Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25/11/2024, 22:47
Behavioral task
behavioral1
Sample
6095f803c25f93ee9d5593d52bff7a821764bb82d98e1c56f84a792f8d5e41d6.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
6095f803c25f93ee9d5593d52bff7a821764bb82d98e1c56f84a792f8d5e41d6.exe
-
Size
306KB
-
MD5
743a751909e914873f686bcc7bbbe352
-
SHA1
9f51f9f603b2aabcb04c6dfcfa6df130712e5fe3
-
SHA256
6095f803c25f93ee9d5593d52bff7a821764bb82d98e1c56f84a792f8d5e41d6
-
SHA512
d1f147d9b26c74b16d17a459c4727cca3f0bb201c25fab0d5e4ef45bad92a231f2c87e8fdfd8af8cf8b511894dff1344e2afbe4b83995c163fd3f41291af24c6
-
SSDEEP
6144:kcm4FmowdHoSphraHcpOFltH4t+IDvSXrh5g8hZVMWhi:y4wFHoS3eFp3IDvSbh5nPVdi
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 51 IoCs
resource yara_rule behavioral1/memory/1800-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2100-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3048-21-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3048-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2948-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2760-56-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2740-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2740-64-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2772-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2156-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2156-85-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/1644-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2732-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2732-104-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2780-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1972-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2036-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/480-154-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/480-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1760-161-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1760-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1828-174-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1828-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2436-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2368-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2376-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2448-219-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2448-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/444-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/888-252-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1892-271-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1516-293-0x00000000005C0000-0x00000000005E7000-memory.dmp family_blackmoon behavioral1/memory/3064-312-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1612-330-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2756-342-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2916-363-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2964-369-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2640-384-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2324-397-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1492-404-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/692-449-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/692-470-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1960-478-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1556-510-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2624-655-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/604-693-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1104-702-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1992-726-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2364-733-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/300-740-0x00000000001C0000-0x00000000001E7000-memory.dmp family_blackmoon behavioral1/memory/2596-780-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2100 rrlffxx.exe 3048 jvjjv.exe 2380 lrllrlf.exe 2948 7xlxrxl.exe 2760 1bttbh.exe 2740 7lxxflr.exe 2772 xfffxfr.exe 2156 ppdpd.exe 1644 frfflff.exe 2732 dddvp.exe 2780 5rflxfr.exe 1972 ppjvp.exe 2804 llllxfr.exe 2036 vppdp.exe 480 rrlrxlx.exe 1760 dvppd.exe 1828 1rlrlfr.exe 2436 3pdpj.exe 2368 ppppj.exe 2376 bbthbn.exe 1316 ppvdv.exe 2448 httnbb.exe 444 ddpvj.exe 2056 tbthht.exe 888 7ppdd.exe 1544 3pvjj.exe 2840 3dppj.exe 1892 nnhtnt.exe 564 bthntt.exe 1516 ffrllrx.exe 2356 5hbhth.exe 3064 7xlflrf.exe 2528 fxrflxf.exe 1612 hbtbnh.exe 2704 jjvjd.exe 2756 3frllrx.exe 2888 bhhtbb.exe 2744 dddjd.exe 2916 9pdjp.exe 2964 lfxrlrf.exe 2748 bbnhtn.exe 2640 9dppv.exe 2688 dpddd.exe 2324 7rfflrl.exe 1492 9hbhnt.exe 580 dpvvv.exe 264 ddpdp.exe 1104 ffxrfrf.exe 2804 htnntn.exe 1064 pdjpj.exe 1692 rlxrrlr.exe 692 lflrxfl.exe 1264 nhbhnt.exe 2256 7jdjv.exe 2180 rllrfxl.exe 1960 lfxlxxl.exe 2568 nhbhtb.exe 2404 vjvdj.exe 1632 1xrlxxr.exe 600 nhnhtt.exe 1144 nhhbtb.exe 1556 ppvjd.exe 896 lxrfxxl.exe 1780 htnbhn.exe -
resource yara_rule behavioral1/memory/1800-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1800-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000012118-5.dat upx behavioral1/files/0x000800000001613e-18.dat upx behavioral1/memory/2100-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3048-21-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/3048-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2380-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016210-29.dat upx behavioral1/files/0x00070000000164db-38.dat upx behavioral1/files/0x000700000001659b-47.dat upx behavioral1/memory/2760-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2948-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2760-56-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0007000000016645-57.dat upx behavioral1/memory/2740-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000900000001686c-66.dat upx behavioral1/files/0x0009000000016ac1-75.dat upx behavioral1/memory/2772-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2156-87-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016de8-86.dat upx behavioral1/files/0x0006000000016eb8-94.dat upx behavioral1/memory/2732-97-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1644-96-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016edb-108.dat upx behavioral1/memory/2732-107-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001707c-118.dat upx behavioral1/memory/2780-117-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000173f3-128.dat upx behavioral1/memory/1972-126-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017400-137.dat upx behavioral1/memory/2036-145-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017403-146.dat upx behavioral1/files/0x0009000000015e64-158.dat upx behavioral1/memory/480-157-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1760-167-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001746a-166.dat upx behavioral1/memory/1828-177-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017488-178.dat upx behavioral1/memory/2436-187-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000174a6-186.dat upx behavioral1/memory/2368-196-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000174c3-194.dat upx behavioral1/files/0x000600000001757f-206.dat upx behavioral1/memory/2376-204-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0015000000018676-213.dat upx behavioral1/memory/2448-216-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2448-225-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018696-224.dat upx behavioral1/files/0x0005000000018697-234.dat upx behavioral1/memory/444-233-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000187a2-243.dat upx behavioral1/files/0x0006000000018c34-251.dat upx behavioral1/memory/888-252-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018c44-260.dat upx behavioral1/memory/1892-271-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018f65-270.dat upx behavioral1/files/0x000600000001904c-278.dat upx behavioral1/files/0x00060000000190e1-290.dat upx behavioral1/memory/1516-289-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000191d2-299.dat upx behavioral1/files/0x00050000000191f6-309.dat upx behavioral1/memory/1612-330-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2916-363-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxflrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ntbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xrflfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrflfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1800 wrote to memory of 2100 1800 6095f803c25f93ee9d5593d52bff7a821764bb82d98e1c56f84a792f8d5e41d6.exe 30 PID 1800 wrote to memory of 2100 1800 6095f803c25f93ee9d5593d52bff7a821764bb82d98e1c56f84a792f8d5e41d6.exe 30 PID 1800 wrote to memory of 2100 1800 6095f803c25f93ee9d5593d52bff7a821764bb82d98e1c56f84a792f8d5e41d6.exe 30 PID 1800 wrote to memory of 2100 1800 6095f803c25f93ee9d5593d52bff7a821764bb82d98e1c56f84a792f8d5e41d6.exe 30 PID 2100 wrote to memory of 3048 2100 rrlffxx.exe 31 PID 2100 wrote to memory of 3048 2100 rrlffxx.exe 31 PID 2100 wrote to memory of 3048 2100 rrlffxx.exe 31 PID 2100 wrote to memory of 3048 2100 rrlffxx.exe 31 PID 3048 wrote to memory of 2380 3048 jvjjv.exe 32 PID 3048 wrote to memory of 2380 3048 jvjjv.exe 32 PID 3048 wrote to memory of 2380 3048 jvjjv.exe 32 PID 3048 wrote to memory of 2380 3048 jvjjv.exe 32 PID 2380 wrote to memory of 2948 2380 lrllrlf.exe 33 PID 2380 wrote to memory of 2948 2380 lrllrlf.exe 33 PID 2380 wrote to memory of 2948 2380 lrllrlf.exe 33 PID 2380 wrote to memory of 2948 2380 lrllrlf.exe 33 PID 2948 wrote to memory of 2760 2948 7xlxrxl.exe 34 PID 2948 wrote to memory of 2760 2948 7xlxrxl.exe 34 PID 2948 wrote to memory of 2760 2948 7xlxrxl.exe 34 PID 2948 wrote to memory of 2760 2948 7xlxrxl.exe 34 PID 2760 wrote to memory of 2740 2760 1bttbh.exe 35 PID 2760 wrote to memory of 2740 2760 1bttbh.exe 35 PID 2760 wrote to memory of 2740 2760 1bttbh.exe 35 PID 2760 wrote to memory of 2740 2760 1bttbh.exe 35 PID 2740 wrote to memory of 2772 2740 7lxxflr.exe 36 PID 2740 wrote to memory of 2772 2740 7lxxflr.exe 36 PID 2740 wrote to memory of 2772 2740 7lxxflr.exe 36 PID 2740 wrote to memory of 2772 2740 7lxxflr.exe 36 PID 2772 wrote to memory of 2156 2772 xfffxfr.exe 37 PID 2772 wrote to memory of 2156 2772 xfffxfr.exe 37 PID 2772 wrote to memory of 2156 2772 xfffxfr.exe 37 PID 2772 wrote to memory of 2156 2772 xfffxfr.exe 37 PID 2156 wrote to memory of 1644 2156 ppdpd.exe 38 PID 2156 wrote to memory of 1644 2156 ppdpd.exe 38 PID 2156 wrote to memory of 1644 2156 ppdpd.exe 38 PID 2156 wrote to memory of 1644 2156 ppdpd.exe 38 PID 1644 wrote to memory of 2732 1644 frfflff.exe 39 PID 1644 wrote to memory of 2732 1644 frfflff.exe 39 PID 1644 wrote to memory of 2732 1644 frfflff.exe 39 PID 1644 wrote to memory of 2732 1644 frfflff.exe 39 PID 2732 wrote to memory of 2780 2732 dddvp.exe 40 PID 2732 wrote to memory of 2780 2732 dddvp.exe 40 PID 2732 wrote to memory of 2780 2732 dddvp.exe 40 PID 2732 wrote to memory of 2780 2732 dddvp.exe 40 PID 2780 wrote to memory of 1972 2780 5rflxfr.exe 41 PID 2780 wrote to memory of 1972 2780 5rflxfr.exe 41 PID 2780 wrote to memory of 1972 2780 5rflxfr.exe 41 PID 2780 wrote to memory of 1972 2780 5rflxfr.exe 41 PID 1972 wrote to memory of 2804 1972 ppjvp.exe 42 PID 1972 wrote to memory of 2804 1972 ppjvp.exe 42 PID 1972 wrote to memory of 2804 1972 ppjvp.exe 42 PID 1972 wrote to memory of 2804 1972 ppjvp.exe 42 PID 2804 wrote to memory of 2036 2804 llllxfr.exe 43 PID 2804 wrote to memory of 2036 2804 llllxfr.exe 43 PID 2804 wrote to memory of 2036 2804 llllxfr.exe 43 PID 2804 wrote to memory of 2036 2804 llllxfr.exe 43 PID 2036 wrote to memory of 480 2036 vppdp.exe 44 PID 2036 wrote to memory of 480 2036 vppdp.exe 44 PID 2036 wrote to memory of 480 2036 vppdp.exe 44 PID 2036 wrote to memory of 480 2036 vppdp.exe 44 PID 480 wrote to memory of 1760 480 rrlrxlx.exe 45 PID 480 wrote to memory of 1760 480 rrlrxlx.exe 45 PID 480 wrote to memory of 1760 480 rrlrxlx.exe 45 PID 480 wrote to memory of 1760 480 rrlrxlx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\6095f803c25f93ee9d5593d52bff7a821764bb82d98e1c56f84a792f8d5e41d6.exe"C:\Users\Admin\AppData\Local\Temp\6095f803c25f93ee9d5593d52bff7a821764bb82d98e1c56f84a792f8d5e41d6.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\rrlffxx.exec:\rrlffxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\jvjjv.exec:\jvjjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\lrllrlf.exec:\lrllrlf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\7xlxrxl.exec:\7xlxrxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\1bttbh.exec:\1bttbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\7lxxflr.exec:\7lxxflr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\xfffxfr.exec:\xfffxfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\ppdpd.exec:\ppdpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\frfflff.exec:\frfflff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\dddvp.exec:\dddvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\5rflxfr.exec:\5rflxfr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\ppjvp.exec:\ppjvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\llllxfr.exec:\llllxfr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\vppdp.exec:\vppdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\rrlrxlx.exec:\rrlrxlx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:480 -
\??\c:\dvppd.exec:\dvppd.exe17⤵
- Executes dropped EXE
PID:1760 -
\??\c:\1rlrlfr.exec:\1rlrlfr.exe18⤵
- Executes dropped EXE
PID:1828 -
\??\c:\3pdpj.exec:\3pdpj.exe19⤵
- Executes dropped EXE
PID:2436 -
\??\c:\ppppj.exec:\ppppj.exe20⤵
- Executes dropped EXE
PID:2368 -
\??\c:\bbthbn.exec:\bbthbn.exe21⤵
- Executes dropped EXE
PID:2376 -
\??\c:\ppvdv.exec:\ppvdv.exe22⤵
- Executes dropped EXE
PID:1316 -
\??\c:\httnbb.exec:\httnbb.exe23⤵
- Executes dropped EXE
PID:2448 -
\??\c:\ddpvj.exec:\ddpvj.exe24⤵
- Executes dropped EXE
PID:444 -
\??\c:\tbthht.exec:\tbthht.exe25⤵
- Executes dropped EXE
PID:2056 -
\??\c:\7ppdd.exec:\7ppdd.exe26⤵
- Executes dropped EXE
PID:888 -
\??\c:\3pvjj.exec:\3pvjj.exe27⤵
- Executes dropped EXE
PID:1544 -
\??\c:\3dppj.exec:\3dppj.exe28⤵
- Executes dropped EXE
PID:2840 -
\??\c:\nnhtnt.exec:\nnhtnt.exe29⤵
- Executes dropped EXE
PID:1892 -
\??\c:\bthntt.exec:\bthntt.exe30⤵
- Executes dropped EXE
PID:564 -
\??\c:\ffrllrx.exec:\ffrllrx.exe31⤵
- Executes dropped EXE
PID:1516 -
\??\c:\5hbhth.exec:\5hbhth.exe32⤵
- Executes dropped EXE
PID:2356 -
\??\c:\7xlflrf.exec:\7xlflrf.exe33⤵
- Executes dropped EXE
PID:3064 -
\??\c:\fxrflxf.exec:\fxrflxf.exe34⤵
- Executes dropped EXE
PID:2528 -
\??\c:\hbtbnh.exec:\hbtbnh.exe35⤵
- Executes dropped EXE
PID:1612 -
\??\c:\jjvjd.exec:\jjvjd.exe36⤵
- Executes dropped EXE
PID:2704 -
\??\c:\3frllrx.exec:\3frllrx.exe37⤵
- Executes dropped EXE
PID:2756 -
\??\c:\bhhtbb.exec:\bhhtbb.exe38⤵
- Executes dropped EXE
PID:2888 -
\??\c:\dddjd.exec:\dddjd.exe39⤵
- Executes dropped EXE
PID:2744 -
\??\c:\9pdjp.exec:\9pdjp.exe40⤵
- Executes dropped EXE
PID:2916 -
\??\c:\lfxrlrf.exec:\lfxrlrf.exe41⤵
- Executes dropped EXE
PID:2964 -
\??\c:\bbnhtn.exec:\bbnhtn.exe42⤵
- Executes dropped EXE
PID:2748 -
\??\c:\9dppv.exec:\9dppv.exe43⤵
- Executes dropped EXE
PID:2640 -
\??\c:\dpddd.exec:\dpddd.exe44⤵
- Executes dropped EXE
PID:2688 -
\??\c:\7rfflrl.exec:\7rfflrl.exe45⤵
- Executes dropped EXE
PID:2324 -
\??\c:\9hbhnt.exec:\9hbhnt.exe46⤵
- Executes dropped EXE
PID:1492 -
\??\c:\dpvvv.exec:\dpvvv.exe47⤵
- Executes dropped EXE
PID:580 -
\??\c:\ddpdp.exec:\ddpdp.exe48⤵
- Executes dropped EXE
PID:264 -
\??\c:\ffxrfrf.exec:\ffxrfrf.exe49⤵
- Executes dropped EXE
PID:1104 -
\??\c:\htnntn.exec:\htnntn.exe50⤵
- Executes dropped EXE
PID:2804 -
\??\c:\pdjpj.exec:\pdjpj.exe51⤵
- Executes dropped EXE
PID:1064 -
\??\c:\rlxrrlr.exec:\rlxrrlr.exe52⤵
- Executes dropped EXE
PID:1692 -
\??\c:\lflrxfl.exec:\lflrxfl.exe53⤵
- Executes dropped EXE
PID:692 -
\??\c:\nhbhnt.exec:\nhbhnt.exe54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1264 -
\??\c:\7jdjv.exec:\7jdjv.exe55⤵
- Executes dropped EXE
PID:2256 -
\??\c:\rllrfxl.exec:\rllrfxl.exe56⤵
- Executes dropped EXE
PID:2180 -
\??\c:\lfxlxxl.exec:\lfxlxxl.exe57⤵
- Executes dropped EXE
PID:1960 -
\??\c:\nhbhtb.exec:\nhbhtb.exe58⤵
- Executes dropped EXE
PID:2568 -
\??\c:\vjvdj.exec:\vjvdj.exe59⤵
- Executes dropped EXE
PID:2404 -
\??\c:\1xrlxxr.exec:\1xrlxxr.exe60⤵
- Executes dropped EXE
PID:1632 -
\??\c:\nhnhtt.exec:\nhnhtt.exe61⤵
- Executes dropped EXE
PID:600 -
\??\c:\nhhbtb.exec:\nhhbtb.exe62⤵
- Executes dropped EXE
PID:1144 -
\??\c:\ppvjd.exec:\ppvjd.exe63⤵
- Executes dropped EXE
PID:1556 -
\??\c:\lxrfxxl.exec:\lxrfxxl.exe64⤵
- Executes dropped EXE
PID:896 -
\??\c:\htnbhn.exec:\htnbhn.exe65⤵
- Executes dropped EXE
PID:1780 -
\??\c:\9pjjv.exec:\9pjjv.exe66⤵PID:3028
-
\??\c:\ppdpd.exec:\ppdpd.exe67⤵PID:3008
-
\??\c:\xxflfrx.exec:\xxflfrx.exe68⤵PID:2524
-
\??\c:\tnbbhn.exec:\tnbbhn.exe69⤵PID:2220
-
\??\c:\nhbbhb.exec:\nhbbhb.exe70⤵PID:2276
-
\??\c:\jdvjj.exec:\jdvjj.exe71⤵PID:880
-
\??\c:\ppvvd.exec:\ppvvd.exe72⤵PID:1588
-
\??\c:\lfrxrxl.exec:\lfrxrxl.exe73⤵PID:1824
-
\??\c:\tthhnt.exec:\tthhnt.exe74⤵PID:2544
-
\??\c:\jjjvd.exec:\jjjvd.exe75⤵PID:2092
-
\??\c:\jdvjv.exec:\jdvjv.exe76⤵PID:2108
-
\??\c:\1rlrxfl.exec:\1rlrxfl.exe77⤵PID:2536
-
\??\c:\nbttnt.exec:\nbttnt.exe78⤵PID:2540
-
\??\c:\pvjpd.exec:\pvjpd.exe79⤵PID:2880
-
\??\c:\vpvvv.exec:\vpvvv.exe80⤵PID:3012
-
\??\c:\7frfrll.exec:\7frfrll.exe81⤵PID:3004
-
\??\c:\lxfflrf.exec:\lxfflrf.exe82⤵PID:2620
-
\??\c:\nnhbnn.exec:\nnhbnn.exe83⤵PID:2308
-
\??\c:\pjjvd.exec:\pjjvd.exe84⤵PID:2700
-
\??\c:\rlllfrl.exec:\rlllfrl.exe85⤵PID:2624
-
\??\c:\ffxxlrf.exec:\ffxxlrf.exe86⤵PID:2684
-
\??\c:\hbthnt.exec:\hbthnt.exe87⤵PID:2152
-
\??\c:\dvpvj.exec:\dvpvj.exe88⤵PID:524
-
\??\c:\pjvjp.exec:\pjvjp.exe89⤵PID:1292
-
\??\c:\7xxlxfr.exec:\7xxlxfr.exe90⤵PID:1676
-
\??\c:\tthbtb.exec:\tthbtb.exe91⤵PID:604
-
\??\c:\hhbhnt.exec:\hhbhnt.exe92⤵PID:2600
-
\??\c:\3dppp.exec:\3dppp.exe93⤵PID:1104
-
\??\c:\xrlfrrr.exec:\xrlfrrr.exe94⤵PID:300
-
\??\c:\lfrllrx.exec:\lfrllrx.exe95⤵PID:480
-
\??\c:\ntbtth.exec:\ntbtth.exe96⤵PID:1992
-
\??\c:\tthtnt.exec:\tthtnt.exe97⤵PID:2364
-
\??\c:\ddvdv.exec:\ddvdv.exe98⤵PID:1828
-
\??\c:\7lxrxfl.exec:\7lxrxfl.exe99⤵PID:2360
-
\??\c:\rrllrxr.exec:\rrllrxr.exe100⤵PID:2420
-
\??\c:\7hbbnn.exec:\7hbbnn.exe101⤵PID:1720
-
\??\c:\pjvvj.exec:\pjvvj.exe102⤵PID:1788
-
\??\c:\xrxxxff.exec:\xrxxxff.exe103⤵PID:2224
-
\??\c:\frllrxx.exec:\frllrxx.exe104⤵PID:2596
-
\??\c:\5nnnhn.exec:\5nnnhn.exe105⤵PID:628
-
\??\c:\hbhbhh.exec:\hbhbhh.exe106⤵PID:1560
-
\??\c:\7vjjj.exec:\7vjjj.exe107⤵PID:1716
-
\??\c:\9lflfrf.exec:\9lflfrf.exe108⤵PID:344
-
\??\c:\bhtbtb.exec:\bhtbtb.exe109⤵PID:2552
-
\??\c:\hhthtt.exec:\hhthtt.exe110⤵PID:1164
-
\??\c:\dpddp.exec:\dpddp.exe111⤵PID:1764
-
\??\c:\lfxfflx.exec:\lfxfflx.exe112⤵PID:2576
-
\??\c:\xrfxflr.exec:\xrfxflr.exe113⤵PID:1508
-
\??\c:\btbttt.exec:\btbttt.exe114⤵PID:872
-
\??\c:\jvjdv.exec:\jvjdv.exe115⤵PID:2328
-
\??\c:\jdvpd.exec:\jdvpd.exe116⤵PID:3068
-
\??\c:\fxrrxfl.exec:\fxrrxfl.exe117⤵PID:2348
-
\??\c:\1xfllrr.exec:\1xfllrr.exe118⤵PID:2944
-
\??\c:\nbnnht.exec:\nbnnht.exe119⤵PID:1468
-
\??\c:\5pjdv.exec:\5pjdv.exe120⤵PID:2408
-
\??\c:\vpvvd.exec:\vpvvd.exe121⤵PID:2752
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-