Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-11-2024 08:36
Behavioral task
behavioral1
Sample
35ab5a997a03f0446dc635d4986165768ca0b98f36e24958a52eaf21a7ade703N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
35ab5a997a03f0446dc635d4986165768ca0b98f36e24958a52eaf21a7ade703N.exe
-
Size
332KB
-
MD5
7be9780dc159b05bd74ac0c88b7a0be0
-
SHA1
14e51fc66b79863d1f6036472a4752e0c1ea1c98
-
SHA256
35ab5a997a03f0446dc635d4986165768ca0b98f36e24958a52eaf21a7ade703
-
SHA512
650139f16e9dee129c8af31b9a6b2939c2f58cd671c3d8ea74ee3c2fa30526853c2b3814a130463e941a33355480a56f0389fd08ac9a2edad9312a2e3061172b
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbe1:R4wFHoSHYHUrAwfMp3CD1
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/2792-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3020-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2088-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2780-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2720-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2784-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2596-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2464-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2580-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/264-87-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/540-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1788-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1788-118-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2212-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/356-143-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2224-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1624-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2684-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2004-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2320-199-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1712-236-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1736-244-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1272-252-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2836-282-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2220-288-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2920-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1548-300-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2496-328-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2456-353-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2508-360-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/344-379-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1332-385-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2668-403-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/1920-414-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2296-478-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2296-477-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2028-492-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1724-534-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/340-545-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/340-563-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2752-582-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2764-588-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2280-701-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2548-714-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2548-713-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2388-833-0x0000000077B60000-0x0000000077C7F000-memory.dmp family_blackmoon behavioral1/memory/2948-873-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2388-12818-0x0000000077B60000-0x0000000077C7F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3020 rffrrfl.exe 2088 1jvvd.exe 2780 ffxrflx.exe 2720 nhtbtb.exe 2784 7fxfxlf.exe 2596 bthhtb.exe 2464 vpvvv.exe 2580 9rllrxx.exe 272 btttnt.exe 264 djvpd.exe 756 frffffl.exe 540 7ttbnh.exe 2664 jdjdd.exe 1788 1rfflrr.exe 824 nhthnn.exe 2212 xlfxffl.exe 356 ttnthh.exe 2224 3dppj.exe 1624 rrxxllx.exe 2684 7btthn.exe 2004 7vpvv.exe 1904 xlrrlrr.exe 2068 1vpjp.exe 2320 jddjj.exe 348 lxrrrrx.exe 2076 hbnntt.exe 772 xfxlllr.exe 1556 tnbbhn.exe 1712 7jpdj.exe 1736 rfrxxxx.exe 1272 btbntt.exe 1704 frrffff.exe 2404 1thhtn.exe 1260 bnnhhn.exe 672 jdpvd.exe 2836 xrffxxf.exe 2220 3bbhnn.exe 2920 hbhhtt.exe 1548 jpdjv.exe 2748 xfrfrxf.exe 2564 9fxfxfl.exe 2612 bththh.exe 2576 dvpvd.exe 2496 vjdvp.exe 2772 5fxfrrx.exe 2512 1htnnb.exe 2624 bnhnnt.exe 2456 vvjdj.exe 2508 xxrlrrx.exe 2944 3fxxrrf.exe 564 1nhttt.exe 344 dpvvv.exe 1332 jdpjp.exe 980 rlxlxrx.exe 2664 nnnnnt.exe 2668 pdpjj.exe 2052 7pvdd.exe 1920 1rflrrr.exe 1216 bnbhnn.exe 2280 1tnnnt.exe 1800 jdjdj.exe 1720 3dvdj.exe 2192 9xfxlxf.exe 1996 9thntb.exe -
resource yara_rule behavioral1/memory/2792-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2792-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000b000000012029-7.dat upx behavioral1/files/0x0008000000014b28-15.dat upx behavioral1/memory/3020-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000014b54-23.dat upx behavioral1/memory/2088-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2720-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2780-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000014bda-31.dat upx behavioral1/files/0x0007000000014cde-40.dat upx behavioral1/memory/2720-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2784-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000014f7b-49.dat upx behavioral1/files/0x0007000000015016-58.dat upx behavioral1/memory/2596-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2464-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016d11-65.dat upx behavioral1/memory/2580-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d33-72.dat upx behavioral1/files/0x0006000000016d46-80.dat upx behavioral1/memory/264-87-0x00000000002A0000-0x00000000002C7000-memory.dmp upx behavioral1/files/0x0006000000016d4a-88.dat upx behavioral1/files/0x0006000000016d4e-95.dat upx behavioral1/files/0x0006000000016db3-102.dat upx behavioral1/memory/2664-104-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/540-103-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016db8-111.dat upx behavioral1/memory/1788-120-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016dc7-119.dat upx behavioral1/files/0x0006000000016dd2-127.dat upx behavioral1/memory/2212-136-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016dd6-135.dat upx behavioral1/memory/356-143-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016ee0-144.dat upx behavioral1/files/0x0006000000017051-151.dat upx behavioral1/memory/2224-152-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000170b5-160.dat upx behavioral1/memory/1624-159-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2684-168-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x003500000001487e-167.dat upx behavioral1/memory/2004-175-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017546-176.dat upx behavioral1/files/0x00060000000175c6-183.dat upx behavioral1/files/0x00060000000175cc-190.dat upx behavioral1/memory/2320-199-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000175d2-198.dat upx behavioral1/files/0x0031000000018654-206.dat upx behavioral1/files/0x0005000000018669-213.dat upx behavioral1/files/0x00050000000186d2-222.dat upx behavioral1/files/0x00050000000186de-229.dat upx behavioral1/files/0x00050000000186ee-237.dat upx behavioral1/memory/1712-236-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001875d-245.dat upx behavioral1/files/0x0005000000018761-253.dat upx behavioral1/memory/1272-252-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2836-282-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2220-288-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2920-294-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1548-300-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2612-312-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2456-353-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2508-360-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/344-372-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxfrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrllrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrllffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrfrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxllrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2792 wrote to memory of 3020 2792 35ab5a997a03f0446dc635d4986165768ca0b98f36e24958a52eaf21a7ade703N.exe 28 PID 2792 wrote to memory of 3020 2792 35ab5a997a03f0446dc635d4986165768ca0b98f36e24958a52eaf21a7ade703N.exe 28 PID 2792 wrote to memory of 3020 2792 35ab5a997a03f0446dc635d4986165768ca0b98f36e24958a52eaf21a7ade703N.exe 28 PID 2792 wrote to memory of 3020 2792 35ab5a997a03f0446dc635d4986165768ca0b98f36e24958a52eaf21a7ade703N.exe 28 PID 3020 wrote to memory of 2088 3020 rffrrfl.exe 29 PID 3020 wrote to memory of 2088 3020 rffrrfl.exe 29 PID 3020 wrote to memory of 2088 3020 rffrrfl.exe 29 PID 3020 wrote to memory of 2088 3020 rffrrfl.exe 29 PID 2088 wrote to memory of 2780 2088 1jvvd.exe 30 PID 2088 wrote to memory of 2780 2088 1jvvd.exe 30 PID 2088 wrote to memory of 2780 2088 1jvvd.exe 30 PID 2088 wrote to memory of 2780 2088 1jvvd.exe 30 PID 2780 wrote to memory of 2720 2780 ffxrflx.exe 31 PID 2780 wrote to memory of 2720 2780 ffxrflx.exe 31 PID 2780 wrote to memory of 2720 2780 ffxrflx.exe 31 PID 2780 wrote to memory of 2720 2780 ffxrflx.exe 31 PID 2720 wrote to memory of 2784 2720 nhtbtb.exe 32 PID 2720 wrote to memory of 2784 2720 nhtbtb.exe 32 PID 2720 wrote to memory of 2784 2720 nhtbtb.exe 32 PID 2720 wrote to memory of 2784 2720 nhtbtb.exe 32 PID 2784 wrote to memory of 2596 2784 7fxfxlf.exe 33 PID 2784 wrote to memory of 2596 2784 7fxfxlf.exe 33 PID 2784 wrote to memory of 2596 2784 7fxfxlf.exe 33 PID 2784 wrote to memory of 2596 2784 7fxfxlf.exe 33 PID 2596 wrote to memory of 2464 2596 bthhtb.exe 34 PID 2596 wrote to memory of 2464 2596 bthhtb.exe 34 PID 2596 wrote to memory of 2464 2596 bthhtb.exe 34 PID 2596 wrote to memory of 2464 2596 bthhtb.exe 34 PID 2464 wrote to memory of 2580 2464 vpvvv.exe 35 PID 2464 wrote to memory of 2580 2464 vpvvv.exe 35 PID 2464 wrote to memory of 2580 2464 vpvvv.exe 35 PID 2464 wrote to memory of 2580 2464 vpvvv.exe 35 PID 2580 wrote to memory of 272 2580 9rllrxx.exe 36 PID 2580 wrote to memory of 272 2580 9rllrxx.exe 36 PID 2580 wrote to memory of 272 2580 9rllrxx.exe 36 PID 2580 wrote to memory of 272 2580 9rllrxx.exe 36 PID 272 wrote to memory of 264 272 btttnt.exe 37 PID 272 wrote to memory of 264 272 btttnt.exe 37 PID 272 wrote to memory of 264 272 btttnt.exe 37 PID 272 wrote to memory of 264 272 btttnt.exe 37 PID 264 wrote to memory of 756 264 djvpd.exe 38 PID 264 wrote to memory of 756 264 djvpd.exe 38 PID 264 wrote to memory of 756 264 djvpd.exe 38 PID 264 wrote to memory of 756 264 djvpd.exe 38 PID 756 wrote to memory of 540 756 frffffl.exe 39 PID 756 wrote to memory of 540 756 frffffl.exe 39 PID 756 wrote to memory of 540 756 frffffl.exe 39 PID 756 wrote to memory of 540 756 frffffl.exe 39 PID 540 wrote to memory of 2664 540 7ttbnh.exe 40 PID 540 wrote to memory of 2664 540 7ttbnh.exe 40 PID 540 wrote to memory of 2664 540 7ttbnh.exe 40 PID 540 wrote to memory of 2664 540 7ttbnh.exe 40 PID 2664 wrote to memory of 1788 2664 jdjdd.exe 41 PID 2664 wrote to memory of 1788 2664 jdjdd.exe 41 PID 2664 wrote to memory of 1788 2664 jdjdd.exe 41 PID 2664 wrote to memory of 1788 2664 jdjdd.exe 41 PID 1788 wrote to memory of 824 1788 1rfflrr.exe 42 PID 1788 wrote to memory of 824 1788 1rfflrr.exe 42 PID 1788 wrote to memory of 824 1788 1rfflrr.exe 42 PID 1788 wrote to memory of 824 1788 1rfflrr.exe 42 PID 824 wrote to memory of 2212 824 nhthnn.exe 43 PID 824 wrote to memory of 2212 824 nhthnn.exe 43 PID 824 wrote to memory of 2212 824 nhthnn.exe 43 PID 824 wrote to memory of 2212 824 nhthnn.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\35ab5a997a03f0446dc635d4986165768ca0b98f36e24958a52eaf21a7ade703N.exe"C:\Users\Admin\AppData\Local\Temp\35ab5a997a03f0446dc635d4986165768ca0b98f36e24958a52eaf21a7ade703N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\rffrrfl.exec:\rffrrfl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\1jvvd.exec:\1jvvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\ffxrflx.exec:\ffxrflx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\nhtbtb.exec:\nhtbtb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\7fxfxlf.exec:\7fxfxlf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\bthhtb.exec:\bthhtb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\vpvvv.exec:\vpvvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\9rllrxx.exec:\9rllrxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\btttnt.exec:\btttnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:272 -
\??\c:\djvpd.exec:\djvpd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:264 -
\??\c:\frffffl.exec:\frffffl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\7ttbnh.exec:\7ttbnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
\??\c:\jdjdd.exec:\jdjdd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\1rfflrr.exec:\1rfflrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\nhthnn.exec:\nhthnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
\??\c:\xlfxffl.exec:\xlfxffl.exe17⤵
- Executes dropped EXE
PID:2212 -
\??\c:\ttnthh.exec:\ttnthh.exe18⤵
- Executes dropped EXE
PID:356 -
\??\c:\3dppj.exec:\3dppj.exe19⤵
- Executes dropped EXE
PID:2224 -
\??\c:\rrxxllx.exec:\rrxxllx.exe20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1624 -
\??\c:\7btthn.exec:\7btthn.exe21⤵
- Executes dropped EXE
PID:2684 -
\??\c:\7vpvv.exec:\7vpvv.exe22⤵
- Executes dropped EXE
PID:2004 -
\??\c:\xlrrlrr.exec:\xlrrlrr.exe23⤵
- Executes dropped EXE
PID:1904 -
\??\c:\1vpjp.exec:\1vpjp.exe24⤵
- Executes dropped EXE
PID:2068 -
\??\c:\jddjj.exec:\jddjj.exe25⤵
- Executes dropped EXE
PID:2320 -
\??\c:\lxrrrrx.exec:\lxrrrrx.exe26⤵
- Executes dropped EXE
PID:348 -
\??\c:\hbnntt.exec:\hbnntt.exe27⤵
- Executes dropped EXE
PID:2076 -
\??\c:\xfxlllr.exec:\xfxlllr.exe28⤵
- Executes dropped EXE
PID:772 -
\??\c:\tnbbhn.exec:\tnbbhn.exe29⤵
- Executes dropped EXE
PID:1556 -
\??\c:\7jpdj.exec:\7jpdj.exe30⤵
- Executes dropped EXE
PID:1712 -
\??\c:\rfrxxxx.exec:\rfrxxxx.exe31⤵
- Executes dropped EXE
PID:1736 -
\??\c:\btbntt.exec:\btbntt.exe32⤵
- Executes dropped EXE
PID:1272 -
\??\c:\frrffff.exec:\frrffff.exe33⤵
- Executes dropped EXE
PID:1704 -
\??\c:\1thhtn.exec:\1thhtn.exe34⤵
- Executes dropped EXE
PID:2404 -
\??\c:\bnnhhn.exec:\bnnhhn.exe35⤵
- Executes dropped EXE
PID:1260 -
\??\c:\jdpvd.exec:\jdpvd.exe36⤵
- Executes dropped EXE
PID:672 -
\??\c:\xrffxxf.exec:\xrffxxf.exe37⤵
- Executes dropped EXE
PID:2836 -
\??\c:\3bbhnn.exec:\3bbhnn.exe38⤵
- Executes dropped EXE
PID:2220 -
\??\c:\hbhhtt.exec:\hbhhtt.exe39⤵
- Executes dropped EXE
PID:2920 -
\??\c:\jpdjv.exec:\jpdjv.exe40⤵
- Executes dropped EXE
PID:1548 -
\??\c:\xfrfrxf.exec:\xfrfrxf.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2748 -
\??\c:\9fxfxfl.exec:\9fxfxfl.exe42⤵
- Executes dropped EXE
PID:2564 -
\??\c:\bththh.exec:\bththh.exe43⤵
- Executes dropped EXE
PID:2612 -
\??\c:\dvpvd.exec:\dvpvd.exe44⤵
- Executes dropped EXE
PID:2576 -
\??\c:\vjdvp.exec:\vjdvp.exe45⤵
- Executes dropped EXE
PID:2496 -
\??\c:\5fxfrrx.exec:\5fxfrrx.exe46⤵
- Executes dropped EXE
PID:2772 -
\??\c:\1htnnb.exec:\1htnnb.exe47⤵
- Executes dropped EXE
PID:2512 -
\??\c:\bnhnnt.exec:\bnhnnt.exe48⤵
- Executes dropped EXE
PID:2624 -
\??\c:\vvjdj.exec:\vvjdj.exe49⤵
- Executes dropped EXE
PID:2456 -
\??\c:\xxrlrrx.exec:\xxrlrrx.exe50⤵
- Executes dropped EXE
PID:2508 -
\??\c:\3fxxrrf.exec:\3fxxrrf.exe51⤵
- Executes dropped EXE
PID:2944 -
\??\c:\1nhttt.exec:\1nhttt.exe52⤵
- Executes dropped EXE
PID:564 -
\??\c:\dpvvv.exec:\dpvvv.exe53⤵
- Executes dropped EXE
PID:344 -
\??\c:\jdpjp.exec:\jdpjp.exe54⤵
- Executes dropped EXE
PID:1332 -
\??\c:\rlxlxrx.exec:\rlxlxrx.exe55⤵
- Executes dropped EXE
PID:980 -
\??\c:\nnnnnt.exec:\nnnnnt.exe56⤵
- Executes dropped EXE
PID:2664 -
\??\c:\pdpjj.exec:\pdpjj.exe57⤵
- Executes dropped EXE
PID:2668 -
\??\c:\7pvdd.exec:\7pvdd.exe58⤵
- Executes dropped EXE
PID:2052 -
\??\c:\1rflrrr.exec:\1rflrrr.exe59⤵
- Executes dropped EXE
PID:1920 -
\??\c:\bnbhnn.exec:\bnbhnn.exe60⤵
- Executes dropped EXE
PID:1216 -
\??\c:\1tnnnt.exec:\1tnnnt.exe61⤵
- Executes dropped EXE
PID:2280 -
\??\c:\jdjdj.exec:\jdjdj.exe62⤵
- Executes dropped EXE
PID:1800 -
\??\c:\3dvdj.exec:\3dvdj.exe63⤵
- Executes dropped EXE
PID:1720 -
\??\c:\9xfxlxf.exec:\9xfxlxf.exe64⤵
- Executes dropped EXE
PID:2192 -
\??\c:\9thntb.exec:\9thntb.exe65⤵
- Executes dropped EXE
PID:1996 -
\??\c:\thhhnn.exec:\thhhnn.exe66⤵PID:2684
-
\??\c:\jjddj.exec:\jjddj.exe67⤵PID:2004
-
\??\c:\pjvvd.exec:\pjvvd.exe68⤵PID:2152
-
\??\c:\1rlrllf.exec:\1rlrllf.exe69⤵PID:748
-
\??\c:\lfxfxfr.exec:\lfxfxfr.exe70⤵PID:2120
-
\??\c:\ttntbh.exec:\ttntbh.exe71⤵PID:2296
-
\??\c:\7dvvj.exec:\7dvvj.exe72⤵PID:2272
-
\??\c:\9dpjj.exec:\9dpjj.exe73⤵PID:2644
-
\??\c:\ffrrrrx.exec:\ffrrrrx.exe74⤵PID:2028
-
\??\c:\xxlrxfl.exec:\xxlrxfl.exe75⤵PID:1448
-
\??\c:\hbtbhn.exec:\hbtbhn.exe76⤵PID:1708
-
\??\c:\jvjpp.exec:\jvjpp.exe77⤵PID:2888
-
\??\c:\vvpvv.exec:\vvpvv.exe78⤵PID:924
-
\??\c:\xxfllrx.exec:\xxfllrx.exe79⤵PID:896
-
\??\c:\fflrlfl.exec:\fflrlfl.exe80⤵PID:1272
-
\??\c:\hhhhbb.exec:\hhhhbb.exe81⤵PID:1724
-
\??\c:\dvddj.exec:\dvddj.exe82⤵PID:888
-
\??\c:\1vjdj.exec:\1vjdj.exe83⤵PID:340
-
\??\c:\fxrflrx.exec:\fxrflrx.exe84⤵PID:572
-
\??\c:\thtnnn.exec:\thtnnn.exe85⤵PID:868
-
\??\c:\bnttbb.exec:\bnttbb.exe86⤵PID:1596
-
\??\c:\jvjpp.exec:\jvjpp.exe87⤵PID:1588
-
\??\c:\rllrffl.exec:\rllrffl.exe88⤵PID:1648
-
\??\c:\xlxxlfr.exec:\xlxxlfr.exe89⤵PID:2752
-
\??\c:\1nbhhn.exec:\1nbhhn.exe90⤵PID:2764
-
\??\c:\7bhbbt.exec:\7bhbbt.exe91⤵PID:2088
-
\??\c:\vjdjd.exec:\vjdjd.exe92⤵PID:3000
-
\??\c:\rflfrlr.exec:\rflfrlr.exe93⤵PID:2560
-
\??\c:\9frrfxf.exec:\9frrfxf.exe94⤵PID:2784
-
\??\c:\nhbbnb.exec:\nhbbnb.exe95⤵PID:2516
-
\??\c:\pjjvv.exec:\pjjvv.exe96⤵PID:2472
-
\??\c:\dpppd.exec:\dpppd.exe97⤵PID:2928
-
\??\c:\xrxxlfl.exec:\xrxxlfl.exe98⤵PID:1748
-
\??\c:\5rrrxrx.exec:\5rrrxrx.exe99⤵PID:2508
-
\??\c:\tnbbbb.exec:\tnbbbb.exe100⤵PID:2944
-
\??\c:\hhtnbb.exec:\hhtnbb.exe101⤵PID:992
-
\??\c:\3vpdv.exec:\3vpdv.exe102⤵PID:264
-
\??\c:\5fflxfr.exec:\5fflxfr.exe103⤵PID:1580
-
\??\c:\frxfllr.exec:\frxfllr.exe104⤵PID:1412
-
\??\c:\bthhnn.exec:\bthhnn.exe105⤵PID:2828
-
\??\c:\btnbhh.exec:\btnbhh.exe106⤵PID:2188
-
\??\c:\dvddd.exec:\dvddd.exe107⤵PID:824
-
\??\c:\xrlxffr.exec:\xrlxffr.exe108⤵PID:1020
-
\??\c:\fxflrxf.exec:\fxflrxf.exe109⤵PID:2000
-
\??\c:\nntbnn.exec:\nntbnn.exe110⤵PID:1992
-
\??\c:\nbhhnn.exec:\nbhhnn.exe111⤵PID:2280
-
\??\c:\jdppv.exec:\jdppv.exe112⤵PID:1048
-
\??\c:\ffxllxx.exec:\ffxllxx.exe113⤵PID:2548
-
\??\c:\rlxlrxf.exec:\rlxlrxf.exe114⤵PID:1460
-
\??\c:\tnbbhh.exec:\tnbbhh.exe115⤵PID:2448
-
\??\c:\btnbbt.exec:\btnbbt.exe116⤵PID:1868
-
\??\c:\7pjjp.exec:\7pjjp.exe117⤵PID:1884
-
\??\c:\5rxrrll.exec:\5rxrrll.exe118⤵PID:2344
-
\??\c:\bththn.exec:\bththn.exe119⤵PID:2316
-
\??\c:\thhhtt.exec:\thhhtt.exe120⤵PID:1484
-
\??\c:\5vjjj.exec:\5vjjj.exe121⤵PID:2196
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-