Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
17-12-2024 11:57
Behavioral task
behavioral1
Sample
755217f96413a3de51e605bdb125b63cd8331a4b36b70db88044e3a779ab924fN.exe
Resource
win7-20241023-en
7 signatures
120 seconds
General
-
Target
755217f96413a3de51e605bdb125b63cd8331a4b36b70db88044e3a779ab924fN.exe
-
Size
91KB
-
MD5
49a772277fa5346d5ad6f09a703c5610
-
SHA1
9d12f1040d9c8ed9eed1fd6e8c65208def083a65
-
SHA256
755217f96413a3de51e605bdb125b63cd8331a4b36b70db88044e3a779ab924f
-
SHA512
cf9ba70eca784b3306458210e5e6c25a9ae436fea30fa967c2189a13f3972b6bc00cf5924736d57513778c2564b0fd8f5eb24e041ffaceaf0879eb0b5838e876
-
SSDEEP
1536:9vQBeOGtrYS3srx93UBWfwC6Ggnouy8PbhnyLFbUZJjw51Mh2RUpt/0Ku:9hOmTsF93UYfwC6GIoutz5yLp1MhZpVE
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 53 IoCs
resource yara_rule behavioral1/memory/2588-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2628-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2596-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2188-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2828-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2548-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2912-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2780-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2688-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2852-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2696-99-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1988-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1312-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1628-177-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2288-181-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1628-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1640-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1080-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1152-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1152-196-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/1544-219-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/956-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/848-260-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1556-247-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1556-251-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/884-271-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2524-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1556-288-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1712-303-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2060-311-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2108-325-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2200-332-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2972-366-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2752-380-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2364-413-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1948-420-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2248-559-0x00000000001C0000-0x00000000001E7000-memory.dmp family_blackmoon behavioral1/memory/2328-660-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1484-667-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1480-683-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2584-700-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1152-741-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1640-760-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1304-765-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2592-830-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1708-845-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2936-906-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2684-913-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1528-990-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2236-1057-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2152-1070-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/2236-1076-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2708-1161-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2628 nhnbnn.exe 2596 0480624.exe 2188 4620848.exe 2548 hnnbbt.exe 2828 frflrrr.exe 2912 xlflrrx.exe 2688 s8646.exe 2780 ttnnbb.exe 2852 tnbhhn.exe 2696 lflxrxf.exe 2512 04680.exe 1732 4662684.exe 852 vvjpv.exe 3044 2466002.exe 2740 40462.exe 1988 4880664.exe 2356 046626.exe 1312 rxlxxrx.exe 1628 48628.exe 2288 pjdvd.exe 1152 dvddd.exe 1080 6488406.exe 1640 26806.exe 1544 2406484.exe 540 080082.exe 956 08062.exe 1556 u084028.exe 848 842442.exe 372 xrllxxx.exe 884 c280244.exe 2524 jvjjp.exe 2632 o646624.exe 1712 pjvdp.exe 2060 dpvpp.exe 2500 vjvjv.exe 2108 2084880.exe 2200 jdpdv.exe 2968 9tntbb.exe 2096 3nhbnn.exe 2708 i682822.exe 2796 jdvvp.exe 2972 5xxfrrl.exe 2980 9dpvj.exe 2752 5rfxxfr.exe 2976 662844.exe 2340 86208.exe 1524 08068.exe 1580 m0446.exe 2364 2404666.exe 1948 268066.exe 2748 208800.exe 2008 hnhbbb.exe 1656 0844006.exe 1592 8640286.exe 376 6428288.exe 472 2684280.exe 2288 nnhnbb.exe 2284 9bthnh.exe 1488 nhtnbh.exe 952 5frrxff.exe 2260 fxlrrrl.exe 1668 xfffllr.exe 112 k20844.exe 1608 nhnnnh.exe -
resource yara_rule behavioral1/memory/2588-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000d00000001202b-5.dat upx behavioral1/memory/2588-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2596-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2628-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016d54-15.dat upx behavioral1/files/0x0007000000016d67-27.dat upx behavioral1/memory/2188-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2596-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016d6b-39.dat upx behavioral1/memory/2548-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2188-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2828-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016d6f-48.dat upx behavioral1/memory/2548-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2912-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000016d77-57.dat upx behavioral1/files/0x0005000000018704-83.dat upx behavioral1/memory/2780-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000186f4-75.dat upx behavioral1/memory/2688-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d9f-66.dat upx behavioral1/files/0x0005000000018739-93.dat upx behavioral1/memory/2852-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018744-102.dat upx behavioral1/files/0x000500000001878e-111.dat upx behavioral1/files/0x00050000000187a8-118.dat upx behavioral1/files/0x0006000000018b4e-126.dat upx behavioral1/files/0x0006000000018c16-134.dat upx behavioral1/memory/1988-145-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019250-151.dat upx behavioral1/files/0x0005000000019246-143.dat upx behavioral1/files/0x0005000000019269-161.dat upx behavioral1/memory/1312-160-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019278-169.dat upx behavioral1/memory/1312-168-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2288-181-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019284-180.dat upx behavioral1/memory/1628-179-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019297-188.dat upx behavioral1/memory/1640-209-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019360-208.dat upx behavioral1/memory/1080-206-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001933f-199.dat upx behavioral1/memory/1152-198-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1544-219-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193b6-226.dat upx behavioral1/files/0x00050000000193a6-217.dat upx behavioral1/files/0x00050000000193c4-234.dat upx behavioral1/files/0x000a000000016d2a-242.dat upx behavioral1/memory/956-241-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019451-262.dat upx behavioral1/memory/848-260-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193df-253.dat upx behavioral1/memory/1556-251-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/884-271-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019458-270.dat upx behavioral1/memory/2524-280-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194a9-279.dat upx behavioral1/files/0x00050000000194b9-289.dat upx behavioral1/memory/1712-296-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2060-304-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1712-303-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2060-311-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language i862206.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e20600.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a4886.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlrxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44686.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxflll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language i804666.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6466224.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language o802062.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42802.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2588 wrote to memory of 2628 2588 755217f96413a3de51e605bdb125b63cd8331a4b36b70db88044e3a779ab924fN.exe 30 PID 2588 wrote to memory of 2628 2588 755217f96413a3de51e605bdb125b63cd8331a4b36b70db88044e3a779ab924fN.exe 30 PID 2588 wrote to memory of 2628 2588 755217f96413a3de51e605bdb125b63cd8331a4b36b70db88044e3a779ab924fN.exe 30 PID 2588 wrote to memory of 2628 2588 755217f96413a3de51e605bdb125b63cd8331a4b36b70db88044e3a779ab924fN.exe 30 PID 2628 wrote to memory of 2596 2628 nhnbnn.exe 31 PID 2628 wrote to memory of 2596 2628 nhnbnn.exe 31 PID 2628 wrote to memory of 2596 2628 nhnbnn.exe 31 PID 2628 wrote to memory of 2596 2628 nhnbnn.exe 31 PID 2596 wrote to memory of 2188 2596 0480624.exe 32 PID 2596 wrote to memory of 2188 2596 0480624.exe 32 PID 2596 wrote to memory of 2188 2596 0480624.exe 32 PID 2596 wrote to memory of 2188 2596 0480624.exe 32 PID 2188 wrote to memory of 2548 2188 4620848.exe 33 PID 2188 wrote to memory of 2548 2188 4620848.exe 33 PID 2188 wrote to memory of 2548 2188 4620848.exe 33 PID 2188 wrote to memory of 2548 2188 4620848.exe 33 PID 2548 wrote to memory of 2828 2548 hnnbbt.exe 34 PID 2548 wrote to memory of 2828 2548 hnnbbt.exe 34 PID 2548 wrote to memory of 2828 2548 hnnbbt.exe 34 PID 2548 wrote to memory of 2828 2548 hnnbbt.exe 34 PID 2828 wrote to memory of 2912 2828 frflrrr.exe 35 PID 2828 wrote to memory of 2912 2828 frflrrr.exe 35 PID 2828 wrote to memory of 2912 2828 frflrrr.exe 35 PID 2828 wrote to memory of 2912 2828 frflrrr.exe 35 PID 2912 wrote to memory of 2688 2912 xlflrrx.exe 36 PID 2912 wrote to memory of 2688 2912 xlflrrx.exe 36 PID 2912 wrote to memory of 2688 2912 xlflrrx.exe 36 PID 2912 wrote to memory of 2688 2912 xlflrrx.exe 36 PID 2688 wrote to memory of 2780 2688 s8646.exe 37 PID 2688 wrote to memory of 2780 2688 s8646.exe 37 PID 2688 wrote to memory of 2780 2688 s8646.exe 37 PID 2688 wrote to memory of 2780 2688 s8646.exe 37 PID 2780 wrote to memory of 2852 2780 ttnnbb.exe 38 PID 2780 wrote to memory of 2852 2780 ttnnbb.exe 38 PID 2780 wrote to memory of 2852 2780 ttnnbb.exe 38 PID 2780 wrote to memory of 2852 2780 ttnnbb.exe 38 PID 2852 wrote to memory of 2696 2852 tnbhhn.exe 39 PID 2852 wrote to memory of 2696 2852 tnbhhn.exe 39 PID 2852 wrote to memory of 2696 2852 tnbhhn.exe 39 PID 2852 wrote to memory of 2696 2852 tnbhhn.exe 39 PID 2696 wrote to memory of 2512 2696 lflxrxf.exe 40 PID 2696 wrote to memory of 2512 2696 lflxrxf.exe 40 PID 2696 wrote to memory of 2512 2696 lflxrxf.exe 40 PID 2696 wrote to memory of 2512 2696 lflxrxf.exe 40 PID 2512 wrote to memory of 1732 2512 04680.exe 41 PID 2512 wrote to memory of 1732 2512 04680.exe 41 PID 2512 wrote to memory of 1732 2512 04680.exe 41 PID 2512 wrote to memory of 1732 2512 04680.exe 41 PID 1732 wrote to memory of 852 1732 4662684.exe 42 PID 1732 wrote to memory of 852 1732 4662684.exe 42 PID 1732 wrote to memory of 852 1732 4662684.exe 42 PID 1732 wrote to memory of 852 1732 4662684.exe 42 PID 852 wrote to memory of 3044 852 vvjpv.exe 43 PID 852 wrote to memory of 3044 852 vvjpv.exe 43 PID 852 wrote to memory of 3044 852 vvjpv.exe 43 PID 852 wrote to memory of 3044 852 vvjpv.exe 43 PID 3044 wrote to memory of 2740 3044 2466002.exe 44 PID 3044 wrote to memory of 2740 3044 2466002.exe 44 PID 3044 wrote to memory of 2740 3044 2466002.exe 44 PID 3044 wrote to memory of 2740 3044 2466002.exe 44 PID 2740 wrote to memory of 1988 2740 40462.exe 45 PID 2740 wrote to memory of 1988 2740 40462.exe 45 PID 2740 wrote to memory of 1988 2740 40462.exe 45 PID 2740 wrote to memory of 1988 2740 40462.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\755217f96413a3de51e605bdb125b63cd8331a4b36b70db88044e3a779ab924fN.exe"C:\Users\Admin\AppData\Local\Temp\755217f96413a3de51e605bdb125b63cd8331a4b36b70db88044e3a779ab924fN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\nhnbnn.exec:\nhnbnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\0480624.exec:\0480624.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\4620848.exec:\4620848.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\hnnbbt.exec:\hnnbbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\frflrrr.exec:\frflrrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\xlflrrx.exec:\xlflrrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\s8646.exec:\s8646.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\ttnnbb.exec:\ttnnbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\tnbhhn.exec:\tnbhhn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\lflxrxf.exec:\lflxrxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\04680.exec:\04680.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\4662684.exec:\4662684.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\vvjpv.exec:\vvjpv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
\??\c:\2466002.exec:\2466002.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\40462.exec:\40462.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\4880664.exec:\4880664.exe17⤵
- Executes dropped EXE
PID:1988 -
\??\c:\046626.exec:\046626.exe18⤵
- Executes dropped EXE
PID:2356 -
\??\c:\rxlxxrx.exec:\rxlxxrx.exe19⤵
- Executes dropped EXE
PID:1312 -
\??\c:\48628.exec:\48628.exe20⤵
- Executes dropped EXE
PID:1628 -
\??\c:\pjdvd.exec:\pjdvd.exe21⤵
- Executes dropped EXE
PID:2288 -
\??\c:\dvddd.exec:\dvddd.exe22⤵
- Executes dropped EXE
PID:1152 -
\??\c:\6488406.exec:\6488406.exe23⤵
- Executes dropped EXE
PID:1080 -
\??\c:\26806.exec:\26806.exe24⤵
- Executes dropped EXE
PID:1640 -
\??\c:\2406484.exec:\2406484.exe25⤵
- Executes dropped EXE
PID:1544 -
\??\c:\080082.exec:\080082.exe26⤵
- Executes dropped EXE
PID:540 -
\??\c:\08062.exec:\08062.exe27⤵
- Executes dropped EXE
PID:956 -
\??\c:\u084028.exec:\u084028.exe28⤵
- Executes dropped EXE
PID:1556 -
\??\c:\842442.exec:\842442.exe29⤵
- Executes dropped EXE
PID:848 -
\??\c:\xrllxxx.exec:\xrllxxx.exe30⤵
- Executes dropped EXE
PID:372 -
\??\c:\c280244.exec:\c280244.exe31⤵
- Executes dropped EXE
PID:884 -
\??\c:\jvjjp.exec:\jvjjp.exe32⤵
- Executes dropped EXE
PID:2524 -
\??\c:\o646624.exec:\o646624.exe33⤵
- Executes dropped EXE
PID:2632 -
\??\c:\pjvdp.exec:\pjvdp.exe34⤵
- Executes dropped EXE
PID:1712 -
\??\c:\dpvpp.exec:\dpvpp.exe35⤵
- Executes dropped EXE
PID:2060 -
\??\c:\vjvjv.exec:\vjvjv.exe36⤵
- Executes dropped EXE
PID:2500 -
\??\c:\2084880.exec:\2084880.exe37⤵
- Executes dropped EXE
PID:2108 -
\??\c:\jdpdv.exec:\jdpdv.exe38⤵
- Executes dropped EXE
PID:2200 -
\??\c:\9tntbb.exec:\9tntbb.exe39⤵
- Executes dropped EXE
PID:2968 -
\??\c:\3nhbnn.exec:\3nhbnn.exe40⤵
- Executes dropped EXE
PID:2096 -
\??\c:\i682822.exec:\i682822.exe41⤵
- Executes dropped EXE
PID:2708 -
\??\c:\jdvvp.exec:\jdvvp.exe42⤵
- Executes dropped EXE
PID:2796 -
\??\c:\5xxfrrl.exec:\5xxfrrl.exe43⤵
- Executes dropped EXE
PID:2972 -
\??\c:\9dpvj.exec:\9dpvj.exe44⤵
- Executes dropped EXE
PID:2980 -
\??\c:\5rfxxfr.exec:\5rfxxfr.exe45⤵
- Executes dropped EXE
PID:2752 -
\??\c:\662844.exec:\662844.exe46⤵
- Executes dropped EXE
PID:2976 -
\??\c:\86208.exec:\86208.exe47⤵
- Executes dropped EXE
PID:2340 -
\??\c:\08068.exec:\08068.exe48⤵
- Executes dropped EXE
PID:1524 -
\??\c:\m0446.exec:\m0446.exe49⤵
- Executes dropped EXE
PID:1580 -
\??\c:\2404666.exec:\2404666.exe50⤵
- Executes dropped EXE
PID:2364 -
\??\c:\268066.exec:\268066.exe51⤵
- Executes dropped EXE
PID:1948 -
\??\c:\208800.exec:\208800.exe52⤵
- Executes dropped EXE
PID:2748 -
\??\c:\hnhbbb.exec:\hnhbbb.exe53⤵
- Executes dropped EXE
PID:2008 -
\??\c:\0844006.exec:\0844006.exe54⤵
- Executes dropped EXE
PID:1656 -
\??\c:\8640286.exec:\8640286.exe55⤵
- Executes dropped EXE
PID:1592 -
\??\c:\6428288.exec:\6428288.exe56⤵
- Executes dropped EXE
PID:376 -
\??\c:\2684280.exec:\2684280.exe57⤵
- Executes dropped EXE
PID:472 -
\??\c:\nnhnbb.exec:\nnhnbb.exe58⤵
- Executes dropped EXE
PID:2288 -
\??\c:\9bthnh.exec:\9bthnh.exe59⤵
- Executes dropped EXE
PID:2284 -
\??\c:\nhtnbh.exec:\nhtnbh.exe60⤵
- Executes dropped EXE
PID:1488 -
\??\c:\5frrxff.exec:\5frrxff.exe61⤵
- Executes dropped EXE
PID:952 -
\??\c:\fxlrrrl.exec:\fxlrrrl.exe62⤵
- Executes dropped EXE
PID:2260 -
\??\c:\xfffllr.exec:\xfffllr.exe63⤵
- Executes dropped EXE
PID:1668 -
\??\c:\k20844.exec:\k20844.exe64⤵
- Executes dropped EXE
PID:112 -
\??\c:\nhnnnh.exec:\nhnnnh.exe65⤵
- Executes dropped EXE
PID:1608 -
\??\c:\dpvvv.exec:\dpvvv.exe66⤵PID:1056
-
\??\c:\2684006.exec:\2684006.exe67⤵PID:2488
-
\??\c:\8684062.exec:\8684062.exe68⤵PID:304
-
\??\c:\q02228.exec:\q02228.exe69⤵PID:848
-
\??\c:\3bhthn.exec:\3bhthn.exe70⤵PID:372
-
\??\c:\42402.exec:\42402.exe71⤵PID:2448
-
\??\c:\hbtbnn.exec:\hbtbnn.exe72⤵PID:2220
-
\??\c:\q84466.exec:\q84466.exe73⤵PID:2248
-
\??\c:\lrxxlll.exec:\lrxxlll.exe74⤵PID:2372
-
\??\c:\0402824.exec:\0402824.exe75⤵PID:2004
-
\??\c:\6066228.exec:\6066228.exe76⤵PID:1600
-
\??\c:\u428062.exec:\u428062.exe77⤵PID:3048
-
\??\c:\82604.exec:\82604.exe78⤵PID:2156
-
\??\c:\3vpvp.exec:\3vpvp.exe79⤵PID:2464
-
\??\c:\o802062.exec:\o802062.exe80⤵
- System Location Discovery: System Language Discovery
PID:2548 -
\??\c:\lfxfrxf.exec:\lfxfrxf.exe81⤵PID:2928
-
\??\c:\42066.exec:\42066.exe82⤵PID:2860
-
\??\c:\bthntt.exec:\bthntt.exe83⤵PID:2944
-
\??\c:\k02466.exec:\k02466.exe84⤵PID:2736
-
\??\c:\nhnnbb.exec:\nhnnbb.exe85⤵PID:2956
-
\??\c:\1pjpd.exec:\1pjpd.exe86⤵PID:2852
-
\??\c:\48626.exec:\48626.exe87⤵PID:2680
-
\??\c:\26806.exec:\26806.exe88⤵PID:1904
-
\??\c:\6026262.exec:\6026262.exe89⤵PID:2328
-
\??\c:\c648488.exec:\c648488.exe90⤵PID:1484
-
\??\c:\64202.exec:\64202.exe91⤵PID:1524
-
\??\c:\ffrrxfr.exec:\ffrrxfr.exe92⤵PID:1480
-
\??\c:\vpddp.exec:\vpddp.exe93⤵PID:3012
-
\??\c:\jdvvj.exec:\jdvvj.exe94⤵PID:1980
-
\??\c:\lfllfll.exec:\lfllfll.exe95⤵PID:2584
-
\??\c:\1xlrxfl.exec:\1xlrxfl.exe96⤵PID:588
-
\??\c:\82068.exec:\82068.exe97⤵PID:1528
-
\??\c:\1tttbh.exec:\1tttbh.exe98⤵PID:548
-
\??\c:\7nhnnt.exec:\7nhnnt.exe99⤵PID:2776
-
\??\c:\9fflrxf.exec:\9fflrxf.exe100⤵PID:2652
-
\??\c:\tnbhtt.exec:\tnbhtt.exe101⤵PID:1152
-
\??\c:\60846.exec:\60846.exe102⤵PID:2180
-
\??\c:\nhtthh.exec:\nhtthh.exe103⤵PID:2068
-
\??\c:\jvddj.exec:\jvddj.exe104⤵PID:1640
-
\??\c:\9bnnbt.exec:\9bnnbt.exe105⤵PID:1304
-
\??\c:\2446846.exec:\2446846.exe106⤵PID:1200
-
\??\c:\e02860.exec:\e02860.exe107⤵PID:1608
-
\??\c:\bthnnn.exec:\bthnnn.exe108⤵PID:2492
-
\??\c:\20008.exec:\20008.exe109⤵PID:1624
-
\??\c:\lflxxlx.exec:\lflxxlx.exe110⤵PID:2528
-
\??\c:\nhbhtt.exec:\nhbhtt.exe111⤵PID:2308
-
\??\c:\e42404.exec:\e42404.exe112⤵PID:2148
-
\??\c:\xrlrxfl.exec:\xrlrxfl.exe113⤵PID:2612
-
\??\c:\jjpjp.exec:\jjpjp.exe114⤵PID:2416
-
\??\c:\jvpvd.exec:\jvpvd.exe115⤵PID:2592
-
\??\c:\e62862.exec:\e62862.exe116⤵PID:2628
-
\??\c:\3rffxfr.exec:\3rffxfr.exe117⤵PID:1708
-
\??\c:\pjpvd.exec:\pjpvd.exe118⤵PID:2060
-
\??\c:\7nnthh.exec:\7nnthh.exe119⤵PID:2988
-
\??\c:\486802.exec:\486802.exe120⤵PID:1752
-
\??\c:\1rllrrx.exec:\1rllrrx.exe121⤵PID:2832
-
\??\c:\646622.exec:\646622.exe122⤵PID:2920
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-