Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17/12/2024, 01:07
Behavioral task
behavioral1
Sample
9abf1dbb1400f9bd05a7bb046ec334862132a19e67d97f707268ae733b26d0c6.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
9abf1dbb1400f9bd05a7bb046ec334862132a19e67d97f707268ae733b26d0c6.exe
-
Size
255KB
-
MD5
8827bb58621129e32be1727b5cfa1e07
-
SHA1
0812c019ad8ec21ec8ae45fc1210e08a1cc7a5dd
-
SHA256
9abf1dbb1400f9bd05a7bb046ec334862132a19e67d97f707268ae733b26d0c6
-
SHA512
6cdbeeb768aa9f6b72e6fe5014a5a2e03218c5f5a7623da1c3d60a173a90d3c07c95c03cde5c6d8dc92843bb07f0cbef148163a3f406a0ed5f0342c8df143602
-
SSDEEP
6144:kcm4FmowdHoSphraHcpOaKHpolTjZXvEQo9dfBP/9:y4wFHoS3eFaKHpKT9XvEhdfBP/9
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/3028-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2800-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2668-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2564-42-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2564-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3040-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2592-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2580-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2580-66-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2972-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2208-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2396-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1292-102-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1292-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1748-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/832-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/832-136-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2356-140-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/808-153-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/1792-173-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2088-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1660-200-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2912-210-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/828-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2896-236-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1784-245-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1716-262-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1056-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1716-264-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2676-335-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2380-354-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2960-361-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2960-362-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1096-444-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/784-450-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/1592-498-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2896-513-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1076-526-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2464-554-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2448-567-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2672-594-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1004-693-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/1748-700-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3016-742-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2484-767-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2624-819-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2668 1ntbhn.exe 2800 vpvpv.exe 3040 jdjjp.exe 2564 pjvdj.exe 2592 7pdjp.exe 2580 1thbbb.exe 2972 jvjjp.exe 2208 nhbhnn.exe 2396 tnhbnh.exe 1292 lfrlxfr.exe 1748 lfxfrfr.exe 1768 3pjjj.exe 832 5frxlrx.exe 2356 rfflxfl.exe 808 thhhhn.exe 784 9jjpv.exe 1792 rfxfrfx.exe 2172 vpdvj.exe 2088 dpddv.exe 1660 lfrrrxf.exe 2912 hhthtb.exe 828 fxfflll.exe 1996 xxffrlr.exe 2896 3jjjv.exe 1784 ddvjv.exe 2460 fxfflrx.exe 1716 9hthnn.exe 1056 xrlrfff.exe 1420 tnhnnh.exe 1788 dpvpp.exe 2156 rfxfflx.exe 2668 1bnnnn.exe 1608 btntht.exe 2792 vjvdj.exe 2800 9rxxxrr.exe 2876 hthhtt.exe 2676 1ththb.exe 2540 jvvvd.exe 2604 1vjdv.exe 2380 3lxxrxf.exe 2960 5rxlflf.exe 2388 btbbbh.exe 2360 pjddd.exe 2092 rfrllff.exe 1236 rxlfllx.exe 1552 ntnhnh.exe 856 hbnbhh.exe 2836 vpvdd.exe 2864 dpddd.exe 1352 lxlrxxf.exe 624 lxfffxl.exe 476 thhbth.exe 1096 9tntbb.exe 784 pdpvv.exe 1668 9lfxffx.exe 3016 thtttt.exe 580 5jvvv.exe 2220 vdpjj.exe 804 xlxllfl.exe 2684 frxxffl.exe 1592 1tnnnn.exe 604 tnnhnt.exe 1996 pdjdd.exe 2896 7xrxxxl.exe -
resource yara_rule behavioral1/memory/3028-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3028-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0003000000012000-5.dat upx behavioral1/memory/2800-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016a66-18.dat upx behavioral1/memory/2668-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016c3a-27.dat upx behavioral1/memory/3040-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2564-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016c51-38.dat upx behavioral1/memory/3040-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016cc8-47.dat upx behavioral1/files/0x0007000000016cec-55.dat upx behavioral1/memory/2580-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2592-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2580-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016d06-67.dat upx behavioral1/files/0x0008000000016d29-76.dat upx behavioral1/memory/2208-78-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2972-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2208-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000171a8-87.dat upx behavioral1/memory/2396-88-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000173a7-96.dat upx behavioral1/memory/1292-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2396-97-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000173a9-108.dat upx behavioral1/memory/1292-107-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017488-116.dat upx behavioral1/memory/1768-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1748-117-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017492-126.dat upx behavioral1/memory/832-128-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000174cc-137.dat upx behavioral1/memory/832-134-0x00000000001B0000-0x00000000001D7000-memory.dmp upx behavioral1/files/0x000d000000018676-147.dat upx behavioral1/memory/2356-140-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/784-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018683-155.dat upx behavioral1/files/0x00050000000186e4-164.dat upx behavioral1/files/0x00050000000186ea-172.dat upx behavioral1/memory/2172-174-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1792-173-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000186ee-182.dat upx behavioral1/memory/2088-184-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000186fd-191.dat upx behavioral1/memory/1660-192-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018728-201.dat upx behavioral1/memory/1660-200-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001873d-209.dat upx behavioral1/memory/2912-210-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0036000000016560-219.dat upx behavioral1/memory/828-218-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018784-229.dat upx behavioral1/files/0x000500000001878f-237.dat upx behavioral1/memory/2896-236-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1784-245-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000187a5-247.dat upx behavioral1/files/0x0006000000019023-254.dat upx behavioral1/memory/1056-266-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001925e-265.dat upx behavioral1/memory/1716-264-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019261-273.dat upx behavioral1/files/0x0005000000019282-282.dat upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbtbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rffrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hnnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnntth.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3028 wrote to memory of 2668 3028 9abf1dbb1400f9bd05a7bb046ec334862132a19e67d97f707268ae733b26d0c6.exe 30 PID 3028 wrote to memory of 2668 3028 9abf1dbb1400f9bd05a7bb046ec334862132a19e67d97f707268ae733b26d0c6.exe 30 PID 3028 wrote to memory of 2668 3028 9abf1dbb1400f9bd05a7bb046ec334862132a19e67d97f707268ae733b26d0c6.exe 30 PID 3028 wrote to memory of 2668 3028 9abf1dbb1400f9bd05a7bb046ec334862132a19e67d97f707268ae733b26d0c6.exe 30 PID 2668 wrote to memory of 2800 2668 1ntbhn.exe 31 PID 2668 wrote to memory of 2800 2668 1ntbhn.exe 31 PID 2668 wrote to memory of 2800 2668 1ntbhn.exe 31 PID 2668 wrote to memory of 2800 2668 1ntbhn.exe 31 PID 2800 wrote to memory of 3040 2800 vpvpv.exe 32 PID 2800 wrote to memory of 3040 2800 vpvpv.exe 32 PID 2800 wrote to memory of 3040 2800 vpvpv.exe 32 PID 2800 wrote to memory of 3040 2800 vpvpv.exe 32 PID 3040 wrote to memory of 2564 3040 jdjjp.exe 33 PID 3040 wrote to memory of 2564 3040 jdjjp.exe 33 PID 3040 wrote to memory of 2564 3040 jdjjp.exe 33 PID 3040 wrote to memory of 2564 3040 jdjjp.exe 33 PID 2564 wrote to memory of 2592 2564 pjvdj.exe 34 PID 2564 wrote to memory of 2592 2564 pjvdj.exe 34 PID 2564 wrote to memory of 2592 2564 pjvdj.exe 34 PID 2564 wrote to memory of 2592 2564 pjvdj.exe 34 PID 2592 wrote to memory of 2580 2592 7pdjp.exe 35 PID 2592 wrote to memory of 2580 2592 7pdjp.exe 35 PID 2592 wrote to memory of 2580 2592 7pdjp.exe 35 PID 2592 wrote to memory of 2580 2592 7pdjp.exe 35 PID 2580 wrote to memory of 2972 2580 1thbbb.exe 36 PID 2580 wrote to memory of 2972 2580 1thbbb.exe 36 PID 2580 wrote to memory of 2972 2580 1thbbb.exe 36 PID 2580 wrote to memory of 2972 2580 1thbbb.exe 36 PID 2972 wrote to memory of 2208 2972 jvjjp.exe 37 PID 2972 wrote to memory of 2208 2972 jvjjp.exe 37 PID 2972 wrote to memory of 2208 2972 jvjjp.exe 37 PID 2972 wrote to memory of 2208 2972 jvjjp.exe 37 PID 2208 wrote to memory of 2396 2208 nhbhnn.exe 38 PID 2208 wrote to memory of 2396 2208 nhbhnn.exe 38 PID 2208 wrote to memory of 2396 2208 nhbhnn.exe 38 PID 2208 wrote to memory of 2396 2208 nhbhnn.exe 38 PID 2396 wrote to memory of 1292 2396 tnhbnh.exe 39 PID 2396 wrote to memory of 1292 2396 tnhbnh.exe 39 PID 2396 wrote to memory of 1292 2396 tnhbnh.exe 39 PID 2396 wrote to memory of 1292 2396 tnhbnh.exe 39 PID 1292 wrote to memory of 1748 1292 lfrlxfr.exe 40 PID 1292 wrote to memory of 1748 1292 lfrlxfr.exe 40 PID 1292 wrote to memory of 1748 1292 lfrlxfr.exe 40 PID 1292 wrote to memory of 1748 1292 lfrlxfr.exe 40 PID 1748 wrote to memory of 1768 1748 lfxfrfr.exe 41 PID 1748 wrote to memory of 1768 1748 lfxfrfr.exe 41 PID 1748 wrote to memory of 1768 1748 lfxfrfr.exe 41 PID 1748 wrote to memory of 1768 1748 lfxfrfr.exe 41 PID 1768 wrote to memory of 832 1768 3pjjj.exe 42 PID 1768 wrote to memory of 832 1768 3pjjj.exe 42 PID 1768 wrote to memory of 832 1768 3pjjj.exe 42 PID 1768 wrote to memory of 832 1768 3pjjj.exe 42 PID 832 wrote to memory of 2356 832 5frxlrx.exe 43 PID 832 wrote to memory of 2356 832 5frxlrx.exe 43 PID 832 wrote to memory of 2356 832 5frxlrx.exe 43 PID 832 wrote to memory of 2356 832 5frxlrx.exe 43 PID 2356 wrote to memory of 808 2356 rfflxfl.exe 44 PID 2356 wrote to memory of 808 2356 rfflxfl.exe 44 PID 2356 wrote to memory of 808 2356 rfflxfl.exe 44 PID 2356 wrote to memory of 808 2356 rfflxfl.exe 44 PID 808 wrote to memory of 784 808 thhhhn.exe 45 PID 808 wrote to memory of 784 808 thhhhn.exe 45 PID 808 wrote to memory of 784 808 thhhhn.exe 45 PID 808 wrote to memory of 784 808 thhhhn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\9abf1dbb1400f9bd05a7bb046ec334862132a19e67d97f707268ae733b26d0c6.exe"C:\Users\Admin\AppData\Local\Temp\9abf1dbb1400f9bd05a7bb046ec334862132a19e67d97f707268ae733b26d0c6.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\1ntbhn.exec:\1ntbhn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\vpvpv.exec:\vpvpv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\jdjjp.exec:\jdjjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\pjvdj.exec:\pjvdj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\7pdjp.exec:\7pdjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\1thbbb.exec:\1thbbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\jvjjp.exec:\jvjjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\nhbhnn.exec:\nhbhnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\tnhbnh.exec:\tnhbnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\lfrlxfr.exec:\lfrlxfr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
\??\c:\lfxfrfr.exec:\lfxfrfr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\3pjjj.exec:\3pjjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
\??\c:\5frxlrx.exec:\5frxlrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
\??\c:\rfflxfl.exec:\rfflxfl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\thhhhn.exec:\thhhhn.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:808 -
\??\c:\9jjpv.exec:\9jjpv.exe17⤵
- Executes dropped EXE
PID:784 -
\??\c:\rfxfrfx.exec:\rfxfrfx.exe18⤵
- Executes dropped EXE
PID:1792 -
\??\c:\vpdvj.exec:\vpdvj.exe19⤵
- Executes dropped EXE
PID:2172 -
\??\c:\dpddv.exec:\dpddv.exe20⤵
- Executes dropped EXE
PID:2088 -
\??\c:\lfrrrxf.exec:\lfrrrxf.exe21⤵
- Executes dropped EXE
PID:1660 -
\??\c:\hhthtb.exec:\hhthtb.exe22⤵
- Executes dropped EXE
PID:2912 -
\??\c:\fxfflll.exec:\fxfflll.exe23⤵
- Executes dropped EXE
PID:828 -
\??\c:\xxffrlr.exec:\xxffrlr.exe24⤵
- Executes dropped EXE
PID:1996 -
\??\c:\3jjjv.exec:\3jjjv.exe25⤵
- Executes dropped EXE
PID:2896 -
\??\c:\ddvjv.exec:\ddvjv.exe26⤵
- Executes dropped EXE
PID:1784 -
\??\c:\fxfflrx.exec:\fxfflrx.exe27⤵
- Executes dropped EXE
PID:2460 -
\??\c:\9hthnn.exec:\9hthnn.exe28⤵
- Executes dropped EXE
PID:1716 -
\??\c:\xrlrfff.exec:\xrlrfff.exe29⤵
- Executes dropped EXE
PID:1056 -
\??\c:\tnhnnh.exec:\tnhnnh.exe30⤵
- Executes dropped EXE
PID:1420 -
\??\c:\dpvpp.exec:\dpvpp.exe31⤵
- Executes dropped EXE
PID:1788 -
\??\c:\rfxfflx.exec:\rfxfflx.exe32⤵
- Executes dropped EXE
PID:2156 -
\??\c:\1bnnnn.exec:\1bnnnn.exe33⤵
- Executes dropped EXE
PID:2668 -
\??\c:\btntht.exec:\btntht.exe34⤵
- Executes dropped EXE
PID:1608 -
\??\c:\vjvdj.exec:\vjvdj.exe35⤵
- Executes dropped EXE
PID:2792 -
\??\c:\9rxxxrr.exec:\9rxxxrr.exe36⤵
- Executes dropped EXE
PID:2800 -
\??\c:\hthhtt.exec:\hthhtt.exe37⤵
- Executes dropped EXE
PID:2876 -
\??\c:\1ththb.exec:\1ththb.exe38⤵
- Executes dropped EXE
PID:2676 -
\??\c:\jvvvd.exec:\jvvvd.exe39⤵
- Executes dropped EXE
PID:2540 -
\??\c:\1vjdv.exec:\1vjdv.exe40⤵
- Executes dropped EXE
PID:2604 -
\??\c:\3lxxrxf.exec:\3lxxrxf.exe41⤵
- Executes dropped EXE
PID:2380 -
\??\c:\5rxlflf.exec:\5rxlflf.exe42⤵
- Executes dropped EXE
PID:2960 -
\??\c:\btbbbh.exec:\btbbbh.exe43⤵
- Executes dropped EXE
PID:2388 -
\??\c:\pjddd.exec:\pjddd.exe44⤵
- Executes dropped EXE
PID:2360 -
\??\c:\rfrllff.exec:\rfrllff.exe45⤵
- Executes dropped EXE
PID:2092 -
\??\c:\rxlfllx.exec:\rxlfllx.exe46⤵
- Executes dropped EXE
PID:1236 -
\??\c:\ntnhnh.exec:\ntnhnh.exe47⤵
- Executes dropped EXE
PID:1552 -
\??\c:\hbnbhh.exec:\hbnbhh.exe48⤵
- Executes dropped EXE
PID:856 -
\??\c:\vpvdd.exec:\vpvdd.exe49⤵
- Executes dropped EXE
PID:2836 -
\??\c:\dpddd.exec:\dpddd.exe50⤵
- Executes dropped EXE
PID:2864 -
\??\c:\lxlrxxf.exec:\lxlrxxf.exe51⤵
- Executes dropped EXE
PID:1352 -
\??\c:\lxfffxl.exec:\lxfffxl.exe52⤵
- Executes dropped EXE
PID:624 -
\??\c:\thhbth.exec:\thhbth.exe53⤵
- Executes dropped EXE
PID:476 -
\??\c:\9tntbb.exec:\9tntbb.exe54⤵
- Executes dropped EXE
PID:1096 -
\??\c:\pdpvv.exec:\pdpvv.exe55⤵
- Executes dropped EXE
PID:784 -
\??\c:\9lfxffx.exec:\9lfxffx.exe56⤵
- Executes dropped EXE
PID:1668 -
\??\c:\thtttt.exec:\thtttt.exe57⤵
- Executes dropped EXE
PID:3016 -
\??\c:\5jvvv.exec:\5jvvv.exe58⤵
- Executes dropped EXE
PID:580 -
\??\c:\vdpjj.exec:\vdpjj.exe59⤵
- Executes dropped EXE
PID:2220 -
\??\c:\xlxllfl.exec:\xlxllfl.exe60⤵
- Executes dropped EXE
PID:804 -
\??\c:\frxxffl.exec:\frxxffl.exe61⤵
- Executes dropped EXE
PID:2684 -
\??\c:\1tnnnn.exec:\1tnnnn.exe62⤵
- Executes dropped EXE
PID:1592 -
\??\c:\tnnhnt.exec:\tnnhnt.exe63⤵
- Executes dropped EXE
PID:604 -
\??\c:\pdjdd.exec:\pdjdd.exe64⤵
- Executes dropped EXE
PID:1996 -
\??\c:\7xrxxxl.exec:\7xrxxxl.exe65⤵
- Executes dropped EXE
PID:2896 -
\??\c:\1rfxrrx.exec:\1rfxrrx.exe66⤵PID:2628
-
\??\c:\htbhbh.exec:\htbhbh.exe67⤵PID:1076
-
\??\c:\5nbbhh.exec:\5nbbhh.exe68⤵PID:2624
-
\??\c:\jdpvd.exec:\jdpvd.exe69⤵PID:2340
-
\??\c:\frlxrrx.exec:\frlxrrx.exe70⤵PID:2464
-
\??\c:\7lxflll.exec:\7lxflll.exe71⤵PID:1512
-
\??\c:\tnnnhn.exec:\tnnnhn.exe72⤵PID:2448
-
\??\c:\pjvvv.exec:\pjvvv.exe73⤵PID:2400
-
\??\c:\dvvdd.exec:\dvvdd.exe74⤵PID:2880
-
\??\c:\rfxfllr.exec:\rfxfllr.exe75⤵PID:1604
-
\??\c:\lrxflff.exec:\lrxflff.exe76⤵PID:2672
-
\??\c:\thnthn.exec:\thnthn.exe77⤵PID:2824
-
\??\c:\hthbtn.exec:\hthbtn.exe78⤵PID:2820
-
\??\c:\ddvvj.exec:\ddvvj.exe79⤵PID:2712
-
\??\c:\rflffll.exec:\rflffll.exe80⤵PID:2556
-
\??\c:\thtntn.exec:\thtntn.exe81⤵PID:2588
-
\??\c:\1ntntt.exec:\1ntntt.exe82⤵PID:2580
-
\??\c:\1jvvd.exec:\1jvvd.exe83⤵PID:2064
-
\??\c:\9vddj.exec:\9vddj.exe84⤵PID:2376
-
\??\c:\lfxllfl.exec:\lfxllfl.exe85⤵PID:2120
-
\??\c:\tnbbbt.exec:\tnbbbt.exe86⤵PID:1936
-
\??\c:\bntbbt.exec:\bntbbt.exe87⤵PID:376
-
\??\c:\dpjdd.exec:\dpjdd.exe88⤵PID:2296
-
\??\c:\1frllrx.exec:\1frllrx.exe89⤵PID:1748
-
\??\c:\lllfffr.exec:\lllfffr.exe90⤵PID:1744
-
\??\c:\nbnntn.exec:\nbnntn.exe91⤵PID:1004
-
\??\c:\hthhnn.exec:\hthhnn.exe92⤵PID:2372
-
\??\c:\vpjpd.exec:\vpjpd.exe93⤵PID:320
-
\??\c:\pjvdj.exec:\pjvdj.exe94⤵PID:532
-
\??\c:\5rfrlff.exec:\5rfrlff.exe95⤵PID:400
-
\??\c:\9httbb.exec:\9httbb.exe96⤵PID:2252
-
\??\c:\bntttb.exec:\bntttb.exe97⤵PID:2412
-
\??\c:\1jpjj.exec:\1jpjj.exe98⤵PID:2288
-
\??\c:\rlrrxfr.exec:\rlrrxfr.exe99⤵PID:3016
-
\??\c:\9xfxxrl.exec:\9xfxxrl.exe100⤵PID:1760
-
\??\c:\3hbtth.exec:\3hbtth.exe101⤵PID:1328
-
\??\c:\5dpjv.exec:\5dpjv.exe102⤵PID:2484
-
\??\c:\vpddp.exec:\vpddp.exe103⤵PID:1620
-
\??\c:\rrxxfrf.exec:\rrxxfrf.exe104⤵PID:680
-
\??\c:\bttbtt.exec:\bttbtt.exe105⤵PID:660
-
\??\c:\bthnnn.exec:\bthnnn.exe106⤵PID:1800
-
\??\c:\9vjpd.exec:\9vjpd.exe107⤵PID:2732
-
\??\c:\5vvdd.exec:\5vvdd.exe108⤵PID:2924
-
\??\c:\5rffrlr.exec:\5rffrlr.exe109⤵
- System Location Discovery: System Language Discovery
PID:2068 -
\??\c:\lrxrllr.exec:\lrxrllr.exe110⤵PID:2624
-
\??\c:\tnbbnh.exec:\tnbbnh.exe111⤵PID:1184
-
\??\c:\pvdjd.exec:\pvdjd.exe112⤵PID:308
-
\??\c:\ddpdp.exec:\ddpdp.exe113⤵PID:1512
-
\??\c:\3rxfllf.exec:\3rxfllf.exe114⤵PID:3028
-
\??\c:\xlrflll.exec:\xlrflll.exe115⤵PID:2156
-
\??\c:\3hnnhb.exec:\3hnnhb.exe116⤵
- System Location Discovery: System Language Discovery
PID:1580 -
\??\c:\thtttt.exec:\thtttt.exe117⤵PID:2784
-
\??\c:\jvdvp.exec:\jvdvp.exe118⤵PID:2544
-
\??\c:\frlrxfl.exec:\frlrxfl.exe119⤵PID:2788
-
\??\c:\lfffrrx.exec:\lfffrrx.exe120⤵PID:2876
-
\??\c:\7tntbb.exec:\7tntbb.exe121⤵PID:2564
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-