Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
30/11/2024, 02:58
Behavioral task
behavioral1
Sample
5d312b073e628a940f300343bfdd7ee1c5a2dda766f9314b049f857a8d90cbf9N.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
120 seconds
General
-
Target
5d312b073e628a940f300343bfdd7ee1c5a2dda766f9314b049f857a8d90cbf9N.exe
-
Size
3.7MB
-
MD5
d9bf54b14b9997759510353ced67c8f0
-
SHA1
3bc5d2dd168a1594b64127364738b3f73946853a
-
SHA256
5d312b073e628a940f300343bfdd7ee1c5a2dda766f9314b049f857a8d90cbf9
-
SHA512
f9785f7f97d40b934343826e43ef7b7bff0f03f5ca41448734da033bba0233fd6f6a2a4a08760fa440d3fb97899a5e2efcf7bef7164d9ea8e230828a849973f5
-
SSDEEP
49152:gCOfN6X5tLLQTg20ITS/PPs/1kS4eKRL/SRsj0Zuur1T75YqVUrmNF988:U6XLq/qPPslzKx/dJg1ErmNP
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 52 IoCs
resource yara_rule behavioral1/memory/3064-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/708-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/708-17-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/2112-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3012-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2712-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2712-46-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2832-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2640-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2740-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2608-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2724-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1580-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2924-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2036-132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2036-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1792-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1792-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2392-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2988-195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2436-211-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1336-248-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1940-245-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2128-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2228-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2540-304-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2476-329-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2876-373-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1756-412-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1224-438-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2856-437-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1224-445-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2336-465-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2052-463-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2484-479-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1620-499-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1764-534-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1764-541-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2340-584-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1736-583-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2340-591-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2880-616-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2320-644-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2900-702-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2900-701-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/572-712-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/572-710-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1504-854-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1504-852-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2112-868-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2140-902-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1060-947-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Njrat family
-
Executes dropped EXE 64 IoCs
pid Process 708 vpvdv.exe 2112 lflxfff.exe 3012 xrlflrf.exe 2712 vpvvd.exe 2832 nthhtb.exe 2640 xrlxlrr.exe 2740 flrfffx.exe 2608 thbhnb.exe 2724 thtbhh.exe 2236 hbthth.exe 1580 jvjvj.exe 2924 vpvvj.exe 1308 rlfxlrr.exe 2036 fxxxlrf.exe 484 dpdpv.exe 1792 vjvjp.exe 2704 9dppp.exe 3004 nhtbhn.exe 2928 9nbbnh.exe 2392 9xrfflr.exe 2988 tnbhth.exe 2436 5fflffl.exe 2584 rrrxxfr.exe 1036 9vdjv.exe 968 rlxlrrf.exe 1940 vpjdj.exe 1336 ddjdv.exe 2128 hbnnbn.exe 2228 btnthh.exe 716 tnhtbt.exe 1812 hbnnbb.exe 1080 nnhnhb.exe 2564 rlllfrx.exe 2540 llflxfr.exe 1736 jvpvd.exe 708 dvpdp.exe 1956 7htbbb.exe 2476 flxffxl.exe 2708 vppdj.exe 2812 9dpdj.exe 2836 vpddv.exe 1516 lfxfflr.exe 2828 1jdjd.exe 2876 jdpvd.exe 2656 jdjjj.exe 2892 dvvjj.exe 588 bhhhbh.exe 2236 rffxxfx.exe 1580 ffrxxlr.exe 1816 pvjpp.exe 1756 hbnnnh.exe 2036 5frxxrr.exe 1248 vpjpd.exe 2856 pjdvd.exe 1224 hhttbh.exe 2996 llrxfrl.exe 2288 fxllxfr.exe 2052 vpdjv.exe 2336 5hbntb.exe 2484 xxlrrxr.exe 3052 jjdvd.exe 628 ppjvd.exe 1620 nhttbt.exe 2968 lxlrlrf.exe -
resource yara_rule behavioral1/memory/3064-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00090000000120f9-7.dat upx behavioral1/memory/708-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3064-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000a000000015d79-21.dat upx behavioral1/memory/708-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2112-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015e48-27.dat upx behavioral1/files/0x0007000000015ec9-40.dat upx behavioral1/memory/2712-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3012-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015f71-48.dat upx behavioral1/memory/2712-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2712-46-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0007000000015ff5-58.dat upx behavioral1/memory/2832-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000015d2a-69.dat upx behavioral1/memory/2740-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2640-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016101-77.dat upx behavioral1/memory/2740-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2608-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016241-86.dat upx behavioral1/files/0x0006000000016d36-96.dat upx behavioral1/memory/2724-94-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1580-106-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d3f-105.dat upx behavioral1/files/0x0006000000016d47-114.dat upx behavioral1/memory/2924-115-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d4f-121.dat upx behavioral1/files/0x0006000000016d63-130.dat upx behavioral1/memory/2036-132-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/484-141-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d69-140.dat upx behavioral1/memory/2036-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1792-151-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d6d-150.dat upx behavioral1/files/0x0006000000016d72-160.dat upx behavioral1/memory/1792-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016dd9-169.dat upx behavioral1/files/0x0006000000016de0-176.dat upx behavioral1/files/0x0006000000016dea-185.dat upx behavioral1/memory/2392-192-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2988-195-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016eb4-194.dat upx behavioral1/files/0x0006000000017047-204.dat upx behavioral1/memory/2436-203-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001743a-213.dat upx behavioral1/memory/2436-211-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001747d-221.dat upx behavioral1/files/0x0006000000017491-229.dat upx behavioral1/files/0x00060000000175e7-236.dat upx behavioral1/memory/1336-248-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018669-247.dat upx behavioral1/memory/1940-245-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1940-237-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x001400000001866f-256.dat upx behavioral1/files/0x0011000000018682-265.dat upx behavioral1/memory/2128-263-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2228-266-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001868b-274.dat upx behavioral1/files/0x00050000000186f2-281.dat upx behavioral1/files/0x00050000000186f8-289.dat upx behavioral1/memory/2564-297-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hbnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffrrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfxxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1djvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxlxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxlxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rrffrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbtbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bbthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxrlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fflxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbthnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxlfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tbhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bhnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5htttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ttbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbtnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rrflxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fxxrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrxrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxxxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrllff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhttbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxflxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrlflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hbbbn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3064 wrote to memory of 708 3064 5d312b073e628a940f300343bfdd7ee1c5a2dda766f9314b049f857a8d90cbf9N.exe 30 PID 3064 wrote to memory of 708 3064 5d312b073e628a940f300343bfdd7ee1c5a2dda766f9314b049f857a8d90cbf9N.exe 30 PID 3064 wrote to memory of 708 3064 5d312b073e628a940f300343bfdd7ee1c5a2dda766f9314b049f857a8d90cbf9N.exe 30 PID 3064 wrote to memory of 708 3064 5d312b073e628a940f300343bfdd7ee1c5a2dda766f9314b049f857a8d90cbf9N.exe 30 PID 708 wrote to memory of 2112 708 vpvdv.exe 31 PID 708 wrote to memory of 2112 708 vpvdv.exe 31 PID 708 wrote to memory of 2112 708 vpvdv.exe 31 PID 708 wrote to memory of 2112 708 vpvdv.exe 31 PID 2112 wrote to memory of 3012 2112 lflxfff.exe 32 PID 2112 wrote to memory of 3012 2112 lflxfff.exe 32 PID 2112 wrote to memory of 3012 2112 lflxfff.exe 32 PID 2112 wrote to memory of 3012 2112 lflxfff.exe 32 PID 3012 wrote to memory of 2712 3012 xrlflrf.exe 33 PID 3012 wrote to memory of 2712 3012 xrlflrf.exe 33 PID 3012 wrote to memory of 2712 3012 xrlflrf.exe 33 PID 3012 wrote to memory of 2712 3012 xrlflrf.exe 33 PID 2712 wrote to memory of 2832 2712 vpvvd.exe 34 PID 2712 wrote to memory of 2832 2712 vpvvd.exe 34 PID 2712 wrote to memory of 2832 2712 vpvvd.exe 34 PID 2712 wrote to memory of 2832 2712 vpvvd.exe 34 PID 2832 wrote to memory of 2640 2832 nthhtb.exe 35 PID 2832 wrote to memory of 2640 2832 nthhtb.exe 35 PID 2832 wrote to memory of 2640 2832 nthhtb.exe 35 PID 2832 wrote to memory of 2640 2832 nthhtb.exe 35 PID 2640 wrote to memory of 2740 2640 xrlxlrr.exe 36 PID 2640 wrote to memory of 2740 2640 xrlxlrr.exe 36 PID 2640 wrote to memory of 2740 2640 xrlxlrr.exe 36 PID 2640 wrote to memory of 2740 2640 xrlxlrr.exe 36 PID 2740 wrote to memory of 2608 2740 flrfffx.exe 37 PID 2740 wrote to memory of 2608 2740 flrfffx.exe 37 PID 2740 wrote to memory of 2608 2740 flrfffx.exe 37 PID 2740 wrote to memory of 2608 2740 flrfffx.exe 37 PID 2608 wrote to memory of 2724 2608 thbhnb.exe 38 PID 2608 wrote to memory of 2724 2608 thbhnb.exe 38 PID 2608 wrote to memory of 2724 2608 thbhnb.exe 38 PID 2608 wrote to memory of 2724 2608 thbhnb.exe 38 PID 2724 wrote to memory of 2236 2724 thtbhh.exe 77 PID 2724 wrote to memory of 2236 2724 thtbhh.exe 77 PID 2724 wrote to memory of 2236 2724 thtbhh.exe 77 PID 2724 wrote to memory of 2236 2724 thtbhh.exe 77 PID 2236 wrote to memory of 1580 2236 hbthth.exe 78 PID 2236 wrote to memory of 1580 2236 hbthth.exe 78 PID 2236 wrote to memory of 1580 2236 hbthth.exe 78 PID 2236 wrote to memory of 1580 2236 hbthth.exe 78 PID 1580 wrote to memory of 2924 1580 jvjvj.exe 41 PID 1580 wrote to memory of 2924 1580 jvjvj.exe 41 PID 1580 wrote to memory of 2924 1580 jvjvj.exe 41 PID 1580 wrote to memory of 2924 1580 jvjvj.exe 41 PID 2924 wrote to memory of 1308 2924 vpvvj.exe 42 PID 2924 wrote to memory of 1308 2924 vpvvj.exe 42 PID 2924 wrote to memory of 1308 2924 vpvvj.exe 42 PID 2924 wrote to memory of 1308 2924 vpvvj.exe 42 PID 1308 wrote to memory of 2036 1308 rlfxlrr.exe 81 PID 1308 wrote to memory of 2036 1308 rlfxlrr.exe 81 PID 1308 wrote to memory of 2036 1308 rlfxlrr.exe 81 PID 1308 wrote to memory of 2036 1308 rlfxlrr.exe 81 PID 2036 wrote to memory of 484 2036 fxxxlrf.exe 44 PID 2036 wrote to memory of 484 2036 fxxxlrf.exe 44 PID 2036 wrote to memory of 484 2036 fxxxlrf.exe 44 PID 2036 wrote to memory of 484 2036 fxxxlrf.exe 44 PID 484 wrote to memory of 1792 484 dpdpv.exe 45 PID 484 wrote to memory of 1792 484 dpdpv.exe 45 PID 484 wrote to memory of 1792 484 dpdpv.exe 45 PID 484 wrote to memory of 1792 484 dpdpv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d312b073e628a940f300343bfdd7ee1c5a2dda766f9314b049f857a8d90cbf9N.exe"C:\Users\Admin\AppData\Local\Temp\5d312b073e628a940f300343bfdd7ee1c5a2dda766f9314b049f857a8d90cbf9N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\vpvdv.exec:\vpvdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:708 -
\??\c:\lflxfff.exec:\lflxfff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\xrlflrf.exec:\xrlflrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\vpvvd.exec:\vpvvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\nthhtb.exec:\nthhtb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\xrlxlrr.exec:\xrlxlrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\flrfffx.exec:\flrfffx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\thbhnb.exec:\thbhnb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\thtbhh.exec:\thtbhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\hbthth.exec:\hbthth.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\jvjvj.exec:\jvjvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\vpvvj.exec:\vpvvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\rlfxlrr.exec:\rlfxlrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
\??\c:\fxxxlrf.exec:\fxxxlrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\dpdpv.exec:\dpdpv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:484 -
\??\c:\vjvjp.exec:\vjvjp.exe17⤵
- Executes dropped EXE
PID:1792 -
\??\c:\9dppp.exec:\9dppp.exe18⤵
- Executes dropped EXE
PID:2704 -
\??\c:\nhtbhn.exec:\nhtbhn.exe19⤵
- Executes dropped EXE
PID:3004 -
\??\c:\9nbbnh.exec:\9nbbnh.exe20⤵
- Executes dropped EXE
PID:2928 -
\??\c:\9xrfflr.exec:\9xrfflr.exe21⤵
- Executes dropped EXE
PID:2392 -
\??\c:\tnbhth.exec:\tnbhth.exe22⤵
- Executes dropped EXE
PID:2988 -
\??\c:\5fflffl.exec:\5fflffl.exe23⤵
- Executes dropped EXE
PID:2436 -
\??\c:\rrrxxfr.exec:\rrrxxfr.exe24⤵
- Executes dropped EXE
PID:2584 -
\??\c:\9vdjv.exec:\9vdjv.exe25⤵
- Executes dropped EXE
PID:1036 -
\??\c:\rlxlrrf.exec:\rlxlrrf.exe26⤵
- Executes dropped EXE
PID:968 -
\??\c:\vpjdj.exec:\vpjdj.exe27⤵
- Executes dropped EXE
PID:1940 -
\??\c:\ddjdv.exec:\ddjdv.exe28⤵
- Executes dropped EXE
PID:1336 -
\??\c:\hbnnbn.exec:\hbnnbn.exe29⤵
- Executes dropped EXE
PID:2128 -
\??\c:\btnthh.exec:\btnthh.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2228 -
\??\c:\tnhtbt.exec:\tnhtbt.exe31⤵
- Executes dropped EXE
PID:716 -
\??\c:\hbnnbb.exec:\hbnnbb.exe32⤵
- Executes dropped EXE
PID:1812 -
\??\c:\nnhnhb.exec:\nnhnhb.exe33⤵
- Executes dropped EXE
PID:1080 -
\??\c:\rlllfrx.exec:\rlllfrx.exe34⤵
- Executes dropped EXE
PID:2564 -
\??\c:\llflxfr.exec:\llflxfr.exe35⤵
- Executes dropped EXE
PID:2540 -
\??\c:\jvpvd.exec:\jvpvd.exe36⤵
- Executes dropped EXE
PID:1736 -
\??\c:\dvpdp.exec:\dvpdp.exe37⤵
- Executes dropped EXE
PID:708 -
\??\c:\7htbbb.exec:\7htbbb.exe38⤵
- Executes dropped EXE
PID:1956 -
\??\c:\flxffxl.exec:\flxffxl.exe39⤵
- Executes dropped EXE
PID:2476 -
\??\c:\vppdj.exec:\vppdj.exe40⤵
- Executes dropped EXE
PID:2708 -
\??\c:\9dpdj.exec:\9dpdj.exe41⤵
- Executes dropped EXE
PID:2812 -
\??\c:\vpddv.exec:\vpddv.exe42⤵
- Executes dropped EXE
PID:2836 -
\??\c:\lfxfflr.exec:\lfxfflr.exe43⤵
- Executes dropped EXE
PID:1516 -
\??\c:\1jdjd.exec:\1jdjd.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2828 -
\??\c:\jdpvd.exec:\jdpvd.exe45⤵
- Executes dropped EXE
PID:2876 -
\??\c:\jdjjj.exec:\jdjjj.exe46⤵
- Executes dropped EXE
PID:2656 -
\??\c:\dvvjj.exec:\dvvjj.exe47⤵
- Executes dropped EXE
PID:2892 -
\??\c:\bhhhbh.exec:\bhhhbh.exe48⤵
- Executes dropped EXE
PID:588 -
\??\c:\rffxxfx.exec:\rffxxfx.exe49⤵
- Executes dropped EXE
PID:2236 -
\??\c:\ffrxxlr.exec:\ffrxxlr.exe50⤵
- Executes dropped EXE
PID:1580 -
\??\c:\pvjpp.exec:\pvjpp.exe51⤵
- Executes dropped EXE
PID:1816 -
\??\c:\hbnnnh.exec:\hbnnnh.exe52⤵
- Executes dropped EXE
PID:1756 -
\??\c:\5frxxrr.exec:\5frxxrr.exe53⤵
- Executes dropped EXE
PID:2036 -
\??\c:\vpjpd.exec:\vpjpd.exe54⤵
- Executes dropped EXE
PID:1248 -
\??\c:\pjdvd.exec:\pjdvd.exe55⤵
- Executes dropped EXE
PID:2856 -
\??\c:\hhttbh.exec:\hhttbh.exe56⤵
- Executes dropped EXE
PID:1224 -
\??\c:\llrxfrl.exec:\llrxfrl.exe57⤵
- Executes dropped EXE
PID:2996 -
\??\c:\fxllxfr.exec:\fxllxfr.exe58⤵
- Executes dropped EXE
PID:2288 -
\??\c:\vpdjv.exec:\vpdjv.exe59⤵
- Executes dropped EXE
PID:2052 -
\??\c:\5hbntb.exec:\5hbntb.exe60⤵
- Executes dropped EXE
PID:2336 -
\??\c:\xxlrrxr.exec:\xxlrrxr.exe61⤵
- Executes dropped EXE
PID:2484 -
\??\c:\jjdvd.exec:\jjdvd.exe62⤵
- Executes dropped EXE
PID:3052 -
\??\c:\ppjvd.exec:\ppjvd.exe63⤵
- Executes dropped EXE
PID:628 -
\??\c:\nhttbt.exec:\nhttbt.exe64⤵
- Executes dropped EXE
PID:1620 -
\??\c:\lxlrlrf.exec:\lxlrlrf.exe65⤵
- Executes dropped EXE
PID:2968 -
\??\c:\lflrrlr.exec:\lflrrlr.exe66⤵PID:2296
-
\??\c:\vjdvd.exec:\vjdvd.exe67⤵PID:912
-
\??\c:\nbthth.exec:\nbthth.exe68⤵PID:1336
-
\??\c:\xlfxrlf.exec:\xlfxrlf.exe69⤵PID:2524
-
\??\c:\flflfxf.exec:\flflfxf.exe70⤵PID:1764
-
\??\c:\pjdpd.exec:\pjdpd.exe71⤵PID:1508
-
\??\c:\hbtbht.exec:\hbtbht.exe72⤵PID:1328
-
\??\c:\fxxrxxf.exec:\fxxrxxf.exe73⤵PID:2528
-
\??\c:\7xfxlxf.exec:\7xfxlxf.exe74⤵PID:2408
-
\??\c:\dpddj.exec:\dpddj.exe75⤵PID:2540
-
\??\c:\1pjdj.exec:\1pjdj.exe76⤵PID:1736
-
\??\c:\ttntnn.exec:\ttntnn.exe77⤵PID:2340
-
\??\c:\nhtbnn.exec:\nhtbnn.exe78⤵
- System Location Discovery: System Language Discovery
PID:2748 -
\??\c:\xlfffll.exec:\xlfffll.exe79⤵PID:2888
-
\??\c:\tnbtht.exec:\tnbtht.exe80⤵PID:2760
-
\??\c:\llxrlfr.exec:\llxrlfr.exe81⤵
- System Location Discovery: System Language Discovery
PID:2880 -
\??\c:\pjjjv.exec:\pjjjv.exe82⤵PID:2960
-
\??\c:\9djjv.exec:\9djjv.exe83⤵PID:1236
-
\??\c:\hbtttb.exec:\hbtttb.exe84⤵PID:2756
-
\??\c:\5frxlxf.exec:\5frxlxf.exe85⤵PID:1796
-
\??\c:\rrfrfrx.exec:\rrfrfrx.exe86⤵PID:2320
-
\??\c:\jvvjj.exec:\jvvjj.exe87⤵PID:1292
-
\??\c:\nnthbh.exec:\nnthbh.exe88⤵PID:2104
-
\??\c:\xlflrff.exec:\xlflrff.exe89⤵PID:1900
-
\??\c:\5fflxlr.exec:\5fflxlr.exe90⤵
- System Location Discovery: System Language Discovery
PID:1920 -
\??\c:\pjddp.exec:\pjddp.exe91⤵PID:2352
-
\??\c:\nhnntb.exec:\nhnntb.exe92⤵PID:2980
-
\??\c:\tnhhhh.exec:\tnhhhh.exe93⤵PID:704
-
\??\c:\bhbbbh.exec:\bhbbbh.exe94⤵
- System Location Discovery: System Language Discovery
PID:2900 -
\??\c:\rfxffll.exec:\rfxffll.exe95⤵PID:572
-
\??\c:\dvvdp.exec:\dvvdp.exe96⤵PID:1440
-
\??\c:\tthbhn.exec:\tthbhn.exe97⤵PID:1624
-
\??\c:\3lffrxx.exec:\3lffrxx.exe98⤵PID:2056
-
\??\c:\rlrxfrf.exec:\rlrxfrf.exe99⤵PID:2676
-
\??\c:\pdvdv.exec:\pdvdv.exe100⤵PID:2700
-
\??\c:\htnntn.exec:\htnntn.exe101⤵PID:2984
-
\??\c:\fxflxfr.exec:\fxflxfr.exe102⤵PID:2336
-
\??\c:\9vvvd.exec:\9vvvd.exe103⤵PID:2988
-
\??\c:\pvvvj.exec:\pvvvj.exe104⤵PID:1948
-
\??\c:\tnhtht.exec:\tnhtht.exe105⤵PID:2040
-
\??\c:\5nhnbt.exec:\5nhnbt.exe106⤵PID:996
-
\??\c:\xxfrfll.exec:\xxfrfll.exe107⤵PID:2212
-
\??\c:\lflflrl.exec:\lflflrl.exe108⤵PID:1188
-
\??\c:\vjvdj.exec:\vjvdj.exe109⤵PID:1332
-
\??\c:\hbnnnb.exec:\hbnnnb.exe110⤵PID:1128
-
\??\c:\5htttb.exec:\5htttb.exe111⤵
- System Location Discovery: System Language Discovery
PID:3036 -
\??\c:\lffxxfl.exec:\lffxxfl.exe112⤵PID:2468
-
\??\c:\pjpdv.exec:\pjpdv.exe113⤵PID:896
-
\??\c:\hbttbn.exec:\hbttbn.exe114⤵PID:1508
-
\??\c:\tbtthb.exec:\tbtthb.exe115⤵PID:2028
-
\??\c:\xrxfxxr.exec:\xrxfxxr.exe116⤵
- System Location Discovery: System Language Discovery
PID:1716 -
\??\c:\7jdpv.exec:\7jdpv.exe117⤵PID:1880
-
\??\c:\9vdpp.exec:\9vdpp.exe118⤵
- System Location Discovery: System Language Discovery
PID:1504 -
\??\c:\1vjdj.exec:\1vjdj.exe119⤵PID:2160
-
\??\c:\tntnbh.exec:\tntnbh.exe120⤵PID:1956
-
\??\c:\rlxxxxf.exec:\rlxxxxf.exe121⤵PID:2112
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-