Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25/11/2024, 22:33
Behavioral task
behavioral1
Sample
5937caad0b58a1d3374f0aa1c5671874ff972bef6245e96422c3f1cca78b0ffd.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
5937caad0b58a1d3374f0aa1c5671874ff972bef6245e96422c3f1cca78b0ffd.exe
-
Size
97KB
-
MD5
01fa27dde01ea5f76ed1dbabf83524d4
-
SHA1
fe2cbd96dd8027dd3e1f2c250eadf1c8651a515e
-
SHA256
5937caad0b58a1d3374f0aa1c5671874ff972bef6245e96422c3f1cca78b0ffd
-
SHA512
1bc7d841afe6ddb1cf4e05f0b80cd933402a5effbc30da853af227b5f679442d26a605cad59b992357f2a1fbb853d66537255af1ca6bf6d76e37c688bafe989e
-
SSDEEP
3072:8hOmTsF93UYfwC6GIout0fmCiiiXA6mzgP:8cm4FmowdHoSgWrXUgP
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 57 IoCs
resource yara_rule behavioral1/memory/2692-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2936-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2708-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2836-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2900-39-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2912-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2640-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2000-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2676-73-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2676-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2424-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2956-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2696-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2340-107-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2340-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2884-116-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2884-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2880-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2984-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2368-150-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2368-152-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1448-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1304-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2816-183-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2476-191-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1752-199-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2096-207-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2180-216-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/880-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2388-247-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/344-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2520-276-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2200-287-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2736-319-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2928-325-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/560-361-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/560-360-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2300-374-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2992-396-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2012-430-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2184-460-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2520-557-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2656-592-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2612-601-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/1804-615-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2300-636-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2300-635-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2992-661-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2992-665-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/372-682-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1644-791-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/2908-811-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2884-894-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1796-7978-0x0000000077340000-0x000000007745F000-memory.dmp family_blackmoon behavioral1/memory/1796-12675-0x0000000077240000-0x000000007733A000-memory.dmp family_blackmoon behavioral1/memory/1796-12674-0x0000000077340000-0x000000007745F000-memory.dmp family_blackmoon behavioral1/memory/1796-22185-0x0000000077340000-0x000000007745F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2692 1hbnhn.exe 2708 pppvv.exe 2836 rllfrfr.exe 2900 bnbbnt.exe 2912 pdddp.exe 2640 5xrfrrl.exe 2000 xrrxrrl.exe 2676 ttbhbh.exe 2424 jdppv.exe 2956 xrfflll.exe 2696 lrxlxrr.exe 2340 tnbhnn.exe 2884 ddpvd.exe 2880 xrflfrx.exe 2984 nnhntt.exe 2036 9nbnhh.exe 2368 5dpvj.exe 1448 dpjdj.exe 1304 xfrrflf.exe 532 bbnntt.exe 2816 htbhnn.exe 2476 jdpjp.exe 1752 1rlfllf.exe 2096 nhbbbb.exe 2180 htnnbn.exe 1664 vvvjp.exe 880 3xlxllx.exe 704 fxffrlr.exe 2388 ttnbnn.exe 2404 jdddd.exe 344 jvjpp.exe 540 xrffxxr.exe 2520 bttbnt.exe 1704 vpvvd.exe 2200 jjdjv.exe 2376 xrfxffl.exe 2804 ffrrfxl.exe 2364 hbthbn.exe 2904 htbbth.exe 2228 jddjj.exe 2736 dvjjp.exe 2928 lxlfxrf.exe 2852 7bhbtt.exe 2596 3nbtbb.exe 2284 7dvdp.exe 2664 xlxlrrf.exe 2328 3fxlrlr.exe 560 1rxflff.exe 2120 nbttnb.exe 2300 vvppv.exe 2112 lfflflr.exe 764 llrlxxf.exe 2888 htnhnh.exe 2868 htnhtt.exe 2992 vvpjv.exe 2960 9lfllfl.exe 1508 7xxflxl.exe 2700 rlxxlrf.exe 2004 ntbbtn.exe 1764 dpvpd.exe 2012 1lflrrx.exe 1636 tbhbtt.exe 532 bhthnb.exe 2480 9ppvj.exe -
resource yara_rule behavioral1/memory/2936-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000a00000001225c-7.dat upx behavioral1/memory/2692-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2936-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016d33-15.dat upx behavioral1/files/0x0007000000016d46-23.dat upx behavioral1/memory/2708-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2836-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016d4a-32.dat upx behavioral1/files/0x0009000000016db3-40.dat upx behavioral1/memory/2912-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193fa-49.dat upx behavioral1/memory/2912-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019408-56.dat upx behavioral1/memory/2000-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2640-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2000-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019494-66.dat upx behavioral1/files/0x00050000000194a7-74.dat upx behavioral1/memory/2676-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2424-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194b4-83.dat upx behavioral1/files/0x00050000000194d4-91.dat upx behavioral1/memory/2956-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2696-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194da-100.dat upx behavioral1/files/0x00050000000194e2-108.dat upx behavioral1/memory/2340-109-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194ea-118.dat upx behavioral1/memory/2884-117-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2880-127-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2984-129-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194f2-128.dat upx behavioral1/files/0x00050000000194f6-136.dat upx behavioral1/files/0x0005000000019501-143.dat upx behavioral1/memory/2368-150-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019503-151.dat upx behavioral1/memory/1448-160-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019515-159.dat upx behavioral1/files/0x000500000001953a-168.dat upx behavioral1/memory/1304-167-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001957c-175.dat upx behavioral1/memory/2816-176-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019589-184.dat upx behavioral1/files/0x000500000001961b-192.dat upx behavioral1/memory/1752-199-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001961f-200.dat upx behavioral1/files/0x0005000000019624-208.dat upx behavioral1/memory/2180-209-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019625-217.dat upx behavioral1/memory/2180-216-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1664-222-0x0000000000430000-0x0000000000457000-memory.dmp upx behavioral1/files/0x00050000000197c1-226.dat upx behavioral1/files/0x0005000000019aea-233.dat upx behavioral1/memory/880-232-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019aec-240.dat upx behavioral1/files/0x0005000000019aee-248.dat upx behavioral1/memory/2388-247-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019c50-256.dat upx behavioral1/memory/344-263-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000016c81-264.dat upx behavioral1/memory/2520-276-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2200-287-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2736-319-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfffll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xlrllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3frlrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrxrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2936 wrote to memory of 2692 2936 5937caad0b58a1d3374f0aa1c5671874ff972bef6245e96422c3f1cca78b0ffd.exe 30 PID 2936 wrote to memory of 2692 2936 5937caad0b58a1d3374f0aa1c5671874ff972bef6245e96422c3f1cca78b0ffd.exe 30 PID 2936 wrote to memory of 2692 2936 5937caad0b58a1d3374f0aa1c5671874ff972bef6245e96422c3f1cca78b0ffd.exe 30 PID 2936 wrote to memory of 2692 2936 5937caad0b58a1d3374f0aa1c5671874ff972bef6245e96422c3f1cca78b0ffd.exe 30 PID 2692 wrote to memory of 2708 2692 1hbnhn.exe 31 PID 2692 wrote to memory of 2708 2692 1hbnhn.exe 31 PID 2692 wrote to memory of 2708 2692 1hbnhn.exe 31 PID 2692 wrote to memory of 2708 2692 1hbnhn.exe 31 PID 2708 wrote to memory of 2836 2708 pppvv.exe 32 PID 2708 wrote to memory of 2836 2708 pppvv.exe 32 PID 2708 wrote to memory of 2836 2708 pppvv.exe 32 PID 2708 wrote to memory of 2836 2708 pppvv.exe 32 PID 2836 wrote to memory of 2900 2836 rllfrfr.exe 33 PID 2836 wrote to memory of 2900 2836 rllfrfr.exe 33 PID 2836 wrote to memory of 2900 2836 rllfrfr.exe 33 PID 2836 wrote to memory of 2900 2836 rllfrfr.exe 33 PID 2900 wrote to memory of 2912 2900 bnbbnt.exe 34 PID 2900 wrote to memory of 2912 2900 bnbbnt.exe 34 PID 2900 wrote to memory of 2912 2900 bnbbnt.exe 34 PID 2900 wrote to memory of 2912 2900 bnbbnt.exe 34 PID 2912 wrote to memory of 2640 2912 pdddp.exe 35 PID 2912 wrote to memory of 2640 2912 pdddp.exe 35 PID 2912 wrote to memory of 2640 2912 pdddp.exe 35 PID 2912 wrote to memory of 2640 2912 pdddp.exe 35 PID 2640 wrote to memory of 2000 2640 5xrfrrl.exe 36 PID 2640 wrote to memory of 2000 2640 5xrfrrl.exe 36 PID 2640 wrote to memory of 2000 2640 5xrfrrl.exe 36 PID 2640 wrote to memory of 2000 2640 5xrfrrl.exe 36 PID 2000 wrote to memory of 2676 2000 xrrxrrl.exe 37 PID 2000 wrote to memory of 2676 2000 xrrxrrl.exe 37 PID 2000 wrote to memory of 2676 2000 xrrxrrl.exe 37 PID 2000 wrote to memory of 2676 2000 xrrxrrl.exe 37 PID 2676 wrote to memory of 2424 2676 ttbhbh.exe 38 PID 2676 wrote to memory of 2424 2676 ttbhbh.exe 38 PID 2676 wrote to memory of 2424 2676 ttbhbh.exe 38 PID 2676 wrote to memory of 2424 2676 ttbhbh.exe 38 PID 2424 wrote to memory of 2956 2424 jdppv.exe 39 PID 2424 wrote to memory of 2956 2424 jdppv.exe 39 PID 2424 wrote to memory of 2956 2424 jdppv.exe 39 PID 2424 wrote to memory of 2956 2424 jdppv.exe 39 PID 2956 wrote to memory of 2696 2956 xrfflll.exe 40 PID 2956 wrote to memory of 2696 2956 xrfflll.exe 40 PID 2956 wrote to memory of 2696 2956 xrfflll.exe 40 PID 2956 wrote to memory of 2696 2956 xrfflll.exe 40 PID 2696 wrote to memory of 2340 2696 lrxlxrr.exe 41 PID 2696 wrote to memory of 2340 2696 lrxlxrr.exe 41 PID 2696 wrote to memory of 2340 2696 lrxlxrr.exe 41 PID 2696 wrote to memory of 2340 2696 lrxlxrr.exe 41 PID 2340 wrote to memory of 2884 2340 tnbhnn.exe 42 PID 2340 wrote to memory of 2884 2340 tnbhnn.exe 42 PID 2340 wrote to memory of 2884 2340 tnbhnn.exe 42 PID 2340 wrote to memory of 2884 2340 tnbhnn.exe 42 PID 2884 wrote to memory of 2880 2884 ddpvd.exe 43 PID 2884 wrote to memory of 2880 2884 ddpvd.exe 43 PID 2884 wrote to memory of 2880 2884 ddpvd.exe 43 PID 2884 wrote to memory of 2880 2884 ddpvd.exe 43 PID 2880 wrote to memory of 2984 2880 xrflfrx.exe 44 PID 2880 wrote to memory of 2984 2880 xrflfrx.exe 44 PID 2880 wrote to memory of 2984 2880 xrflfrx.exe 44 PID 2880 wrote to memory of 2984 2880 xrflfrx.exe 44 PID 2984 wrote to memory of 2036 2984 nnhntt.exe 45 PID 2984 wrote to memory of 2036 2984 nnhntt.exe 45 PID 2984 wrote to memory of 2036 2984 nnhntt.exe 45 PID 2984 wrote to memory of 2036 2984 nnhntt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\5937caad0b58a1d3374f0aa1c5671874ff972bef6245e96422c3f1cca78b0ffd.exe"C:\Users\Admin\AppData\Local\Temp\5937caad0b58a1d3374f0aa1c5671874ff972bef6245e96422c3f1cca78b0ffd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\1hbnhn.exec:\1hbnhn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\pppvv.exec:\pppvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\rllfrfr.exec:\rllfrfr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\bnbbnt.exec:\bnbbnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\pdddp.exec:\pdddp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\5xrfrrl.exec:\5xrfrrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\xrrxrrl.exec:\xrrxrrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\ttbhbh.exec:\ttbhbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\jdppv.exec:\jdppv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\xrfflll.exec:\xrfflll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\lrxlxrr.exec:\lrxlxrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\tnbhnn.exec:\tnbhnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\ddpvd.exec:\ddpvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\xrflfrx.exec:\xrflfrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\nnhntt.exec:\nnhntt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\9nbnhh.exec:\9nbnhh.exe17⤵
- Executes dropped EXE
PID:2036 -
\??\c:\5dpvj.exec:\5dpvj.exe18⤵
- Executes dropped EXE
PID:2368 -
\??\c:\dpjdj.exec:\dpjdj.exe19⤵
- Executes dropped EXE
PID:1448 -
\??\c:\xfrrflf.exec:\xfrrflf.exe20⤵
- Executes dropped EXE
PID:1304 -
\??\c:\bbnntt.exec:\bbnntt.exe21⤵
- Executes dropped EXE
PID:532 -
\??\c:\htbhnn.exec:\htbhnn.exe22⤵
- Executes dropped EXE
PID:2816 -
\??\c:\jdpjp.exec:\jdpjp.exe23⤵
- Executes dropped EXE
PID:2476 -
\??\c:\1rlfllf.exec:\1rlfllf.exe24⤵
- Executes dropped EXE
PID:1752 -
\??\c:\nhbbbb.exec:\nhbbbb.exe25⤵
- Executes dropped EXE
PID:2096 -
\??\c:\htnnbn.exec:\htnnbn.exe26⤵
- Executes dropped EXE
PID:2180 -
\??\c:\vvvjp.exec:\vvvjp.exe27⤵
- Executes dropped EXE
PID:1664 -
\??\c:\3xlxllx.exec:\3xlxllx.exe28⤵
- Executes dropped EXE
PID:880 -
\??\c:\fxffrlr.exec:\fxffrlr.exe29⤵
- Executes dropped EXE
PID:704 -
\??\c:\ttnbnn.exec:\ttnbnn.exe30⤵
- Executes dropped EXE
PID:2388 -
\??\c:\jdddd.exec:\jdddd.exe31⤵
- Executes dropped EXE
PID:2404 -
\??\c:\jvjpp.exec:\jvjpp.exe32⤵
- Executes dropped EXE
PID:344 -
\??\c:\xrffxxr.exec:\xrffxxr.exe33⤵
- Executes dropped EXE
PID:540 -
\??\c:\bttbnt.exec:\bttbnt.exe34⤵
- Executes dropped EXE
PID:2520 -
\??\c:\vpvvd.exec:\vpvvd.exe35⤵
- Executes dropped EXE
PID:1704 -
\??\c:\jjdjv.exec:\jjdjv.exe36⤵
- Executes dropped EXE
PID:2200 -
\??\c:\xrfxffl.exec:\xrfxffl.exe37⤵
- Executes dropped EXE
PID:2376 -
\??\c:\ffrrfxl.exec:\ffrrfxl.exe38⤵
- Executes dropped EXE
PID:2804 -
\??\c:\hbthbn.exec:\hbthbn.exe39⤵
- Executes dropped EXE
PID:2364 -
\??\c:\htbbth.exec:\htbbth.exe40⤵
- Executes dropped EXE
PID:2904 -
\??\c:\jddjj.exec:\jddjj.exe41⤵
- Executes dropped EXE
PID:2228 -
\??\c:\dvjjp.exec:\dvjjp.exe42⤵
- Executes dropped EXE
PID:2736 -
\??\c:\lxlfxrf.exec:\lxlfxrf.exe43⤵
- Executes dropped EXE
PID:2928 -
\??\c:\7bhbtt.exec:\7bhbtt.exe44⤵
- Executes dropped EXE
PID:2852 -
\??\c:\3nbtbb.exec:\3nbtbb.exe45⤵
- Executes dropped EXE
PID:2596 -
\??\c:\7dvdp.exec:\7dvdp.exe46⤵
- Executes dropped EXE
PID:2284 -
\??\c:\xlxlrrf.exec:\xlxlrrf.exe47⤵
- Executes dropped EXE
PID:2664 -
\??\c:\3fxlrlr.exec:\3fxlrlr.exe48⤵
- Executes dropped EXE
PID:2328 -
\??\c:\1rxflff.exec:\1rxflff.exe49⤵
- Executes dropped EXE
PID:560 -
\??\c:\nbttnb.exec:\nbttnb.exe50⤵
- Executes dropped EXE
PID:2120 -
\??\c:\vvppv.exec:\vvppv.exe51⤵
- Executes dropped EXE
PID:2300 -
\??\c:\lfflflr.exec:\lfflflr.exe52⤵
- Executes dropped EXE
PID:2112 -
\??\c:\llrlxxf.exec:\llrlxxf.exe53⤵
- Executes dropped EXE
PID:764 -
\??\c:\htnhnh.exec:\htnhnh.exe54⤵
- Executes dropped EXE
PID:2888 -
\??\c:\htnhtt.exec:\htnhtt.exe55⤵
- Executes dropped EXE
PID:2868 -
\??\c:\vvpjv.exec:\vvpjv.exe56⤵
- Executes dropped EXE
PID:2992 -
\??\c:\9lfllfl.exec:\9lfllfl.exe57⤵
- Executes dropped EXE
PID:2960 -
\??\c:\7xxflxl.exec:\7xxflxl.exe58⤵
- Executes dropped EXE
PID:1508 -
\??\c:\rlxxlrf.exec:\rlxxlrf.exe59⤵
- Executes dropped EXE
PID:2700 -
\??\c:\ntbbtn.exec:\ntbbtn.exe60⤵
- Executes dropped EXE
PID:2004 -
\??\c:\dpvpd.exec:\dpvpd.exe61⤵
- Executes dropped EXE
PID:1764 -
\??\c:\1lflrrx.exec:\1lflrrx.exe62⤵
- Executes dropped EXE
PID:2012 -
\??\c:\tbhbtt.exec:\tbhbtt.exe63⤵
- Executes dropped EXE
PID:1636 -
\??\c:\bhthnb.exec:\bhthnb.exe64⤵
- Executes dropped EXE
PID:532 -
\??\c:\9ppvj.exec:\9ppvj.exe65⤵
- Executes dropped EXE
PID:2480 -
\??\c:\dvvpd.exec:\dvvpd.exe66⤵PID:2148
-
\??\c:\rlfffll.exec:\rlfffll.exe67⤵
- System Location Discovery: System Language Discovery
PID:2184 -
\??\c:\tnbbnt.exec:\tnbbnt.exe68⤵PID:1752
-
\??\c:\7nbhhh.exec:\7nbhhh.exe69⤵PID:408
-
\??\c:\7vjjj.exec:\7vjjj.exe70⤵PID:2232
-
\??\c:\jdddj.exec:\jdddj.exe71⤵PID:1280
-
\??\c:\rrflxfx.exec:\rrflxfx.exe72⤵PID:2320
-
\??\c:\rlxfllx.exec:\rlxfllx.exe73⤵PID:912
-
\??\c:\tnnnht.exec:\tnnnht.exe74⤵PID:1584
-
\??\c:\tttbnn.exec:\tttbnn.exe75⤵PID:1952
-
\??\c:\btnnnt.exec:\btnnnt.exe76⤵PID:1724
-
\??\c:\jdjpp.exec:\jdjpp.exe77⤵PID:1948
-
\??\c:\rlxxlrx.exec:\rlxxlrx.exe78⤵PID:1572
-
\??\c:\frfxrrr.exec:\frfxrrr.exe79⤵PID:572
-
\??\c:\xlxxllr.exec:\xlxxllr.exe80⤵PID:1644
-
\??\c:\bnbtht.exec:\bnbtht.exe81⤵PID:876
-
\??\c:\hhbhnn.exec:\hhbhnn.exe82⤵PID:2520
-
\??\c:\pdvvv.exec:\pdvvv.exe83⤵PID:2072
-
\??\c:\7dddv.exec:\7dddv.exe84⤵PID:1700
-
\??\c:\9rffrxl.exec:\9rffrxl.exe85⤵PID:2744
-
\??\c:\9rlflfl.exec:\9rlflfl.exe86⤵PID:2812
-
\??\c:\nhtbtb.exec:\nhtbtb.exe87⤵PID:1688
-
\??\c:\hbhtnt.exec:\hbhtnt.exe88⤵PID:2916
-
\??\c:\7dvvd.exec:\7dvvd.exe89⤵PID:2720
-
\??\c:\vpjvd.exec:\vpjvd.exe90⤵PID:2912
-
\??\c:\xrrlrrx.exec:\xrrlrrx.exe91⤵PID:2716
-
\??\c:\1rfrxrr.exec:\1rfrxrr.exe92⤵PID:2656
-
\??\c:\thbhnn.exec:\thbhnn.exe93⤵PID:2612
-
\??\c:\nhthnt.exec:\nhthnt.exe94⤵PID:2284
-
\??\c:\pdjdd.exec:\pdjdd.exe95⤵PID:2664
-
\??\c:\5pdvv.exec:\5pdvv.exe96⤵PID:1804
-
\??\c:\5xfrlfx.exec:\5xfrlfx.exe97⤵PID:352
-
\??\c:\fxflrrf.exec:\fxflrrf.exe98⤵PID:2696
-
\??\c:\thtttb.exec:\thtttb.exe99⤵PID:2300
-
\??\c:\pdddj.exec:\pdddj.exe100⤵PID:2996
-
\??\c:\pdjjd.exec:\pdjjd.exe101⤵PID:2856
-
\??\c:\3dvdv.exec:\3dvdv.exe102⤵PID:2660
-
\??\c:\7xffrxl.exec:\7xffrxl.exe103⤵PID:2056
-
\??\c:\7bthbt.exec:\7bthbt.exe104⤵PID:2992
-
\??\c:\tnbnbn.exec:\tnbnbn.exe105⤵PID:396
-
\??\c:\5djpj.exec:\5djpj.exe106⤵PID:492
-
\??\c:\dvdpv.exec:\dvdpv.exe107⤵PID:372
-
\??\c:\xrllxrx.exec:\xrllxrx.exe108⤵PID:1448
-
\??\c:\9frrxxf.exec:\9frrxxf.exe109⤵PID:556
-
\??\c:\tntnnb.exec:\tntnnb.exe110⤵PID:1156
-
\??\c:\nhntht.exec:\nhntht.exe111⤵PID:2296
-
\??\c:\vjvvv.exec:\vjvvv.exe112⤵PID:532
-
\??\c:\vpppp.exec:\vpppp.exe113⤵PID:2492
-
\??\c:\dpvpv.exec:\dpvpv.exe114⤵PID:916
-
\??\c:\xrfxlfl.exec:\xrfxlfl.exe115⤵PID:2184
-
\??\c:\1lxxfff.exec:\1lxxfff.exe116⤵PID:1256
-
\??\c:\nbhhnh.exec:\nbhhnh.exe117⤵PID:2260
-
\??\c:\nbhhbb.exec:\nbhhbb.exe118⤵PID:2232
-
\??\c:\pvjdd.exec:\pvjdd.exe119⤵PID:1352
-
\??\c:\dppdd.exec:\dppdd.exe120⤵PID:2244
-
\??\c:\xrxrrll.exec:\xrxrrll.exe121⤵PID:2416
-
\??\c:\7rlllrr.exec:\7rlllrr.exe122⤵PID:292
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-