Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/11/2024, 00:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8627715f925746dfee87432c7cbd808ac3335f378bf3ff4b156423160ad07d8c.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
8627715f925746dfee87432c7cbd808ac3335f378bf3ff4b156423160ad07d8c.exe
-
Size
453KB
-
MD5
a19c2cee7dacdd052ac8bcb20ef9dd93
-
SHA1
42eb77b449bf933f54bef5170ad6116ffc6be3f2
-
SHA256
8627715f925746dfee87432c7cbd808ac3335f378bf3ff4b156423160ad07d8c
-
SHA512
bf17d7c9cb4375bd211f85ceb189939003d96acff58ed5174906d8285ef9f8ce8b314aeefc3ac1590f5447d9e97278702f301c802b51f7e3bf5e937f268ed17e
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbef:q7Tc2NYHUrAwfMp3CDf
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/264-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2068-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1864-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/568-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1516-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1900-107-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2564-125-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2564-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1680-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1876-144-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1680-165-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2912-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1272-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2148-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1912-226-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1796-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/624-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2432-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3044-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/988-305-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1784-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1932-346-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2808-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-379-0x0000000001C50000-0x0000000001C7A000-memory.dmp family_blackmoon behavioral1/memory/2600-386-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1916-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-447-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-442-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/684-488-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-512-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1508-526-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/804-590-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2624-646-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2696-658-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-665-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2696-678-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1872-704-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2752-711-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1980-718-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2408-738-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2252-764-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/896-777-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2068 9bthbt.exe 2544 jdpvj.exe 1864 flfllfx.exe 568 ffrxfrx.exe 2808 frlxxlf.exe 2708 rlfrfrx.exe 2792 hhttbh.exe 2740 dvpdv.exe 2588 bnnbnh.exe 1900 xfrflxf.exe 1516 vpjpj.exe 2564 rrrlrfr.exe 1680 vvjvd.exe 1876 7ttbtn.exe 2004 lxrxllx.exe 1848 thnhnb.exe 1348 rlxflxf.exe 2912 1tnhtn.exe 2144 pdjdv.exe 348 ttbtnb.exe 1272 httnhn.exe 2148 dvvpv.exe 1912 thhbbb.exe 624 lrxlxlf.exe 1796 1vjpd.exe 2432 rrflrfr.exe 2108 ppjjv.exe 2228 3rlrfff.exe 988 1jdjv.exe 1764 rfxlxfr.exe 3044 dvvdp.exe 1688 flfrlxr.exe 480 djjvj.exe 2480 rlflrfr.exe 1932 ttbnhn.exe 1784 3ppvd.exe 2784 1xrflrx.exe 2984 3fxlfxl.exe 2808 5bthtb.exe 2584 xxrxrfx.exe 2600 hnthht.exe 2880 nhtbhh.exe 2740 jjpvd.exe 2592 1rlrflf.exe 2204 tbbtth.exe 2388 ppjpv.exe 1916 3llxlxf.exe 1924 tnbnbn.exe 1064 vvpvd.exe 2392 ppjdv.exe 1884 frrxxxf.exe 856 nnhbnt.exe 2756 jjjpp.exe 1752 rlflxxl.exe 2964 tbbtbh.exe 2268 thbhbh.exe 1736 dvdjv.exe 1532 ffxrfrf.exe 684 nbtttn.exe 1096 3vdpd.exe 2192 rxflllx.exe 3000 9thtnt.exe 1800 tthntt.exe 1508 xxlrffx.exe -
resource yara_rule behavioral1/memory/264-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1864-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1864-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/568-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1516-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1272-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1796-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/624-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1784-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-386-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1916-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/684-489-0x00000000001C0000-0x00000000001EA000-memory.dmp upx behavioral1/memory/684-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-512-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-559-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/804-590-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2728-623-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2776-630-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2852-637-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2696-658-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-685-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1872-704-0x00000000002B0000-0x00000000002DA000-memory.dmp upx behavioral1/memory/2752-711-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-718-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-725-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rxxrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rlflrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnthht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhttbb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 264 wrote to memory of 2068 264 8627715f925746dfee87432c7cbd808ac3335f378bf3ff4b156423160ad07d8c.exe 31 PID 264 wrote to memory of 2068 264 8627715f925746dfee87432c7cbd808ac3335f378bf3ff4b156423160ad07d8c.exe 31 PID 264 wrote to memory of 2068 264 8627715f925746dfee87432c7cbd808ac3335f378bf3ff4b156423160ad07d8c.exe 31 PID 264 wrote to memory of 2068 264 8627715f925746dfee87432c7cbd808ac3335f378bf3ff4b156423160ad07d8c.exe 31 PID 2068 wrote to memory of 2544 2068 9bthbt.exe 32 PID 2068 wrote to memory of 2544 2068 9bthbt.exe 32 PID 2068 wrote to memory of 2544 2068 9bthbt.exe 32 PID 2068 wrote to memory of 2544 2068 9bthbt.exe 32 PID 2544 wrote to memory of 1864 2544 jdpvj.exe 33 PID 2544 wrote to memory of 1864 2544 jdpvj.exe 33 PID 2544 wrote to memory of 1864 2544 jdpvj.exe 33 PID 2544 wrote to memory of 1864 2544 jdpvj.exe 33 PID 1864 wrote to memory of 568 1864 flfllfx.exe 34 PID 1864 wrote to memory of 568 1864 flfllfx.exe 34 PID 1864 wrote to memory of 568 1864 flfllfx.exe 34 PID 1864 wrote to memory of 568 1864 flfllfx.exe 34 PID 568 wrote to memory of 2808 568 ffrxfrx.exe 35 PID 568 wrote to memory of 2808 568 ffrxfrx.exe 35 PID 568 wrote to memory of 2808 568 ffrxfrx.exe 35 PID 568 wrote to memory of 2808 568 ffrxfrx.exe 35 PID 2808 wrote to memory of 2708 2808 frlxxlf.exe 36 PID 2808 wrote to memory of 2708 2808 frlxxlf.exe 36 PID 2808 wrote to memory of 2708 2808 frlxxlf.exe 36 PID 2808 wrote to memory of 2708 2808 frlxxlf.exe 36 PID 2708 wrote to memory of 2792 2708 rlfrfrx.exe 37 PID 2708 wrote to memory of 2792 2708 rlfrfrx.exe 37 PID 2708 wrote to memory of 2792 2708 rlfrfrx.exe 37 PID 2708 wrote to memory of 2792 2708 rlfrfrx.exe 37 PID 2792 wrote to memory of 2740 2792 hhttbh.exe 38 PID 2792 wrote to memory of 2740 2792 hhttbh.exe 38 PID 2792 wrote to memory of 2740 2792 hhttbh.exe 38 PID 2792 wrote to memory of 2740 2792 hhttbh.exe 38 PID 2740 wrote to memory of 2588 2740 dvpdv.exe 39 PID 2740 wrote to memory of 2588 2740 dvpdv.exe 39 PID 2740 wrote to memory of 2588 2740 dvpdv.exe 39 PID 2740 wrote to memory of 2588 2740 dvpdv.exe 39 PID 2588 wrote to memory of 1900 2588 bnnbnh.exe 40 PID 2588 wrote to memory of 1900 2588 bnnbnh.exe 40 PID 2588 wrote to memory of 1900 2588 bnnbnh.exe 40 PID 2588 wrote to memory of 1900 2588 bnnbnh.exe 40 PID 1900 wrote to memory of 1516 1900 xfrflxf.exe 41 PID 1900 wrote to memory of 1516 1900 xfrflxf.exe 41 PID 1900 wrote to memory of 1516 1900 xfrflxf.exe 41 PID 1900 wrote to memory of 1516 1900 xfrflxf.exe 41 PID 1516 wrote to memory of 2564 1516 vpjpj.exe 42 PID 1516 wrote to memory of 2564 1516 vpjpj.exe 42 PID 1516 wrote to memory of 2564 1516 vpjpj.exe 42 PID 1516 wrote to memory of 2564 1516 vpjpj.exe 42 PID 2564 wrote to memory of 1680 2564 rrrlrfr.exe 43 PID 2564 wrote to memory of 1680 2564 rrrlrfr.exe 43 PID 2564 wrote to memory of 1680 2564 rrrlrfr.exe 43 PID 2564 wrote to memory of 1680 2564 rrrlrfr.exe 43 PID 1680 wrote to memory of 1876 1680 vvjvd.exe 44 PID 1680 wrote to memory of 1876 1680 vvjvd.exe 44 PID 1680 wrote to memory of 1876 1680 vvjvd.exe 44 PID 1680 wrote to memory of 1876 1680 vvjvd.exe 44 PID 1876 wrote to memory of 2004 1876 7ttbtn.exe 45 PID 1876 wrote to memory of 2004 1876 7ttbtn.exe 45 PID 1876 wrote to memory of 2004 1876 7ttbtn.exe 45 PID 1876 wrote to memory of 2004 1876 7ttbtn.exe 45 PID 2004 wrote to memory of 1848 2004 lxrxllx.exe 46 PID 2004 wrote to memory of 1848 2004 lxrxllx.exe 46 PID 2004 wrote to memory of 1848 2004 lxrxllx.exe 46 PID 2004 wrote to memory of 1848 2004 lxrxllx.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\8627715f925746dfee87432c7cbd808ac3335f378bf3ff4b156423160ad07d8c.exe"C:\Users\Admin\AppData\Local\Temp\8627715f925746dfee87432c7cbd808ac3335f378bf3ff4b156423160ad07d8c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:264 -
\??\c:\9bthbt.exec:\9bthbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\jdpvj.exec:\jdpvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\flfllfx.exec:\flfllfx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\ffrxfrx.exec:\ffrxfrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:568 -
\??\c:\frlxxlf.exec:\frlxxlf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\rlfrfrx.exec:\rlfrfrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\hhttbh.exec:\hhttbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\dvpdv.exec:\dvpdv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\bnnbnh.exec:\bnnbnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\xfrflxf.exec:\xfrflxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\vpjpj.exec:\vpjpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\rrrlrfr.exec:\rrrlrfr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\vvjvd.exec:\vvjvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\7ttbtn.exec:\7ttbtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\lxrxllx.exec:\lxrxllx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\thnhnb.exec:\thnhnb.exe17⤵
- Executes dropped EXE
PID:1848 -
\??\c:\rlxflxf.exec:\rlxflxf.exe18⤵
- Executes dropped EXE
PID:1348 -
\??\c:\1tnhtn.exec:\1tnhtn.exe19⤵
- Executes dropped EXE
PID:2912 -
\??\c:\pdjdv.exec:\pdjdv.exe20⤵
- Executes dropped EXE
PID:2144 -
\??\c:\ttbtnb.exec:\ttbtnb.exe21⤵
- Executes dropped EXE
PID:348 -
\??\c:\httnhn.exec:\httnhn.exe22⤵
- Executes dropped EXE
PID:1272 -
\??\c:\dvvpv.exec:\dvvpv.exe23⤵
- Executes dropped EXE
PID:2148 -
\??\c:\thhbbb.exec:\thhbbb.exe24⤵
- Executes dropped EXE
PID:1912 -
\??\c:\lrxlxlf.exec:\lrxlxlf.exe25⤵
- Executes dropped EXE
PID:624 -
\??\c:\1vjpd.exec:\1vjpd.exe26⤵
- Executes dropped EXE
PID:1796 -
\??\c:\rrflrfr.exec:\rrflrfr.exe27⤵
- Executes dropped EXE
PID:2432 -
\??\c:\ppjjv.exec:\ppjjv.exe28⤵
- Executes dropped EXE
PID:2108 -
\??\c:\3rlrfff.exec:\3rlrfff.exe29⤵
- Executes dropped EXE
PID:2228 -
\??\c:\1jdjv.exec:\1jdjv.exe30⤵
- Executes dropped EXE
PID:988 -
\??\c:\rfxlxfr.exec:\rfxlxfr.exe31⤵
- Executes dropped EXE
PID:1764 -
\??\c:\dvvdp.exec:\dvvdp.exe32⤵
- Executes dropped EXE
PID:3044 -
\??\c:\flfrlxr.exec:\flfrlxr.exe33⤵
- Executes dropped EXE
PID:1688 -
\??\c:\djjvj.exec:\djjvj.exe34⤵
- Executes dropped EXE
PID:480 -
\??\c:\rlflrfr.exec:\rlflrfr.exe35⤵
- Executes dropped EXE
PID:2480 -
\??\c:\ttbnhn.exec:\ttbnhn.exe36⤵
- Executes dropped EXE
PID:1932 -
\??\c:\3ppvd.exec:\3ppvd.exe37⤵
- Executes dropped EXE
PID:1784 -
\??\c:\1xrflrx.exec:\1xrflrx.exe38⤵
- Executes dropped EXE
PID:2784 -
\??\c:\3fxlfxl.exec:\3fxlfxl.exe39⤵
- Executes dropped EXE
PID:2984 -
\??\c:\5bthtb.exec:\5bthtb.exe40⤵
- Executes dropped EXE
PID:2808 -
\??\c:\xxrxrfx.exec:\xxrxrfx.exe41⤵
- Executes dropped EXE
PID:2584 -
\??\c:\hnthht.exec:\hnthht.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2600 -
\??\c:\nhtbhh.exec:\nhtbhh.exe43⤵
- Executes dropped EXE
PID:2880 -
\??\c:\jjpvd.exec:\jjpvd.exe44⤵
- Executes dropped EXE
PID:2740 -
\??\c:\1rlrflf.exec:\1rlrflf.exe45⤵
- Executes dropped EXE
PID:2592 -
\??\c:\tbbtth.exec:\tbbtth.exe46⤵
- Executes dropped EXE
PID:2204 -
\??\c:\ppjpv.exec:\ppjpv.exe47⤵
- Executes dropped EXE
PID:2388 -
\??\c:\3llxlxf.exec:\3llxlxf.exe48⤵
- Executes dropped EXE
PID:1916 -
\??\c:\tnbnbn.exec:\tnbnbn.exe49⤵
- Executes dropped EXE
PID:1924 -
\??\c:\vvpvd.exec:\vvpvd.exe50⤵
- Executes dropped EXE
PID:1064 -
\??\c:\ppjdv.exec:\ppjdv.exe51⤵
- Executes dropped EXE
PID:2392 -
\??\c:\frrxxxf.exec:\frrxxxf.exe52⤵
- Executes dropped EXE
PID:1884 -
\??\c:\nnhbnt.exec:\nnhbnt.exe53⤵
- Executes dropped EXE
PID:856 -
\??\c:\jjjpp.exec:\jjjpp.exe54⤵
- Executes dropped EXE
PID:2756 -
\??\c:\rlflxxl.exec:\rlflxxl.exe55⤵
- Executes dropped EXE
PID:1752 -
\??\c:\tbbtbh.exec:\tbbtbh.exe56⤵
- Executes dropped EXE
PID:2964 -
\??\c:\thbhbh.exec:\thbhbh.exe57⤵
- Executes dropped EXE
PID:2268 -
\??\c:\dvdjv.exec:\dvdjv.exe58⤵
- Executes dropped EXE
PID:1736 -
\??\c:\ffxrfrf.exec:\ffxrfrf.exe59⤵
- Executes dropped EXE
PID:1532 -
\??\c:\nbtttn.exec:\nbtttn.exe60⤵
- Executes dropped EXE
PID:684 -
\??\c:\3vdpd.exec:\3vdpd.exe61⤵
- Executes dropped EXE
PID:1096 -
\??\c:\rxflllx.exec:\rxflllx.exe62⤵
- Executes dropped EXE
PID:2192 -
\??\c:\9thtnt.exec:\9thtnt.exe63⤵
- Executes dropped EXE
PID:3000 -
\??\c:\tthntt.exec:\tthntt.exe64⤵
- Executes dropped EXE
PID:1800 -
\??\c:\xxlrffx.exec:\xxlrffx.exe65⤵
- Executes dropped EXE
PID:1508 -
\??\c:\xrrrxxr.exec:\xrrrxxr.exe66⤵PID:3048
-
\??\c:\tththt.exec:\tththt.exe67⤵PID:1748
-
\??\c:\jdvdj.exec:\jdvdj.exe68⤵PID:2424
-
\??\c:\9fxfxfl.exec:\9fxfxfl.exe69⤵PID:3032
-
\??\c:\tnthnt.exec:\tnthnt.exe70⤵PID:2072
-
\??\c:\1nhnbb.exec:\1nhnbb.exe71⤵PID:1620
-
\??\c:\vjjpj.exec:\vjjpj.exe72⤵PID:264
-
\??\c:\xxrfrff.exec:\xxrfrff.exe73⤵PID:2340
-
\??\c:\tthnbb.exec:\tthnbb.exe74⤵PID:2052
-
\??\c:\jdvjp.exec:\jdvjp.exe75⤵PID:804
-
\??\c:\lrrrxfl.exec:\lrrrxfl.exe76⤵PID:2056
-
\??\c:\9xrlrxl.exec:\9xrlrxl.exe77⤵PID:2236
-
\??\c:\httnth.exec:\httnth.exe78⤵PID:2776
-
\??\c:\9jdvp.exec:\9jdvp.exe79⤵PID:2860
-
\??\c:\jpppj.exec:\jpppj.exe80⤵PID:2728
-
\??\c:\9lrrxfl.exec:\9lrrxfl.exe81⤵PID:2612
-
\??\c:\3nntnb.exec:\3nntnb.exe82⤵PID:2852
-
\??\c:\9vvpp.exec:\9vvpp.exe83⤵PID:2632
-
\??\c:\1frfrxr.exec:\1frfrxr.exe84⤵PID:2624
-
\??\c:\xlxxrfl.exec:\xlxxrfl.exe85⤵PID:2696
-
\??\c:\bbnhhb.exec:\bbnhhb.exe86⤵PID:3068
-
\??\c:\7dvjp.exec:\7dvjp.exe87⤵PID:2036
-
\??\c:\9xxrxlr.exec:\9xxrxlr.exe88⤵PID:2764
-
\??\c:\7nhtbb.exec:\7nhtbb.exe89⤵PID:1516
-
\??\c:\pvvpp.exec:\pvvpp.exe90⤵PID:1632
-
\??\c:\1jjvv.exec:\1jjvv.exe91⤵PID:2104
-
\??\c:\lfflffl.exec:\lfflffl.exe92⤵PID:1872
-
\??\c:\3nbtnn.exec:\3nbtnn.exe93⤵PID:2752
-
\??\c:\9pjpj.exec:\9pjpj.exe94⤵PID:1980
-
\??\c:\rrlxxll.exec:\rrlxxll.exe95⤵PID:2916
-
\??\c:\3tbbhn.exec:\3tbbhn.exe96⤵PID:2848
-
\??\c:\pvdjv.exec:\pvdjv.exe97⤵PID:2408
-
\??\c:\rlxxlrx.exec:\rlxxlrx.exe98⤵PID:2252
-
\??\c:\7ttbhh.exec:\7ttbhh.exe99⤵PID:600
-
\??\c:\jdpvp.exec:\jdpvp.exe100⤵PID:1584
-
\??\c:\pjvjv.exec:\pjvjv.exe101⤵PID:576
-
\??\c:\lfrfflx.exec:\lfrfflx.exe102⤵PID:1704
-
\??\c:\hhhnbh.exec:\hhhnbh.exe103⤵PID:896
-
\??\c:\dvjpp.exec:\dvjpp.exe104⤵PID:736
-
\??\c:\ppppd.exec:\ppppd.exe105⤵PID:624
-
\??\c:\rlrflrx.exec:\rlrflrx.exe106⤵PID:1800
-
\??\c:\xrfllll.exec:\xrfllll.exe107⤵PID:2288
-
\??\c:\nthtnb.exec:\nthtnb.exe108⤵PID:2976
-
\??\c:\ddvjv.exec:\ddvjv.exe109⤵PID:2160
-
\??\c:\xxlrrlx.exec:\xxlrrlx.exe110⤵PID:2228
-
\??\c:\lfxfffl.exec:\lfxfffl.exe111⤵PID:560
-
\??\c:\nnhttn.exec:\nnhttn.exe112⤵PID:2072
-
\??\c:\1vvvj.exec:\1vvvj.exe113⤵PID:1572
-
\??\c:\pjjpp.exec:\pjjpp.exe114⤵PID:1564
-
\??\c:\7rrfrxl.exec:\7rrfrxl.exe115⤵PID:744
-
\??\c:\hhnbtb.exec:\hhnbtb.exe116⤵PID:480
-
\??\c:\vddjv.exec:\vddjv.exe117⤵PID:768
-
\??\c:\rrxllrf.exec:\rrxllrf.exe118⤵PID:1864
-
\??\c:\tnnntt.exec:\tnnntt.exe119⤵PID:2704
-
\??\c:\hhhnbh.exec:\hhhnbh.exe120⤵PID:2816
-
\??\c:\jjdjv.exec:\jjdjv.exe121⤵PID:2804
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-