Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04-12-2024 01:38
Behavioral task
behavioral1
Sample
af8dc32ec71b8761c8652e6fb1a9b50933cedd296dc73434b991e7a98c20f9e7.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
120 seconds
General
-
Target
af8dc32ec71b8761c8652e6fb1a9b50933cedd296dc73434b991e7a98c20f9e7.exe
-
Size
3.7MB
-
MD5
e75d344ff5f22d55af9afad5f6c12868
-
SHA1
87168079e491c71a6fd1bc216685abd3324a9b68
-
SHA256
af8dc32ec71b8761c8652e6fb1a9b50933cedd296dc73434b991e7a98c20f9e7
-
SHA512
a10474160df0f4510dfd3155a7cf862bb200b67cb2f87194119d8b4c569ebec6ba39540d617f455567439c12522a7cc33a140a60bbdf3c3db8a925a1a19da517
-
SSDEEP
49152:gCOfN6X5tLLQTg20ITS/PPs/1kS4eKRL/SRsj0Zuur1T75YqVUrmNF988:U6XLq/qPPslzKx/dJg1ErmNB
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/2760-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2216-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2856-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2836-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2352-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2592-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2564-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2228-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1856-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2380-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1864-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1732-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1976-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2008-146-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2028-155-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1500-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2052-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1348-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/496-264-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/720-285-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/888-298-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1376-318-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2860-332-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2604-347-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1804-354-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2584-360-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2108-362-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/448-440-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/320-460-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2388-461-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2388-468-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2148-479-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2960-515-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1940-528-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3008-566-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2988-573-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1920-654-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/864-658-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2008-696-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1760-769-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1516-817-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2448-1002-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2448-1022-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2392-1069-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2792-1088-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Njrat family
-
Executes dropped EXE 64 IoCs
pid Process 2216 1llxfxr.exe 2856 bhthht.exe 2836 djpvp.exe 2352 3ffrlrf.exe 2592 xfllxrl.exe 2564 7dvjd.exe 2228 vjdjv.exe 1628 fffrlxl.exe 1856 3vdpd.exe 2380 vdvdj.exe 2008 bhbnnh.exe 1864 htnbtn.exe 1732 xxflxxl.exe 1976 rxrlfxl.exe 2204 lxxrfxl.exe 2028 5lxlrrr.exe 1500 vjpjj.exe 1764 1llfxfr.exe 2180 xxxrlxl.exe 2052 bbntbn.exe 2140 fllfxfr.exe 2792 ppddv.exe 1876 vvjvp.exe 752 jdvdj.exe 300 9ppdv.exe 1348 ddjdd.exe 1708 jpjpj.exe 2084 ffxlrfx.exe 496 vpjdj.exe 2552 dddjv.exe 1736 btnttb.exe 720 xrrxfrx.exe 888 1vvdv.exe 1816 ttnthh.exe 2512 ttnbnt.exe 1376 5fxfxfr.exe 2848 vvppd.exe 2860 5vppv.exe 2820 nnthbh.exe 2604 ttnntt.exe 1804 nnbtnb.exe 2584 7nhhht.exe 2108 rrxxxfr.exe 2100 djvjd.exe 1432 9jdpj.exe 3028 hnbntb.exe 2284 lfflfxl.exe 2408 llrxfrr.exe 2056 vvpdp.exe 1004 ttbbhn.exe 1148 hhbbth.exe 2640 llrflfr.exe 1228 jpjvp.exe 448 jjdpv.exe 2360 nthnhh.exe 2028 flrxrxr.exe 320 rrrxlxf.exe 2388 9dvdv.exe 2132 3pddp.exe 2148 9tthth.exe 1388 1lflrxl.exe 948 xxxfxfr.exe 2792 dvjjp.exe 1852 nhntht.exe -
resource yara_rule behavioral1/memory/2760-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2216-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000010300-8.dat upx behavioral1/memory/2760-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000c00000001659b-19.dat upx behavioral1/memory/2856-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2216-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016645-27.dat upx behavioral1/memory/2856-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2836-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0035000000016334-35.dat upx behavioral1/memory/2352-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000800000001686c-46.dat upx behavioral1/memory/2592-54-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016c73-55.dat upx behavioral1/memory/2564-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016c95-65.dat upx behavioral1/files/0x0007000000016ce1-73.dat upx behavioral1/memory/1628-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2228-72-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016d0d-82.dat upx behavioral1/files/0x0008000000016d47-92.dat upx behavioral1/memory/1856-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000174a6-101.dat upx behavioral1/memory/2380-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000174c3-109.dat upx behavioral1/files/0x000600000001757f-119.dat upx behavioral1/memory/1864-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0015000000018676-128.dat upx behavioral1/memory/1732-127-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018696-137.dat upx behavioral1/memory/1976-136-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018697-145.dat upx behavioral1/memory/2008-146-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2028-147-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000187a2-156.dat upx behavioral1/memory/2028-155-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1500-164-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018c34-165.dat upx behavioral1/files/0x0006000000018c44-173.dat upx behavioral1/files/0x0006000000018f65-181.dat upx behavioral1/memory/2052-183-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001904c-190.dat upx behavioral1/files/0x00060000000190e1-199.dat upx behavioral1/files/0x00050000000191d2-206.dat upx behavioral1/files/0x00050000000191f6-215.dat upx behavioral1/files/0x0005000000019217-222.dat upx behavioral1/files/0x0005000000019240-230.dat upx behavioral1/memory/1348-231-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019259-240.dat upx behavioral1/memory/1348-239-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019268-250.dat upx behavioral1/files/0x000500000001926c-257.dat upx behavioral1/memory/496-264-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019275-265.dat upx behavioral1/memory/2552-266-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019278-274.dat upx behavioral1/memory/720-285-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001929a-284.dat upx behavioral1/memory/888-298-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1816-299-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1376-318-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2860-325-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2860-332-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7thntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffrlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrfrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrxlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbntbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5btbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rxlxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxlfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxrlxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxflxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ddjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxffxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xxfxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxlfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrfrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrrlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrflxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbtbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language af8dc32ec71b8761c8652e6fb1a9b50933cedd296dc73434b991e7a98c20f9e7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxfrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xlxllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllxrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rfrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhthnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnthbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nhbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5llxrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfxxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tthth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpjp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2760 wrote to memory of 2216 2760 af8dc32ec71b8761c8652e6fb1a9b50933cedd296dc73434b991e7a98c20f9e7.exe 30 PID 2760 wrote to memory of 2216 2760 af8dc32ec71b8761c8652e6fb1a9b50933cedd296dc73434b991e7a98c20f9e7.exe 30 PID 2760 wrote to memory of 2216 2760 af8dc32ec71b8761c8652e6fb1a9b50933cedd296dc73434b991e7a98c20f9e7.exe 30 PID 2760 wrote to memory of 2216 2760 af8dc32ec71b8761c8652e6fb1a9b50933cedd296dc73434b991e7a98c20f9e7.exe 30 PID 2216 wrote to memory of 2856 2216 1llxfxr.exe 31 PID 2216 wrote to memory of 2856 2216 1llxfxr.exe 31 PID 2216 wrote to memory of 2856 2216 1llxfxr.exe 31 PID 2216 wrote to memory of 2856 2216 1llxfxr.exe 31 PID 2856 wrote to memory of 2836 2856 bhthht.exe 32 PID 2856 wrote to memory of 2836 2856 bhthht.exe 32 PID 2856 wrote to memory of 2836 2856 bhthht.exe 32 PID 2856 wrote to memory of 2836 2856 bhthht.exe 32 PID 2836 wrote to memory of 2352 2836 djpvp.exe 33 PID 2836 wrote to memory of 2352 2836 djpvp.exe 33 PID 2836 wrote to memory of 2352 2836 djpvp.exe 33 PID 2836 wrote to memory of 2352 2836 djpvp.exe 33 PID 2352 wrote to memory of 2592 2352 3ffrlrf.exe 34 PID 2352 wrote to memory of 2592 2352 3ffrlrf.exe 34 PID 2352 wrote to memory of 2592 2352 3ffrlrf.exe 34 PID 2352 wrote to memory of 2592 2352 3ffrlrf.exe 34 PID 2592 wrote to memory of 2564 2592 xfllxrl.exe 35 PID 2592 wrote to memory of 2564 2592 xfllxrl.exe 35 PID 2592 wrote to memory of 2564 2592 xfllxrl.exe 35 PID 2592 wrote to memory of 2564 2592 xfllxrl.exe 35 PID 2564 wrote to memory of 2228 2564 7dvjd.exe 36 PID 2564 wrote to memory of 2228 2564 7dvjd.exe 36 PID 2564 wrote to memory of 2228 2564 7dvjd.exe 36 PID 2564 wrote to memory of 2228 2564 7dvjd.exe 36 PID 2228 wrote to memory of 1628 2228 vjdjv.exe 37 PID 2228 wrote to memory of 1628 2228 vjdjv.exe 37 PID 2228 wrote to memory of 1628 2228 vjdjv.exe 37 PID 2228 wrote to memory of 1628 2228 vjdjv.exe 37 PID 1628 wrote to memory of 1856 1628 fffrlxl.exe 38 PID 1628 wrote to memory of 1856 1628 fffrlxl.exe 38 PID 1628 wrote to memory of 1856 1628 fffrlxl.exe 38 PID 1628 wrote to memory of 1856 1628 fffrlxl.exe 38 PID 1856 wrote to memory of 2380 1856 3vdpd.exe 39 PID 1856 wrote to memory of 2380 1856 3vdpd.exe 39 PID 1856 wrote to memory of 2380 1856 3vdpd.exe 39 PID 1856 wrote to memory of 2380 1856 3vdpd.exe 39 PID 2380 wrote to memory of 2008 2380 vdvdj.exe 40 PID 2380 wrote to memory of 2008 2380 vdvdj.exe 40 PID 2380 wrote to memory of 2008 2380 vdvdj.exe 40 PID 2380 wrote to memory of 2008 2380 vdvdj.exe 40 PID 2008 wrote to memory of 1864 2008 bhbnnh.exe 41 PID 2008 wrote to memory of 1864 2008 bhbnnh.exe 41 PID 2008 wrote to memory of 1864 2008 bhbnnh.exe 41 PID 2008 wrote to memory of 1864 2008 bhbnnh.exe 41 PID 1864 wrote to memory of 1732 1864 htnbtn.exe 42 PID 1864 wrote to memory of 1732 1864 htnbtn.exe 42 PID 1864 wrote to memory of 1732 1864 htnbtn.exe 42 PID 1864 wrote to memory of 1732 1864 htnbtn.exe 42 PID 1732 wrote to memory of 1976 1732 xxflxxl.exe 43 PID 1732 wrote to memory of 1976 1732 xxflxxl.exe 43 PID 1732 wrote to memory of 1976 1732 xxflxxl.exe 43 PID 1732 wrote to memory of 1976 1732 xxflxxl.exe 43 PID 1976 wrote to memory of 2204 1976 rxrlfxl.exe 44 PID 1976 wrote to memory of 2204 1976 rxrlfxl.exe 44 PID 1976 wrote to memory of 2204 1976 rxrlfxl.exe 44 PID 1976 wrote to memory of 2204 1976 rxrlfxl.exe 44 PID 2204 wrote to memory of 2028 2204 lxxrfxl.exe 45 PID 2204 wrote to memory of 2028 2204 lxxrfxl.exe 45 PID 2204 wrote to memory of 2028 2204 lxxrfxl.exe 45 PID 2204 wrote to memory of 2028 2204 lxxrfxl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\af8dc32ec71b8761c8652e6fb1a9b50933cedd296dc73434b991e7a98c20f9e7.exe"C:\Users\Admin\AppData\Local\Temp\af8dc32ec71b8761c8652e6fb1a9b50933cedd296dc73434b991e7a98c20f9e7.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\1llxfxr.exec:\1llxfxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\bhthht.exec:\bhthht.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\djpvp.exec:\djpvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\3ffrlrf.exec:\3ffrlrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\xfllxrl.exec:\xfllxrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\7dvjd.exec:\7dvjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\vjdjv.exec:\vjdjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\fffrlxl.exec:\fffrlxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\3vdpd.exec:\3vdpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
\??\c:\vdvdj.exec:\vdvdj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\bhbnnh.exec:\bhbnnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\htnbtn.exec:\htnbtn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\xxflxxl.exec:\xxflxxl.exe14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\rxrlfxl.exec:\rxrlfxl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\lxxrfxl.exec:\lxxrfxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\5lxlrrr.exec:\5lxlrrr.exe17⤵
- Executes dropped EXE
PID:2028 -
\??\c:\vjpjj.exec:\vjpjj.exe18⤵
- Executes dropped EXE
PID:1500 -
\??\c:\1llfxfr.exec:\1llfxfr.exe19⤵
- Executes dropped EXE
PID:1764 -
\??\c:\xxxrlxl.exec:\xxxrlxl.exe20⤵
- Executes dropped EXE
PID:2180 -
\??\c:\bbntbn.exec:\bbntbn.exe21⤵
- Executes dropped EXE
PID:2052 -
\??\c:\fllfxfr.exec:\fllfxfr.exe22⤵
- Executes dropped EXE
PID:2140 -
\??\c:\ppddv.exec:\ppddv.exe23⤵
- Executes dropped EXE
PID:2792 -
\??\c:\vvjvp.exec:\vvjvp.exe24⤵
- Executes dropped EXE
PID:1876 -
\??\c:\jdvdj.exec:\jdvdj.exe25⤵
- Executes dropped EXE
PID:752 -
\??\c:\9ppdv.exec:\9ppdv.exe26⤵
- Executes dropped EXE
PID:300 -
\??\c:\ddjdd.exec:\ddjdd.exe27⤵
- Executes dropped EXE
PID:1348 -
\??\c:\jpjpj.exec:\jpjpj.exe28⤵
- Executes dropped EXE
PID:1708 -
\??\c:\ffxlrfx.exec:\ffxlrfx.exe29⤵
- Executes dropped EXE
PID:2084 -
\??\c:\vpjdj.exec:\vpjdj.exe30⤵
- Executes dropped EXE
PID:496 -
\??\c:\dddjv.exec:\dddjv.exe31⤵
- Executes dropped EXE
PID:2552 -
\??\c:\btnttb.exec:\btnttb.exe32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1736 -
\??\c:\xrrxfrx.exec:\xrrxfrx.exe33⤵
- Executes dropped EXE
PID:720 -
\??\c:\1vvdv.exec:\1vvdv.exe34⤵
- Executes dropped EXE
PID:888 -
\??\c:\ttnthh.exec:\ttnthh.exe35⤵
- Executes dropped EXE
PID:1816 -
\??\c:\ttnbnt.exec:\ttnbnt.exe36⤵
- Executes dropped EXE
PID:2512 -
\??\c:\5fxfxfr.exec:\5fxfxfr.exe37⤵
- Executes dropped EXE
PID:1376 -
\??\c:\vvppd.exec:\vvppd.exe38⤵
- Executes dropped EXE
PID:2848 -
\??\c:\5vppv.exec:\5vppv.exe39⤵
- Executes dropped EXE
PID:2860 -
\??\c:\nnthbh.exec:\nnthbh.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2820 -
\??\c:\ttnntt.exec:\ttnntt.exe41⤵
- Executes dropped EXE
PID:2604 -
\??\c:\nnbtnb.exec:\nnbtnb.exe42⤵
- Executes dropped EXE
PID:1804 -
\??\c:\7nhhht.exec:\7nhhht.exe43⤵
- Executes dropped EXE
PID:2584 -
\??\c:\rrxxxfr.exec:\rrxxxfr.exe44⤵
- Executes dropped EXE
PID:2108 -
\??\c:\djvjd.exec:\djvjd.exe45⤵
- Executes dropped EXE
PID:2100 -
\??\c:\9jdpj.exec:\9jdpj.exe46⤵
- Executes dropped EXE
PID:1432 -
\??\c:\hnbntb.exec:\hnbntb.exe47⤵
- Executes dropped EXE
PID:3028 -
\??\c:\lfflfxl.exec:\lfflfxl.exe48⤵
- Executes dropped EXE
PID:2284 -
\??\c:\llrxfrr.exec:\llrxfrr.exe49⤵
- Executes dropped EXE
PID:2408 -
\??\c:\vvpdp.exec:\vvpdp.exe50⤵
- Executes dropped EXE
PID:2056 -
\??\c:\ttbbhn.exec:\ttbbhn.exe51⤵
- Executes dropped EXE
PID:1004 -
\??\c:\hhbbth.exec:\hhbbth.exe52⤵
- Executes dropped EXE
PID:1148 -
\??\c:\llrflfr.exec:\llrflfr.exe53⤵
- Executes dropped EXE
PID:2640 -
\??\c:\jpjvp.exec:\jpjvp.exe54⤵
- Executes dropped EXE
PID:1228 -
\??\c:\jjdpv.exec:\jjdpv.exe55⤵
- Executes dropped EXE
PID:448 -
\??\c:\nthnhh.exec:\nthnhh.exe56⤵
- Executes dropped EXE
PID:2360 -
\??\c:\flrxrxr.exec:\flrxrxr.exe57⤵
- Executes dropped EXE
PID:2028 -
\??\c:\rrrxlxf.exec:\rrrxlxf.exe58⤵
- Executes dropped EXE
PID:320 -
\??\c:\9dvdv.exec:\9dvdv.exe59⤵
- Executes dropped EXE
PID:2388 -
\??\c:\3pddp.exec:\3pddp.exe60⤵
- Executes dropped EXE
PID:2132 -
\??\c:\9tthth.exec:\9tthth.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2148 -
\??\c:\1lflrxl.exec:\1lflrxl.exe62⤵
- Executes dropped EXE
PID:1388 -
\??\c:\xxxfxfr.exec:\xxxfxfr.exe63⤵
- Executes dropped EXE
PID:948 -
\??\c:\dvjjp.exec:\dvjjp.exe64⤵
- Executes dropped EXE
PID:2792 -
\??\c:\nhntht.exec:\nhntht.exe65⤵
- Executes dropped EXE
PID:1852 -
\??\c:\bbbhnt.exec:\bbbhnt.exe66⤵PID:2960
-
\??\c:\ffllrfl.exec:\ffllrfl.exe67⤵PID:624
-
\??\c:\5dvvp.exec:\5dvvp.exe68⤵PID:300
-
\??\c:\jvddd.exec:\jvddd.exe69⤵PID:1940
-
\??\c:\tbtbhb.exec:\tbtbhb.exe70⤵PID:1848
-
\??\c:\ffflxlr.exec:\ffflxlr.exe71⤵PID:1672
-
\??\c:\llfrxrl.exec:\llfrxrl.exe72⤵PID:2468
-
\??\c:\ddpjp.exec:\ddpjp.exe73⤵PID:2428
-
\??\c:\7hbbht.exec:\7hbbht.exe74⤵PID:3008
-
\??\c:\bnbhnb.exec:\bnbhnb.exe75⤵PID:1984
-
\??\c:\1frflrx.exec:\1frflrx.exe76⤵PID:2988
-
\??\c:\fxrrfxf.exec:\fxrrfxf.exe77⤵PID:352
-
\??\c:\1jdpd.exec:\1jdpd.exe78⤵PID:888
-
\??\c:\hhbntb.exec:\hhbntb.exe79⤵PID:1572
-
\??\c:\7htbbn.exec:\7htbbn.exe80⤵PID:2712
-
\??\c:\rlflxxr.exec:\rlflxxr.exe81⤵PID:2412
-
\??\c:\ddpdj.exec:\ddpdj.exe82⤵PID:2340
-
\??\c:\7btbbn.exec:\7btbbn.exe83⤵PID:3004
-
\??\c:\nhttbn.exec:\nhttbn.exe84⤵PID:2824
-
\??\c:\lfflrxx.exec:\lfflrxx.exe85⤵PID:2596
-
\??\c:\xfxfxlx.exec:\xfxfxlx.exe86⤵PID:2588
-
\??\c:\jdjjd.exec:\jdjjd.exe87⤵PID:1980
-
\??\c:\vvppv.exec:\vvppv.exe88⤵PID:1920
-
\??\c:\nnthbh.exec:\nnthbh.exe89⤵PID:864
-
\??\c:\fflxfxr.exec:\fflxfxr.exe90⤵PID:1628
-
\??\c:\lfflxff.exec:\lfflxff.exe91⤵PID:3016
-
\??\c:\jjjpd.exec:\jjjpd.exe92⤵PID:1868
-
\??\c:\5btbht.exec:\5btbht.exe93⤵PID:2944
-
\??\c:\nnhtbn.exec:\nnhtbn.exe94⤵PID:2008
-
\??\c:\xxrfrxl.exec:\xxrfrxl.exe95⤵PID:1864
-
\??\c:\pvddv.exec:\pvddv.exe96⤵PID:2452
-
\??\c:\jjpdp.exec:\jjpdp.exe97⤵PID:2016
-
\??\c:\hhbnhn.exec:\hhbnhn.exe98⤵PID:1496
-
\??\c:\lfrfxfx.exec:\lfrfxfx.exe99⤵PID:1128
-
\??\c:\flrlrxr.exec:\flrlrxr.exe100⤵PID:536
-
\??\c:\pjjjv.exec:\pjjjv.exe101⤵PID:2780
-
\??\c:\hhbhnn.exec:\hhbhnn.exe102⤵PID:1500
-
\??\c:\ttthtn.exec:\ttthtn.exe103⤵PID:1812
-
\??\c:\rllrflf.exec:\rllrflf.exe104⤵PID:2208
-
\??\c:\djpjv.exec:\djpjv.exe105⤵PID:1760
-
\??\c:\3jdjd.exec:\3jdjd.exe106⤵PID:2148
-
\??\c:\9nbhbn.exec:\9nbhbn.exe107⤵PID:1392
-
\??\c:\flflfff.exec:\flflfff.exe108⤵PID:948
-
\??\c:\vvpdp.exec:\vvpdp.exe109⤵PID:836
-
\??\c:\1jdjj.exec:\1jdjj.exe110⤵PID:896
-
\??\c:\hbthtb.exec:\hbthtb.exe111⤵PID:688
-
\??\c:\ffrfrxr.exec:\ffrfrxr.exe112⤵PID:1752
-
\??\c:\9rxlxff.exec:\9rxlxff.exe113⤵PID:1516
-
\??\c:\djjvp.exec:\djjvp.exe114⤵
- System Location Discovery: System Language Discovery
PID:1832 -
\??\c:\ddddp.exec:\ddddp.exe115⤵PID:1712
-
\??\c:\tbbhtn.exec:\tbbhtn.exe116⤵PID:1604
-
\??\c:\xfrfrfr.exec:\xfrfrfr.exe117⤵PID:1268
-
\??\c:\lrrlfxr.exec:\lrrlfxr.exe118⤵PID:2296
-
\??\c:\ddvvp.exec:\ddvvp.exe119⤵PID:3008
-
\??\c:\tbbnht.exec:\tbbnht.exe120⤵PID:664
-
\??\c:\btbnbn.exec:\btbnbn.exe121⤵PID:2096
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-