Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24-11-2024 18:37
Behavioral task
behavioral1
Sample
16566cc7726c4562e66b8f2ead1301459ee78d326d30b0b4dd8ece8c6538a550N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
16566cc7726c4562e66b8f2ead1301459ee78d326d30b0b4dd8ece8c6538a550N.exe
-
Size
332KB
-
MD5
4b02ea9cc214e3ed7f37638b15b47cc0
-
SHA1
13c53723b273e70abceced1f509a3c99d820f932
-
SHA256
16566cc7726c4562e66b8f2ead1301459ee78d326d30b0b4dd8ece8c6538a550
-
SHA512
478509377ce0297c15efe8b2b78621a5f028792609c9ea2a12a00945c400b497609c3457d8ea72a38a1ecd3ff0b6d1e4e66d59c82ab96f859dbdd17eb24c771b
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbew/:R4wFHoSHYHUrAwfMp3CD8
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/2748-0-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2776-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2208-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2812-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2256-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2556-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2620-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/288-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/288-65-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/800-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/560-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/560-110-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2860-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1864-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/592-143-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/592-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1852-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/872-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2456-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2096-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3004-236-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/896-275-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1628-274-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2792-287-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2940-321-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3052-343-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/320-354-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2520-365-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/280-372-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2016-410-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1868-421-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1632-472-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1308-478-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/352-484-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1056-495-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2312-512-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/272-543-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2832-564-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2844-575-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2004-662-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1752-683-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2932-937-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/1860-965-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2748-1071-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2500-1326-0x00000000772F0000-0x00000000773EA000-memory.dmp family_blackmoon behavioral1/memory/2500-1325-0x00000000773F0000-0x000000007750F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2776 xrxlllr.exe 2208 tnbbnn.exe 2812 rffxxlf.exe 2256 tnhtnt.exe 2556 btnbnn.exe 2620 xlxllrf.exe 288 ntbntn.exe 320 1rfrlll.exe 800 xrlrrxf.exe 2260 pjpjv.exe 2352 1flflrx.exe 2076 1ttttt.exe 560 vjpjj.exe 2624 rlffxxf.exe 2860 bnttbb.exe 1864 ppvdj.exe 592 fxrxxxl.exe 1784 ppvvd.exe 1852 1dpjp.exe 872 tnbhtt.exe 2456 9vpvd.exe 1952 7tnnnt.exe 1416 pjddv.exe 2096 xrrflxl.exe 1192 nbthtt.exe 1712 pjpvj.exe 1228 bhnnnn.exe 760 dvjdj.exe 3004 lfrrfxf.exe 916 tnbbhh.exe 2488 djjvj.exe 2524 fxrlrrx.exe 2416 thtttt.exe 328 dppjp.exe 1628 dpvpj.exe 896 fxrlfll.exe 2792 1hbthh.exe 1508 pdjjj.exe 1644 pdpjd.exe 2708 lxrrxrx.exe 2208 hbnttt.exe 2816 nbhhhb.exe 2940 1vjdd.exe 2568 dvvvv.exe 2556 lxlffxf.exe 3036 nnbbhh.exe 3052 nbhnbb.exe 2428 dpdjv.exe 320 pdppp.exe 664 lxxflff.exe 2520 bnhhnn.exe 280 jdjpd.exe 300 vjvdd.exe 2900 5lrrxrx.exe 2868 3hnnnh.exe 2892 nhtbbh.exe 2920 jdjpv.exe 2924 xrfflfl.exe 2016 fxffrxx.exe 3028 htbbtt.exe 1868 pjvdp.exe 1784 5vdpj.exe 2372 llxxlrx.exe 2440 bbthnh.exe -
resource yara_rule behavioral1/memory/2748-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000001211a-5.dat upx behavioral1/memory/2776-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015d7e-16.dat upx behavioral1/memory/2776-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2208-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015d87-25.dat upx behavioral1/memory/2208-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015d8f-33.dat upx behavioral1/memory/2812-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2256-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015d9a-41.dat upx behavioral1/memory/2556-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015da7-49.dat upx behavioral1/memory/2556-48-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x000a000000015db1-58.dat upx behavioral1/memory/2620-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/288-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000015e18-66.dat upx behavioral1/files/0x0006000000016c84-74.dat upx behavioral1/memory/800-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016cd1-81.dat upx behavioral1/files/0x0006000000016cfc-89.dat upx behavioral1/files/0x0006000000016d25-96.dat upx behavioral1/files/0x0006000000016d36-103.dat upx behavioral1/memory/560-112-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d3e-111.dat upx behavioral1/memory/560-110-0x00000000001B0000-0x00000000001D7000-memory.dmp upx behavioral1/files/0x0006000000016d46-119.dat upx behavioral1/memory/2860-127-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d96-126.dat upx behavioral1/files/0x0006000000016d9a-135.dat upx behavioral1/memory/1864-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/592-136-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016dbe-144.dat upx behavioral1/memory/1784-146-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/592-145-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016dd1-153.dat upx behavioral1/memory/1852-160-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/872-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x002e000000015d36-162.dat upx behavioral1/files/0x0006000000016dd7-169.dat upx behavioral1/files/0x0006000000016ea4-177.dat upx behavioral1/memory/2456-176-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016eca-184.dat upx behavioral1/files/0x000600000001706d-191.dat upx behavioral1/files/0x00060000000173da-199.dat upx behavioral1/memory/2096-198-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000173f1-206.dat upx behavioral1/files/0x00060000000173f4-215.dat upx behavioral1/files/0x00060000000173fc-222.dat upx behavioral1/files/0x0006000000017472-229.dat upx behavioral1/files/0x0006000000017487-237.dat upx behavioral1/memory/3004-236-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000174a2-244.dat upx behavioral1/files/0x0006000000017525-252.dat upx behavioral1/memory/896-275-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1628-274-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2792-281-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2792-287-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2940-321-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/320-354-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2520-365-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/280-372-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hhbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nhhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxlrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbntnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrlrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2748 wrote to memory of 2776 2748 16566cc7726c4562e66b8f2ead1301459ee78d326d30b0b4dd8ece8c6538a550N.exe 30 PID 2748 wrote to memory of 2776 2748 16566cc7726c4562e66b8f2ead1301459ee78d326d30b0b4dd8ece8c6538a550N.exe 30 PID 2748 wrote to memory of 2776 2748 16566cc7726c4562e66b8f2ead1301459ee78d326d30b0b4dd8ece8c6538a550N.exe 30 PID 2748 wrote to memory of 2776 2748 16566cc7726c4562e66b8f2ead1301459ee78d326d30b0b4dd8ece8c6538a550N.exe 30 PID 2776 wrote to memory of 2208 2776 xrxlllr.exe 31 PID 2776 wrote to memory of 2208 2776 xrxlllr.exe 31 PID 2776 wrote to memory of 2208 2776 xrxlllr.exe 31 PID 2776 wrote to memory of 2208 2776 xrxlllr.exe 31 PID 2208 wrote to memory of 2812 2208 tnbbnn.exe 32 PID 2208 wrote to memory of 2812 2208 tnbbnn.exe 32 PID 2208 wrote to memory of 2812 2208 tnbbnn.exe 32 PID 2208 wrote to memory of 2812 2208 tnbbnn.exe 32 PID 2812 wrote to memory of 2256 2812 rffxxlf.exe 33 PID 2812 wrote to memory of 2256 2812 rffxxlf.exe 33 PID 2812 wrote to memory of 2256 2812 rffxxlf.exe 33 PID 2812 wrote to memory of 2256 2812 rffxxlf.exe 33 PID 2256 wrote to memory of 2556 2256 tnhtnt.exe 34 PID 2256 wrote to memory of 2556 2256 tnhtnt.exe 34 PID 2256 wrote to memory of 2556 2256 tnhtnt.exe 34 PID 2256 wrote to memory of 2556 2256 tnhtnt.exe 34 PID 2556 wrote to memory of 2620 2556 btnbnn.exe 35 PID 2556 wrote to memory of 2620 2556 btnbnn.exe 35 PID 2556 wrote to memory of 2620 2556 btnbnn.exe 35 PID 2556 wrote to memory of 2620 2556 btnbnn.exe 35 PID 2620 wrote to memory of 288 2620 xlxllrf.exe 36 PID 2620 wrote to memory of 288 2620 xlxllrf.exe 36 PID 2620 wrote to memory of 288 2620 xlxllrf.exe 36 PID 2620 wrote to memory of 288 2620 xlxllrf.exe 36 PID 288 wrote to memory of 320 288 ntbntn.exe 37 PID 288 wrote to memory of 320 288 ntbntn.exe 37 PID 288 wrote to memory of 320 288 ntbntn.exe 37 PID 288 wrote to memory of 320 288 ntbntn.exe 37 PID 320 wrote to memory of 800 320 1rfrlll.exe 38 PID 320 wrote to memory of 800 320 1rfrlll.exe 38 PID 320 wrote to memory of 800 320 1rfrlll.exe 38 PID 320 wrote to memory of 800 320 1rfrlll.exe 38 PID 800 wrote to memory of 2260 800 xrlrrxf.exe 39 PID 800 wrote to memory of 2260 800 xrlrrxf.exe 39 PID 800 wrote to memory of 2260 800 xrlrrxf.exe 39 PID 800 wrote to memory of 2260 800 xrlrrxf.exe 39 PID 2260 wrote to memory of 2352 2260 pjpjv.exe 40 PID 2260 wrote to memory of 2352 2260 pjpjv.exe 40 PID 2260 wrote to memory of 2352 2260 pjpjv.exe 40 PID 2260 wrote to memory of 2352 2260 pjpjv.exe 40 PID 2352 wrote to memory of 2076 2352 1flflrx.exe 41 PID 2352 wrote to memory of 2076 2352 1flflrx.exe 41 PID 2352 wrote to memory of 2076 2352 1flflrx.exe 41 PID 2352 wrote to memory of 2076 2352 1flflrx.exe 41 PID 2076 wrote to memory of 560 2076 1ttttt.exe 42 PID 2076 wrote to memory of 560 2076 1ttttt.exe 42 PID 2076 wrote to memory of 560 2076 1ttttt.exe 42 PID 2076 wrote to memory of 560 2076 1ttttt.exe 42 PID 560 wrote to memory of 2624 560 vjpjj.exe 43 PID 560 wrote to memory of 2624 560 vjpjj.exe 43 PID 560 wrote to memory of 2624 560 vjpjj.exe 43 PID 560 wrote to memory of 2624 560 vjpjj.exe 43 PID 2624 wrote to memory of 2860 2624 rlffxxf.exe 44 PID 2624 wrote to memory of 2860 2624 rlffxxf.exe 44 PID 2624 wrote to memory of 2860 2624 rlffxxf.exe 44 PID 2624 wrote to memory of 2860 2624 rlffxxf.exe 44 PID 2860 wrote to memory of 1864 2860 bnttbb.exe 45 PID 2860 wrote to memory of 1864 2860 bnttbb.exe 45 PID 2860 wrote to memory of 1864 2860 bnttbb.exe 45 PID 2860 wrote to memory of 1864 2860 bnttbb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\16566cc7726c4562e66b8f2ead1301459ee78d326d30b0b4dd8ece8c6538a550N.exe"C:\Users\Admin\AppData\Local\Temp\16566cc7726c4562e66b8f2ead1301459ee78d326d30b0b4dd8ece8c6538a550N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\xrxlllr.exec:\xrxlllr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\tnbbnn.exec:\tnbbnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\rffxxlf.exec:\rffxxlf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\tnhtnt.exec:\tnhtnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\btnbnn.exec:\btnbnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\xlxllrf.exec:\xlxllrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\ntbntn.exec:\ntbntn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:288 -
\??\c:\1rfrlll.exec:\1rfrlll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\xrlrrxf.exec:\xrlrrxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:800 -
\??\c:\pjpjv.exec:\pjpjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\1flflrx.exec:\1flflrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\1ttttt.exec:\1ttttt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\vjpjj.exec:\vjpjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
\??\c:\rlffxxf.exec:\rlffxxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\bnttbb.exec:\bnttbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\ppvdj.exec:\ppvdj.exe17⤵
- Executes dropped EXE
PID:1864 -
\??\c:\fxrxxxl.exec:\fxrxxxl.exe18⤵
- Executes dropped EXE
PID:592 -
\??\c:\ppvvd.exec:\ppvvd.exe19⤵
- Executes dropped EXE
PID:1784 -
\??\c:\1dpjp.exec:\1dpjp.exe20⤵
- Executes dropped EXE
PID:1852 -
\??\c:\tnbhtt.exec:\tnbhtt.exe21⤵
- Executes dropped EXE
PID:872 -
\??\c:\9vpvd.exec:\9vpvd.exe22⤵
- Executes dropped EXE
PID:2456 -
\??\c:\7tnnnt.exec:\7tnnnt.exe23⤵
- Executes dropped EXE
PID:1952 -
\??\c:\pjddv.exec:\pjddv.exe24⤵
- Executes dropped EXE
PID:1416 -
\??\c:\xrrflxl.exec:\xrrflxl.exe25⤵
- Executes dropped EXE
PID:2096 -
\??\c:\nbthtt.exec:\nbthtt.exe26⤵
- Executes dropped EXE
PID:1192 -
\??\c:\pjpvj.exec:\pjpvj.exe27⤵
- Executes dropped EXE
PID:1712 -
\??\c:\bhnnnn.exec:\bhnnnn.exe28⤵
- Executes dropped EXE
PID:1228 -
\??\c:\dvjdj.exec:\dvjdj.exe29⤵
- Executes dropped EXE
PID:760 -
\??\c:\lfrrfxf.exec:\lfrrfxf.exe30⤵
- Executes dropped EXE
PID:3004 -
\??\c:\tnbbhh.exec:\tnbbhh.exe31⤵
- Executes dropped EXE
PID:916 -
\??\c:\djjvj.exec:\djjvj.exe32⤵
- Executes dropped EXE
PID:2488 -
\??\c:\fxrlrrx.exec:\fxrlrrx.exe33⤵
- Executes dropped EXE
PID:2524 -
\??\c:\thtttt.exec:\thtttt.exe34⤵
- Executes dropped EXE
PID:2416 -
\??\c:\dppjp.exec:\dppjp.exe35⤵
- Executes dropped EXE
PID:328 -
\??\c:\dpvpj.exec:\dpvpj.exe36⤵
- Executes dropped EXE
PID:1628 -
\??\c:\fxrlfll.exec:\fxrlfll.exe37⤵
- Executes dropped EXE
PID:896 -
\??\c:\1hbthh.exec:\1hbthh.exe38⤵
- Executes dropped EXE
PID:2792 -
\??\c:\pdjjj.exec:\pdjjj.exe39⤵
- Executes dropped EXE
PID:1508 -
\??\c:\pdpjd.exec:\pdpjd.exe40⤵
- Executes dropped EXE
PID:1644 -
\??\c:\lxrrxrx.exec:\lxrrxrx.exe41⤵
- Executes dropped EXE
PID:2708 -
\??\c:\hbnttt.exec:\hbnttt.exe42⤵
- Executes dropped EXE
PID:2208 -
\??\c:\nbhhhb.exec:\nbhhhb.exe43⤵
- Executes dropped EXE
PID:2816 -
\??\c:\1vjdd.exec:\1vjdd.exe44⤵
- Executes dropped EXE
PID:2940 -
\??\c:\dvvvv.exec:\dvvvv.exe45⤵
- Executes dropped EXE
PID:2568 -
\??\c:\lxlffxf.exec:\lxlffxf.exe46⤵
- Executes dropped EXE
PID:2556 -
\??\c:\nnbbhh.exec:\nnbbhh.exe47⤵
- Executes dropped EXE
PID:3036 -
\??\c:\nbhnbb.exec:\nbhnbb.exe48⤵
- Executes dropped EXE
PID:3052 -
\??\c:\dpdjv.exec:\dpdjv.exe49⤵
- Executes dropped EXE
PID:2428 -
\??\c:\pdppp.exec:\pdppp.exe50⤵
- Executes dropped EXE
PID:320 -
\??\c:\lxxflff.exec:\lxxflff.exe51⤵
- Executes dropped EXE
PID:664 -
\??\c:\bnhhnn.exec:\bnhhnn.exe52⤵
- Executes dropped EXE
PID:2520 -
\??\c:\jdjpd.exec:\jdjpd.exe53⤵
- Executes dropped EXE
PID:280 -
\??\c:\vjvdd.exec:\vjvdd.exe54⤵
- Executes dropped EXE
PID:300 -
\??\c:\5lrrxrx.exec:\5lrrxrx.exe55⤵
- Executes dropped EXE
PID:2900 -
\??\c:\3hnnnh.exec:\3hnnnh.exe56⤵
- Executes dropped EXE
PID:2868 -
\??\c:\nhtbbh.exec:\nhtbbh.exe57⤵
- Executes dropped EXE
PID:2892 -
\??\c:\jdjpv.exec:\jdjpv.exe58⤵
- Executes dropped EXE
PID:2920 -
\??\c:\xrfflfl.exec:\xrfflfl.exe59⤵
- Executes dropped EXE
PID:2924 -
\??\c:\fxffrxx.exec:\fxffrxx.exe60⤵
- Executes dropped EXE
PID:2016 -
\??\c:\htbbtt.exec:\htbbtt.exe61⤵
- Executes dropped EXE
PID:3028 -
\??\c:\pjvdp.exec:\pjvdp.exe62⤵
- Executes dropped EXE
PID:1868 -
\??\c:\5vdpj.exec:\5vdpj.exe63⤵
- Executes dropped EXE
PID:1784 -
\??\c:\llxxlrx.exec:\llxxlrx.exe64⤵
- Executes dropped EXE
PID:2372 -
\??\c:\bbthnh.exec:\bbthnh.exe65⤵
- Executes dropped EXE
PID:2440 -
\??\c:\nhntbh.exec:\nhntbh.exe66⤵PID:2276
-
\??\c:\ppddv.exec:\ppddv.exe67⤵PID:2280
-
\??\c:\lxxxrlr.exec:\lxxxrlr.exe68⤵PID:1956
-
\??\c:\7fllrxx.exec:\7fllrxx.exe69⤵PID:1132
-
\??\c:\nhbhtn.exec:\nhbhtn.exe70⤵PID:624
-
\??\c:\1jpdd.exec:\1jpdd.exe71⤵PID:856
-
\??\c:\vpjpp.exec:\vpjpp.exe72⤵PID:1632
-
\??\c:\xrxxxrr.exec:\xrxxxrr.exe73⤵PID:1308
-
\??\c:\thbtth.exec:\thbtth.exe74⤵PID:352
-
\??\c:\5tnttn.exec:\5tnttn.exe75⤵PID:1300
-
\??\c:\vjvvd.exec:\vjvvd.exe76⤵PID:1056
-
\??\c:\pjddj.exec:\pjddj.exe77⤵PID:1940
-
\??\c:\xllllfx.exec:\xllllfx.exe78⤵PID:2268
-
\??\c:\thnhtt.exec:\thnhtt.exe79⤵PID:2312
-
\??\c:\bthnhb.exec:\bthnhb.exe80⤵PID:2508
-
\??\c:\pddvd.exec:\pddvd.exe81⤵PID:2032
-
\??\c:\lxllrxx.exec:\lxllrxx.exe82⤵PID:1936
-
\??\c:\hhttbt.exec:\hhttbt.exe83⤵PID:2480
-
\??\c:\pddvv.exec:\pddvv.exe84⤵PID:1444
-
\??\c:\vjpdj.exec:\vjpdj.exe85⤵PID:272
-
\??\c:\lxlrrlr.exec:\lxlrrlr.exe86⤵PID:2284
-
\??\c:\thbnhn.exec:\thbnhn.exe87⤵PID:1640
-
\??\c:\hthhhh.exec:\hthhhh.exe88⤵PID:2712
-
\??\c:\9ppjp.exec:\9ppjp.exe89⤵PID:2832
-
\??\c:\9lrrrxx.exec:\9lrrrxx.exe90⤵PID:2564
-
\??\c:\3xllllr.exec:\3xllllr.exe91⤵PID:2844
-
\??\c:\httntn.exec:\httntn.exe92⤵PID:2604
-
\??\c:\bnnhnh.exec:\bnnhnh.exe93⤵PID:2580
-
\??\c:\5pdjj.exec:\5pdjj.exe94⤵PID:2560
-
\??\c:\9rrlffl.exec:\9rrlffl.exe95⤵PID:2728
-
\??\c:\7bhthh.exec:\7bhthh.exe96⤵PID:3040
-
\??\c:\bnnnhb.exec:\bnnnhb.exe97⤵PID:2656
-
\??\c:\dpdvd.exec:\dpdvd.exe98⤵PID:484
-
\??\c:\lffffll.exec:\lffffll.exe99⤵PID:1432
-
\??\c:\xrxxxxf.exec:\xrxxxxf.exe100⤵PID:1424
-
\??\c:\9nbttn.exec:\9nbttn.exe101⤵PID:2652
-
\??\c:\thnbbh.exec:\thnbbh.exe102⤵
- System Location Discovery: System Language Discovery
PID:2176 -
\??\c:\9vpvj.exec:\9vpvj.exe103⤵PID:2376
-
\??\c:\rlxxxxx.exec:\rlxxxxx.exe104⤵PID:300
-
\??\c:\frfllff.exec:\frfllff.exe105⤵PID:560
-
\??\c:\bntbbh.exec:\bntbbh.exe106⤵PID:2788
-
\??\c:\thnnbb.exec:\thnnbb.exe107⤵PID:2004
-
\??\c:\9jvdd.exec:\9jvdd.exe108⤵PID:1720
-
\??\c:\1frlfxx.exec:\1frlfxx.exe109⤵PID:2356
-
\??\c:\3lxxxxf.exec:\3lxxxxf.exe110⤵PID:2936
-
\??\c:\thhnbb.exec:\thhnbb.exe111⤵PID:1752
-
\??\c:\jdpvd.exec:\jdpvd.exe112⤵PID:400
-
\??\c:\vjpjj.exec:\vjpjj.exe113⤵PID:2968
-
\??\c:\fflrlfl.exec:\fflrlfl.exe114⤵PID:2372
-
\??\c:\bhnhht.exec:\bhnhht.exe115⤵PID:2440
-
\??\c:\hthhtt.exec:\hthhtt.exe116⤵PID:2000
-
\??\c:\dpdjp.exec:\dpdjp.exe117⤵PID:1788
-
\??\c:\xlflllr.exec:\xlflllr.exe118⤵PID:1288
-
\??\c:\lfllllr.exec:\lfllllr.exe119⤵PID:1416
-
\??\c:\3nhnbb.exec:\3nhnbb.exe120⤵PID:2096
-
\??\c:\9tnnnh.exec:\9tnnnh.exe121⤵PID:2288
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-