec:\xrffffl.exe40⤵
- Executes dropped EXE
PID:2720 -
\??\c:\pjpjj.exec:\pjpjj.exe41⤵
- Executes dropped EXE
PID:3044 -
\??\c:\vpppp.exec:\vpppp.exe42⤵
- Executes dropped EXE
PID:2944 -
\??\c:\5rfflll.exec:\5rfflll.exe43⤵
- Executes dropped EXE
PID:2600 -
\??\c:\7bnntn.exec:\7bnntn.exe44⤵
- Executes dropped EXE
PID:2716 -
\??\c:\vpddd.exec:\vpddd.exe45⤵
- Executes dropped EXE
PID:2348 -
\??\c:\jppjj.exec:\jppjj.exe46⤵
- Executes dropped EXE
PID:1132 -
\??\c:\rfrrxxf.exec:\rfrrxxf.exe47⤵
- Executes dropped EXE
PID:1828 -
\??\c:\7nnhhh.exec:\7nnhhh.exe48⤵
- Executes dropped EXE
PID:2928 -
\??\c:\dpjjj.exec:\dpjjj.exe49⤵
- Executes dropped EXE
PID:2984 -
\??\c:\dpddd.exec:\dpddd.exe50⤵
- Executes dropped EXE
PID:2976 -
\??\c:\lxflfxl.exec:\lxflfxl.exe51⤵
- Executes dropped EXE
PID:2780 -
\??\c:\3hbhnn.exec:\3hbhnn.exe52⤵
- Executes dropped EXE
PID:1388 -
\??\c:\jdppp.exec:\jdppp.exe53⤵
- Executes dropped EXE
PID:2672 -
\??\c:\vpvdd.exec:\vpvdd.exe54⤵
- Executes dropped EXE
PID:2012 -
\??\c:\9frrlff.exec:\9frrlff.exe55⤵
- Executes dropped EXE
PID:3016 -
\??\c:\tnbhhn.exec:\tnbhhn.exe56⤵
- Executes dropped EXE
PID:3020 -
\??\c:\thtntn.exec:\thtntn.exe57⤵
- Executes dropped EXE
PID:676 -
\??\c:\pdjjd.exec:\pdjjd.exe58⤵
- Executes dropped EXE
PID:2060 -
\??\c:\xrllrxx.exec:\xrllrxx.exe59⤵
- Executes dropped EXE
PID:2516 -
\??\c:\9lfffff.exec:\9lfffff.exe60⤵
- Executes dropped EXE
PID:568 -
\??\c:\7hbtbb.exec:\7hbtbb.exe61⤵
- Executes dropped EXE
PID:1144 -
\??\c:\1btnnn.exec:\1btnnn.exe62⤵
- Executes dropped EXE
PID:448 -
\??\c:\jvdpv.exec:\jvdpv.exe63⤵
- Executes dropped EXE
PID:2588 -
\??\c:\xlfflfx.exec:\xlfflfx.exe64⤵
- Executes dropped EXE
PID:1968 -
\??\c:\nbhttt.exec:\nbhttt.exe65⤵
- Executes dropped EXE
PID:348 -
\??\c:\hthhnt.exec:\hthhnt.exe66⤵PID:352
-
\??\c:\3jvdd.exec:\3jvdd.exe67⤵PID:1520
-
\??\c:\5lrrfll.exec:\5lrrfll.exe68⤵PID:3060
-
\??\c:\bhtntn.exec:\bhtntn.exe69⤵PID:760
-
\??\c:\tnbhnn.exec:\tnbhnn.exe70⤵PID:1324
-
\??\c:\vjvvv.exec:\vjvvv.exe71⤵PID:1844
-
\??\c:\lxrlllr.exec:\lxrlllr.exe72⤵PID:2500
-
\??\c:\rrrrfrx.exec:\rrrrfrx.exe73⤵PID:884
-
\??\c:\tthhth.exec:\tthhth.exe74⤵PID:1576
-
\??\c:\jdpvv.exec:\jdpvv.exe75⤵PID:2324
-
\??\c:\vvdjp.exec:\vvdjp.exe76⤵PID:2092
-
\??\c:\xlxxxxl.exec:\xlxxxxl.exe77⤵PID:2328
-
\??\c:\3nnhbt.exec:\3nnhbt.exe78⤵PID:3032
-
\??\c:\1httbb.exec:\1httbb.exe79⤵
- System Location Discovery: System Language Discovery
PID:2696 -
\??\c:\ddpjj.exec:\ddpjj.exe80⤵PID:2128
-
\??\c:\vjvpp.exec:\vjvpp.exe81⤵PID:2848
-
\??\c:\9flfrlr.exec:\9flfrlr.exe82⤵PID:2824
-
\??\c:\5htntt.exec:\5htntt.exe83⤵PID:2736
-
\??\c:\9hnhhh.exec:\9hnhhh.exe84⤵PID:2852
-
\??\c:\vpddd.exec:\vpddd.exe85⤵PID:2604
-
\??\c:\lrrlrlf.exec:\lrrlrlf.exe86⤵PID:2660
-
\??\c:\lrfllff.exec:\lrfllff.exe87⤵PID:2656
-
\??\c:\9hthhb.exec:\9hthhb.exe88⤵PID:2648
-
\??\c:\jvjdv.exec:\jvjdv.exe89⤵PID:2464
-
\??\c:\frxrrff.exec:\frxrrff.exe90⤵PID:2664
-
\??\c:\9xllfff.exec:\9xllfff.exe91⤵PID:2140
-
\??\c:\bntnnh.exec:\bntnnh.exe92⤵PID:2920
-
\??\c:\nbbnhh.exec:\nbbnhh.exe93⤵PID:1868
-
\??\c:\ppjdv.exec:\ppjdv.exe94⤵PID:1308
-
\??\c:\lxffffr.exec:\lxffffr.exe95⤵PID:1232
-
\??\c:\lxlxrlr.exec:\lxlxrlr.exe96⤵
- System Location Discovery: System Language Discovery
PID:1748 -
\??\c:\nbhbhb.exec:\nbhbhb.exe97⤵PID:2960
-
\??\c:\vpvvd.exec:\vpvvd.exe98⤵PID:2988
-
\??\c:\7jvvv.exec:\7jvvv.exe99⤵PID:3004
-
\??\c:\7xxrlll.exec:\7xxrlll.exe100⤵PID:2204
-
\??\c:\7ntnbt.exec:\7ntnbt.exe101⤵PID:2232
-
\??\c:\nhnhht.exec:\nhnhht.exe102⤵PID:2188
-
\??\c:\jvjdv.exec:\jvjdv.exe103⤵PID:1920
-
\??\c:\lxfxfxx.exec:\lxfxfxx.exe104⤵PID:2180
-
\??\c:\xlfrrll.exec:\xlfrrll.exe105⤵PID:1604
-
\??\c:\bnbhhn.exec:\bnbhhn.exe106⤵PID:2132
-
\??\c:\pvjdj.exec:\pvjdj.exe107⤵PID:1764
-
\??\c:\vjpjj.exec:\vjpjj.exe108⤵PID:3064
-
\??\c:\9lrlfxl.exec:\9lrlfxl.exe109⤵PID:2116
-
\??\c:\1bnhnh.exec:\1bnhnh.exe110⤵PID:2284
-
\??\c:\5jppv.exec:\5jppv.exe111⤵PID:644
-
\??\c:\ppdpv.exec:\ppdpv.exe112⤵PID:2448
-
\??\c:\lxllrrx.exec:\lxllrrx.exe113⤵PID:1740
-
\??\c:\bnttbh.exec:\bnttbh.exe114⤵PID:1188
-
\??\c:\7jdjv.exec:\7jdjv.exe115⤵PID:2412
-
\??\c:\jdppv.exec:\jdppv.exe116⤵PID:1668
-
\??\c:\9lrlfrx.exec:\9lrlfrx.exe117⤵PID:2556
-
\??\c:\htbnnh.exec:\htbnnh.exe118⤵PID:2408
-
\??\c:\1pdjj.exec:\1pdjj.exe119⤵PID:2528
-
\??\c:\flrllll.exec:\flrllll.exe120⤵PID:2760
-
\??\c:\rrfxllx.exec:\rrfxllx.exe121⤵PID:540
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-