Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
01-12-2024 00:03
Behavioral task
behavioral1
Sample
73be99099641aa91746b4938124988dbccd195342f287be188406b57a98d2ba0.exe
Resource
win7-20240903-en
General
-
Target
73be99099641aa91746b4938124988dbccd195342f287be188406b57a98d2ba0.exe
-
Size
3.7MB
-
MD5
ba1c24b2d74a8a09351d3f6a64a7af23
-
SHA1
3c0d35568a4525242cdba87ef34efce57b3eb424
-
SHA256
73be99099641aa91746b4938124988dbccd195342f287be188406b57a98d2ba0
-
SHA512
cd690a7ec3464522421fbd87c11ebb5403f61745176fdeebc140a3f73928b9199c3a27a1791b76c6f22baa002142b017ba1cf9b66df7e1db790771764c317c1d
-
SSDEEP
49152:gCOfN6X5tLLQTg20ITS/PPs/1kS4eKRL/SRsj0Zuur1T75YqVUrmNF98l:U6XLq/qPPslzKx/dJg1ErmNI
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 56 IoCs
Processes:
resource yara_rule behavioral1/memory/2812-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2848-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2976-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2724-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2092-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2872-51-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2872-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2636-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3060-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2904-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2904-85-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/576-121-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2904-123-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/2132-132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1920-150-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/492-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/492-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/948-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/612-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1268-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/760-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1624-238-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2476-252-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/760-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/760-248-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/764-261-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2156-271-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/764-269-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1676-288-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1676-295-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1468-300-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2492-298-0x0000000076ED0000-0x0000000076FEF000-memory.dmp family_blackmoon behavioral1/memory/1468-308-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2972-321-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1636-378-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1636-385-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2624-392-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2784-393-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2900-406-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1536-407-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1536-413-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2216-438-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/884-555-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2596-599-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2716-617-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1952-656-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2544-701-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1632-777-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1640-803-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2196-880-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2872-889-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1520-902-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1884-992-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/320-1041-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2352-1076-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2248-1103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Njrat family
-
Executes dropped EXE 64 IoCs
Processes:
rfxfrrf.exe1bnnbh.exe9ntnht.exetbhhnt.exevpdjj.exexlrxffr.exettnntt.exetbhtnb.exebbhhnt.exerrfrlrf.exelrxxflr.exethnthh.exehhtnbn.exebbtthn.exennbhnn.exeddpjj.exejdppp.exedjvjv.exejpjvd.exetbntbh.exehhhttb.exejdddj.exe7flrrxx.exe1xflrxr.exedvjjp.exebtntth.exefrlxxxx.exefrlflrf.exe7tbtbb.exexxxrrfx.exexflllrf.exettnnbh.exettbntb.exelrlxlfx.exefrrxflr.exejvpvv.exe5vvvd.exe3vvpp.exevpjpv.exehnbhtt.exehthhnh.exehbnbhb.exennhhbn.exerrrrxff.exerrrxlrx.exe3vddp.exenbtbht.exelxxxlrr.exeffrfxlx.exe1pddj.exeppdjp.exenhhbtn.exe1tbbbh.exe5rfflrr.exedvdvd.exejvjjp.exenbbbtb.exefrrrflf.exeflrrxxr.exejdpvj.exe1bntbh.exe1nbhbh.exefxxxllr.exevjdpp.exepid Process 2848 rfxfrrf.exe 2976 1bnnbh.exe 2724 9ntnht.exe 2092 tbhhnt.exe 2872 vpdjj.exe 2636 xlrxffr.exe 3060 ttnntt.exe 2904 tbhtnb.exe 2028 bbhhnt.exe 1744 rrfrlrf.exe 2784 lrxxflr.exe 576 thnthh.exe 2132 hhtnbn.exe 340 bbtthn.exe 1920 nnbhnn.exe 3000 ddpjj.exe 492 jdppp.exe 1176 djvjv.exe 2212 jpjvd.exe 1348 tbntbh.exe 948 hhhttb.exe 612 jdddj.exe 836 7flrrxx.exe 1268 1xflrxr.exe 1624 dvjjp.exe 760 btntth.exe 2476 frlxxxx.exe 764 frlflrf.exe 2156 7tbtbb.exe 324 xxxrrfx.exe 1676 xflllrf.exe 2492 ttnnbh.exe 2688 ttbntb.exe 2972 lrlxlfx.exe 2944 frrxflr.exe 2728 jvpvv.exe 2092 5vvvd.exe 2716 3vvpp.exe 1944 vpjpv.exe 2396 hnbhtt.exe 1608 hthhnh.exe 2904 hbnbhb.exe 2384 nnhhbn.exe 1636 rrrrxff.exe 2624 rrrxlrx.exe 2784 3vddp.exe 2900 nbtbht.exe 1536 lxxxlrr.exe 348 ffrfxlx.exe 912 1pddj.exe 1920 ppdjp.exe 2408 nhhbtn.exe 2216 1tbbbh.exe 2432 5rfflrr.exe 1792 dvdvd.exe 2012 jvjjp.exe 1976 nbbbtb.exe 328 frrrflf.exe 860 flrrxxr.exe 1704 jdpvj.exe 1552 1bntbh.exe 3036 1nbhbh.exe 632 fxxxllr.exe 2516 vjdpp.exe -
Processes:
resource yara_rule behavioral1/memory/2812-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000012102-8.dat upx behavioral1/memory/2812-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2848-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000190c6-15.dat upx behavioral1/memory/2976-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000190c9-27.dat upx behavioral1/memory/2976-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2724-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000191f3-34.dat upx behavioral1/memory/2092-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2092-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000019217-46.dat upx behavioral1/memory/2092-45-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0006000000019220-56.dat upx behavioral1/memory/2872-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0039000000018662-64.dat upx behavioral1/memory/2636-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000019238-76.dat upx behavioral1/memory/3060-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000800000001925d-84.dat upx behavioral1/memory/2904-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2028-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000194bd-96.dat upx behavioral1/memory/1744-95-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019fb9-104.dat upx behavioral1/memory/2784-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a067-113.dat upx behavioral1/memory/576-121-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a07b-122.dat upx behavioral1/files/0x000500000001a0a1-133.dat upx behavioral1/memory/2132-132-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1920-142-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a301-141.dat upx behavioral1/memory/1920-150-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a345-153.dat upx behavioral1/memory/3000-152-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a42b-160.dat upx behavioral1/memory/492-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a42d-170.dat upx behavioral1/memory/492-168-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a42f-177.dat upx behavioral1/memory/2212-178-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a431-187.dat upx behavioral1/memory/948-195-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a434-196.dat upx behavioral1/files/0x000500000001a46a-205.dat upx behavioral1/memory/948-203-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/612-214-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a48c-212.dat upx behavioral1/files/0x000500000001a48e-221.dat upx behavioral1/files/0x000500000001a49a-230.dat upx behavioral1/memory/1268-229-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/760-241-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a49c-240.dat upx behavioral1/memory/1624-238-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2476-252-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4aa-251.dat upx behavioral1/memory/760-250-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4b5-259.dat upx behavioral1/memory/764-261-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2156-271-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4b7-270.dat upx behavioral1/memory/764-269-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
dvpvj.exelrlfrlr.exedvdvd.exepjjpp.exevvppd.exerlfrrfl.exethnhnt.exejvddj.exe7vjjp.exefxlrfrf.exejpvdj.exennbtnb.exe7bhhhb.exejdjvj.exe5xlrxfl.exeddjvp.exerlfrflr.exehtthhh.exejjvvv.exedvppd.exe1vjjv.exetbhhth.exevpdpj.exerrfrlll.exetbtnbt.exenbhhtt.exennttbn.exe1vjpd.exedddvp.exexrfxrlr.exerlxflrl.exexxrxlfr.exedpvdd.exerrlfflf.exehbbnnn.exe7jpvd.exettnnbh.exevjjjd.exetthnbh.exenhhnnn.exepjpvp.exe5rffffl.exenhbbnt.exenbnbhn.exelrrlxfl.exedppdv.exelfllrxf.exelffrxrx.exe1lrxlxx.exerxllxlr.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlfrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfrrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbtnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bhhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xlrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfrflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htthhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbtnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnttbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfxrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxflrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrxlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlfflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rffffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrlxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfllrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffrxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lrxlxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxllxlr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
73be99099641aa91746b4938124988dbccd195342f287be188406b57a98d2ba0.exerfxfrrf.exe1bnnbh.exe9ntnht.exetbhhnt.exevpdjj.exexlrxffr.exettnntt.exetbhtnb.exebbhhnt.exerrfrlrf.exelrxxflr.exethnthh.exehhtnbn.exebbtthn.exennbhnn.exedescription pid Process procid_target PID 2812 wrote to memory of 2848 2812 73be99099641aa91746b4938124988dbccd195342f287be188406b57a98d2ba0.exe 30 PID 2812 wrote to memory of 2848 2812 73be99099641aa91746b4938124988dbccd195342f287be188406b57a98d2ba0.exe 30 PID 2812 wrote to memory of 2848 2812 73be99099641aa91746b4938124988dbccd195342f287be188406b57a98d2ba0.exe 30 PID 2812 wrote to memory of 2848 2812 73be99099641aa91746b4938124988dbccd195342f287be188406b57a98d2ba0.exe 30 PID 2848 wrote to memory of 2976 2848 rfxfrrf.exe 31 PID 2848 wrote to memory of 2976 2848 rfxfrrf.exe 31 PID 2848 wrote to memory of 2976 2848 rfxfrrf.exe 31 PID 2848 wrote to memory of 2976 2848 rfxfrrf.exe 31 PID 2976 wrote to memory of 2724 2976 1bnnbh.exe 32 PID 2976 wrote to memory of 2724 2976 1bnnbh.exe 32 PID 2976 wrote to memory of 2724 2976 1bnnbh.exe 32 PID 2976 wrote to memory of 2724 2976 1bnnbh.exe 32 PID 2724 wrote to memory of 2092 2724 9ntnht.exe 33 PID 2724 wrote to memory of 2092 2724 9ntnht.exe 33 PID 2724 wrote to memory of 2092 2724 9ntnht.exe 33 PID 2724 wrote to memory of 2092 2724 9ntnht.exe 33 PID 2092 wrote to memory of 2872 2092 tbhhnt.exe 34 PID 2092 wrote to memory of 2872 2092 tbhhnt.exe 34 PID 2092 wrote to memory of 2872 2092 tbhhnt.exe 34 PID 2092 wrote to memory of 2872 2092 tbhhnt.exe 34 PID 2872 wrote to memory of 2636 2872 vpdjj.exe 35 PID 2872 wrote to memory of 2636 2872 vpdjj.exe 35 PID 2872 wrote to memory of 2636 2872 vpdjj.exe 35 PID 2872 wrote to memory of 2636 2872 vpdjj.exe 35 PID 2636 wrote to memory of 3060 2636 xlrxffr.exe 36 PID 2636 wrote to memory of 3060 2636 xlrxffr.exe 36 PID 2636 wrote to memory of 3060 2636 xlrxffr.exe 36 PID 2636 wrote to memory of 3060 2636 xlrxffr.exe 36 PID 3060 wrote to memory of 2904 3060 ttnntt.exe 72 PID 3060 wrote to memory of 2904 3060 ttnntt.exe 72 PID 3060 wrote to memory of 2904 3060 ttnntt.exe 72 PID 3060 wrote to memory of 2904 3060 ttnntt.exe 72 PID 2904 wrote to memory of 2028 2904 tbhtnb.exe 38 PID 2904 wrote to memory of 2028 2904 tbhtnb.exe 38 PID 2904 wrote to memory of 2028 2904 tbhtnb.exe 38 PID 2904 wrote to memory of 2028 2904 tbhtnb.exe 38 PID 2028 wrote to memory of 1744 2028 bbhhnt.exe 39 PID 2028 wrote to memory of 1744 2028 bbhhnt.exe 39 PID 2028 wrote to memory of 1744 2028 bbhhnt.exe 39 PID 2028 wrote to memory of 1744 2028 bbhhnt.exe 39 PID 1744 wrote to memory of 2784 1744 rrfrlrf.exe 76 PID 1744 wrote to memory of 2784 1744 rrfrlrf.exe 76 PID 1744 wrote to memory of 2784 1744 rrfrlrf.exe 76 PID 1744 wrote to memory of 2784 1744 rrfrlrf.exe 76 PID 2784 wrote to memory of 576 2784 lrxxflr.exe 41 PID 2784 wrote to memory of 576 2784 lrxxflr.exe 41 PID 2784 wrote to memory of 576 2784 lrxxflr.exe 41 PID 2784 wrote to memory of 576 2784 lrxxflr.exe 41 PID 576 wrote to memory of 2132 576 thnthh.exe 42 PID 576 wrote to memory of 2132 576 thnthh.exe 42 PID 576 wrote to memory of 2132 576 thnthh.exe 42 PID 576 wrote to memory of 2132 576 thnthh.exe 42 PID 2132 wrote to memory of 340 2132 hhtnbn.exe 43 PID 2132 wrote to memory of 340 2132 hhtnbn.exe 43 PID 2132 wrote to memory of 340 2132 hhtnbn.exe 43 PID 2132 wrote to memory of 340 2132 hhtnbn.exe 43 PID 340 wrote to memory of 1920 340 bbtthn.exe 44 PID 340 wrote to memory of 1920 340 bbtthn.exe 44 PID 340 wrote to memory of 1920 340 bbtthn.exe 44 PID 340 wrote to memory of 1920 340 bbtthn.exe 44 PID 1920 wrote to memory of 3000 1920 nnbhnn.exe 45 PID 1920 wrote to memory of 3000 1920 nnbhnn.exe 45 PID 1920 wrote to memory of 3000 1920 nnbhnn.exe 45 PID 1920 wrote to memory of 3000 1920 nnbhnn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\73be99099641aa91746b4938124988dbccd195342f287be188406b57a98d2ba0.exe"C:\Users\Admin\AppData\Local\Temp\73be99099641aa91746b4938124988dbccd195342f287be188406b57a98d2ba0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\rfxfrrf.exec:\rfxfrrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\1bnnbh.exec:\1bnnbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\9ntnht.exec:\9ntnht.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\tbhhnt.exec:\tbhhnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\vpdjj.exec:\vpdjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\xlrxffr.exec:\xlrxffr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\ttnntt.exec:\ttnntt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\tbhtnb.exec:\tbhtnb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\bbhhnt.exec:\bbhhnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\rrfrlrf.exec:\rrfrlrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
\??\c:\lrxxflr.exec:\lrxxflr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\thnthh.exec:\thnthh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:576 -
\??\c:\hhtnbn.exec:\hhtnbn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\bbtthn.exec:\bbtthn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:340 -
\??\c:\nnbhnn.exec:\nnbhnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\ddpjj.exec:\ddpjj.exe17⤵
- Executes dropped EXE
PID:3000 -
\??\c:\jdppp.exec:\jdppp.exe18⤵
- Executes dropped EXE
PID:492 -
\??\c:\djvjv.exec:\djvjv.exe19⤵
- Executes dropped EXE
PID:1176 -
\??\c:\jpjvd.exec:\jpjvd.exe20⤵
- Executes dropped EXE
PID:2212 -
\??\c:\tbntbh.exec:\tbntbh.exe21⤵
- Executes dropped EXE
PID:1348 -
\??\c:\hhhttb.exec:\hhhttb.exe22⤵
- Executes dropped EXE
PID:948 -
\??\c:\jdddj.exec:\jdddj.exe23⤵
- Executes dropped EXE
PID:612 -
\??\c:\7flrrxx.exec:\7flrrxx.exe24⤵
- Executes dropped EXE
PID:836 -
\??\c:\1xflrxr.exec:\1xflrxr.exe25⤵
- Executes dropped EXE
PID:1268 -
\??\c:\dvjjp.exec:\dvjjp.exe26⤵
- Executes dropped EXE
PID:1624 -
\??\c:\btntth.exec:\btntth.exe27⤵
- Executes dropped EXE
PID:760 -
\??\c:\frlxxxx.exec:\frlxxxx.exe28⤵
- Executes dropped EXE
PID:2476 -
\??\c:\frlflrf.exec:\frlflrf.exe29⤵
- Executes dropped EXE
PID:764 -
\??\c:\7tbtbb.exec:\7tbtbb.exe30⤵
- Executes dropped EXE
PID:2156 -
\??\c:\xxxrrfx.exec:\xxxrrfx.exe31⤵
- Executes dropped EXE
PID:324 -
\??\c:\xflllrf.exec:\xflllrf.exe32⤵
- Executes dropped EXE
PID:1676 -
\??\c:\ttnnbh.exec:\ttnnbh.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2492 -
\??\c:\nnbbhn.exec:\nnbbhn.exe34⤵PID:1468
-
\??\c:\ttbntb.exec:\ttbntb.exe35⤵
- Executes dropped EXE
PID:2688 -
\??\c:\lrlxlfx.exec:\lrlxlfx.exe36⤵
- Executes dropped EXE
PID:2972 -
\??\c:\frrxflr.exec:\frrxflr.exe37⤵
- Executes dropped EXE
PID:2944 -
\??\c:\jvpvv.exec:\jvpvv.exe38⤵
- Executes dropped EXE
PID:2728 -
\??\c:\5vvvd.exec:\5vvvd.exe39⤵
- Executes dropped EXE
PID:2092 -
\??\c:\3vvpp.exec:\3vvpp.exe40⤵
- Executes dropped EXE
PID:2716 -
\??\c:\vpjpv.exec:\vpjpv.exe41⤵
- Executes dropped EXE
PID:1944 -
\??\c:\hnbhtt.exec:\hnbhtt.exe42⤵
- Executes dropped EXE
PID:2396 -
\??\c:\hthhnh.exec:\hthhnh.exe43⤵
- Executes dropped EXE
PID:1608 -
\??\c:\hbnbhb.exec:\hbnbhb.exe44⤵
- Executes dropped EXE
PID:2904 -
\??\c:\nnhhbn.exec:\nnhhbn.exe45⤵
- Executes dropped EXE
PID:2384 -
\??\c:\rrrrxff.exec:\rrrrxff.exe46⤵
- Executes dropped EXE
PID:1636 -
\??\c:\rrrxlrx.exec:\rrrxlrx.exe47⤵
- Executes dropped EXE
PID:2624 -
\??\c:\3vddp.exec:\3vddp.exe48⤵
- Executes dropped EXE
PID:2784 -
\??\c:\nbtbht.exec:\nbtbht.exe49⤵
- Executes dropped EXE
PID:2900 -
\??\c:\lxxxlrr.exec:\lxxxlrr.exe50⤵
- Executes dropped EXE
PID:1536 -
\??\c:\ffrfxlx.exec:\ffrfxlx.exe51⤵
- Executes dropped EXE
PID:348 -
\??\c:\1pddj.exec:\1pddj.exe52⤵
- Executes dropped EXE
PID:912 -
\??\c:\ppdjp.exec:\ppdjp.exe53⤵
- Executes dropped EXE
PID:1920 -
\??\c:\nhhbtn.exec:\nhhbtn.exe54⤵
- Executes dropped EXE
PID:2408 -
\??\c:\1tbbbh.exec:\1tbbbh.exe55⤵
- Executes dropped EXE
PID:2216 -
\??\c:\5rfflrr.exec:\5rfflrr.exe56⤵
- Executes dropped EXE
PID:2432 -
\??\c:\dvdvd.exec:\dvdvd.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1792 -
\??\c:\jvjjp.exec:\jvjjp.exe58⤵
- Executes dropped EXE
PID:2012 -
\??\c:\nbbbtb.exec:\nbbbtb.exe59⤵
- Executes dropped EXE
PID:1976 -
\??\c:\frrrflf.exec:\frrrflf.exe60⤵
- Executes dropped EXE
PID:328 -
\??\c:\flrrxxr.exec:\flrrxxr.exe61⤵
- Executes dropped EXE
PID:860 -
\??\c:\jdpvj.exec:\jdpvj.exe62⤵
- Executes dropped EXE
PID:1704 -
\??\c:\1bntbh.exec:\1bntbh.exe63⤵
- Executes dropped EXE
PID:1552 -
\??\c:\1nbhbh.exec:\1nbhbh.exe64⤵
- Executes dropped EXE
PID:3036 -
\??\c:\fxxxllr.exec:\fxxxllr.exe65⤵
- Executes dropped EXE
PID:632 -
\??\c:\vjdpp.exec:\vjdpp.exe66⤵
- Executes dropped EXE
PID:2516 -
\??\c:\vdpjp.exec:\vdpjp.exe67⤵PID:624
-
\??\c:\jdjjv.exec:\jdjjv.exe68⤵PID:2476
-
\??\c:\bhttnb.exec:\bhttnb.exe69⤵PID:1852
-
\??\c:\3hbhnt.exec:\3hbhnt.exe70⤵PID:1180
-
\??\c:\1fffrff.exec:\1fffrff.exe71⤵PID:892
-
\??\c:\3pppp.exec:\3pppp.exe72⤵PID:884
-
\??\c:\jjdvd.exec:\jjdvd.exe73⤵PID:1680
-
\??\c:\nnhhth.exec:\nnhhth.exe74⤵PID:2820
-
\??\c:\fxxlxll.exec:\fxxlxll.exe75⤵PID:1468
-
\??\c:\9rfrfrr.exec:\9rfrfrr.exe76⤵PID:2808
-
\??\c:\vvpdj.exec:\vvpdj.exe77⤵PID:2908
-
\??\c:\5tbbnn.exec:\5tbbnn.exe78⤵PID:2916
-
\??\c:\nhbhtt.exec:\nhbhtt.exe79⤵PID:2812
-
\??\c:\9rxflrf.exec:\9rxflrf.exe80⤵PID:2596
-
\??\c:\jjvpv.exec:\jjvpv.exe81⤵PID:3048
-
\??\c:\tnbbhn.exec:\tnbbhn.exe82⤵PID:2716
-
\??\c:\bhhhhh.exec:\bhhhhh.exe83⤵PID:1972
-
\??\c:\lfrrlrl.exec:\lfrrlrl.exe84⤵PID:2952
-
\??\c:\dvddj.exec:\dvddj.exe85⤵PID:2328
-
\??\c:\ppdpp.exec:\ppdpp.exe86⤵PID:2428
-
\??\c:\hhtbhh.exec:\hhtbhh.exe87⤵PID:2028
-
\??\c:\5rffffl.exec:\5rffffl.exe88⤵
- System Location Discovery: System Language Discovery
PID:1952 -
\??\c:\rrrfxrf.exec:\rrrfxrf.exe89⤵PID:1744
-
\??\c:\jdjdj.exec:\jdjdj.exe90⤵PID:2792
-
\??\c:\9pdvj.exec:\9pdvj.exe91⤵PID:2364
-
\??\c:\ttbthn.exec:\ttbthn.exe92⤵PID:2760
-
\??\c:\7fffrff.exec:\7fffrff.exe93⤵PID:2928
-
\??\c:\ppjjp.exec:\ppjjp.exe94⤵PID:1536
-
\??\c:\pjvdp.exec:\pjvdp.exe95⤵PID:340
-
\??\c:\hbtbnh.exec:\hbtbnh.exe96⤵PID:2544
-
\??\c:\9thbbh.exec:\9thbbh.exe97⤵PID:2244
-
\??\c:\9xrrxxl.exec:\9xrrxxl.exe98⤵PID:2240
-
\??\c:\fxxxfff.exec:\fxxxfff.exe99⤵PID:1860
-
\??\c:\ppjjv.exec:\ppjjv.exe100⤵PID:2432
-
\??\c:\nnbhhh.exec:\nnbhhh.exe101⤵PID:2552
-
\??\c:\hnhhtt.exec:\hnhhtt.exe102⤵PID:2084
-
\??\c:\9xfxflf.exec:\9xfxflf.exe103⤵PID:1504
-
\??\c:\5ppvd.exec:\5ppvd.exe104⤵PID:328
-
\??\c:\dvpdp.exec:\dvpdp.exe105⤵PID:860
-
\??\c:\hbnthh.exec:\hbnthh.exe106⤵PID:1120
-
\??\c:\tnnntb.exec:\tnnntb.exe107⤵PID:1440
-
\??\c:\xrfrffr.exec:\xrfrffr.exe108⤵PID:1632
-
\??\c:\jdddj.exec:\jdddj.exe109⤵PID:1620
-
\??\c:\1btbnt.exec:\1btbnt.exe110⤵PID:1148
-
\??\c:\nhtnbh.exec:\nhtnbh.exe111⤵PID:2148
-
\??\c:\7fflflr.exec:\7fflflr.exe112⤵PID:1640
-
\??\c:\jjpvp.exec:\jjpvp.exe113⤵PID:564
-
\??\c:\bnthbt.exec:\bnthbt.exe114⤵PID:1588
-
\??\c:\rlxflrx.exec:\rlxflrx.exe115⤵PID:892
-
\??\c:\fxlrffl.exec:\fxlrffl.exe116⤵PID:2296
-
\??\c:\vpjpd.exec:\vpjpd.exe117⤵PID:1676
-
\??\c:\5hthnn.exec:\5hthnn.exe118⤵PID:2836
-
\??\c:\hbtbhb.exec:\hbtbhb.exe119⤵PID:2976
-
\??\c:\9lxxxxl.exec:\9lxxxxl.exe120⤵PID:2876
-
\??\c:\djpdj.exec:\djpdj.exe121⤵PID:2592
-
\??\c:\jdjpv.exec:\jdjpv.exe122⤵PID:2892
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-