Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18-12-2024 23:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
85e87e390e47689ae3053d7018b0b9728b615399aafc8be0e341400589ab788c.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
85e87e390e47689ae3053d7018b0b9728b615399aafc8be0e341400589ab788c.exe
-
Size
453KB
-
MD5
1df35bc50c0ee817910fd9f6f2693f9f
-
SHA1
375124745971c2cbf9f203be91d9f08af788a7b6
-
SHA256
85e87e390e47689ae3053d7018b0b9728b615399aafc8be0e341400589ab788c
-
SHA512
ee463eb30139c1ea77a50ae01ff12c83a4355053933d1ea04f187295926582ee3f77ac8b3f3255f9c001ce3706eb9066102a1ab1603138337096148aed81d7a6
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeQ:q7Tc2NYHUrAwfMp3CDQ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 54 IoCs
resource yara_rule behavioral1/memory/2360-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2472-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-45-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2832-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-85-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/644-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1252-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-140-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2748-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2316-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-167-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2932-176-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2932-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2132-195-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2132-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1500-214-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2036-222-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2036-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/776-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-250-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1188-269-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2360-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1188-301-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2308-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-361-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2596-364-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1032-393-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1428-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-413-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-454-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2044-473-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/840-499-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1592-531-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-544-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-576-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-596-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-733-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2132-754-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2228-807-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/3044-832-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1848-865-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/936-878-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1596-1048-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2336-1099-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2472 3ffllxl.exe 2488 vvpdp.exe 2112 fxlflrf.exe 2676 hthhnn.exe 2832 9frxxxl.exe 2696 bbnthb.exe 2608 pjvdj.exe 2980 lxllrxf.exe 2584 5vpvp.exe 644 dvjpv.exe 1252 bbbnbh.exe 2908 dvdpd.exe 2540 lxxfrxr.exe 2748 hnbnhh.exe 2316 lflrllx.exe 2000 tntbbn.exe 2756 ppdjv.exe 2932 frllrxl.exe 1672 xlrxfxx.exe 2132 pjdjv.exe 2348 3lfrxxl.exe 1500 9hbhnn.exe 2036 ffrxffl.exe 308 rrxlrrr.exe 776 pvjvd.exe 3064 flxlxrr.exe 2392 xlllrxl.exe 1188 9htntt.exe 2532 ddddp.exe 1756 rlrfxfr.exe 2360 tnbhhh.exe 764 vvpvd.exe 2308 rlxfrlf.exe 2488 tnbbhh.exe 2680 lfxfrlx.exe 2296 nhtttt.exe 3016 hbnntt.exe 2832 5vjpv.exe 2884 xrflrxl.exe 2848 7rrxxfr.exe 2596 nnthth.exe 1932 vvppp.exe 2200 lxlrxxr.exe 540 nbttht.exe 1032 7pppp.exe 548 vpjvd.exe 1428 frfrxxx.exe 2904 bththn.exe 536 ppjvj.exe 2456 fxxflrl.exe 2672 ffxlrff.exe 1424 nhtbtb.exe 2040 vvpvj.exe 2968 3frxlff.exe 2424 bnbnth.exe 2144 tnnbtb.exe 2044 jpddj.exe 1912 xrrlrfx.exe 2976 tnthht.exe 316 7dvdp.exe 840 lxrflrx.exe 1604 1ttnnh.exe 2276 ddjdv.exe 2136 xxxxfxf.exe -
resource yara_rule behavioral1/memory/2472-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/644-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1252-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-140-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2748-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/776-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-361-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1428-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-473-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/840-499-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-531-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-544-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-576-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-596-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-605-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-683-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1940-696-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-754-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-845-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1848-865-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-885-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-907-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-936-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-992-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-1005-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1596-1048-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/1804-1086-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-1099-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/764-1112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/936-1125-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjpd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2360 wrote to memory of 2472 2360 85e87e390e47689ae3053d7018b0b9728b615399aafc8be0e341400589ab788c.exe 31 PID 2360 wrote to memory of 2472 2360 85e87e390e47689ae3053d7018b0b9728b615399aafc8be0e341400589ab788c.exe 31 PID 2360 wrote to memory of 2472 2360 85e87e390e47689ae3053d7018b0b9728b615399aafc8be0e341400589ab788c.exe 31 PID 2360 wrote to memory of 2472 2360 85e87e390e47689ae3053d7018b0b9728b615399aafc8be0e341400589ab788c.exe 31 PID 2472 wrote to memory of 2488 2472 3ffllxl.exe 32 PID 2472 wrote to memory of 2488 2472 3ffllxl.exe 32 PID 2472 wrote to memory of 2488 2472 3ffllxl.exe 32 PID 2472 wrote to memory of 2488 2472 3ffllxl.exe 32 PID 2488 wrote to memory of 2112 2488 vvpdp.exe 33 PID 2488 wrote to memory of 2112 2488 vvpdp.exe 33 PID 2488 wrote to memory of 2112 2488 vvpdp.exe 33 PID 2488 wrote to memory of 2112 2488 vvpdp.exe 33 PID 2112 wrote to memory of 2676 2112 fxlflrf.exe 34 PID 2112 wrote to memory of 2676 2112 fxlflrf.exe 34 PID 2112 wrote to memory of 2676 2112 fxlflrf.exe 34 PID 2112 wrote to memory of 2676 2112 fxlflrf.exe 34 PID 2676 wrote to memory of 2832 2676 hthhnn.exe 35 PID 2676 wrote to memory of 2832 2676 hthhnn.exe 35 PID 2676 wrote to memory of 2832 2676 hthhnn.exe 35 PID 2676 wrote to memory of 2832 2676 hthhnn.exe 35 PID 2832 wrote to memory of 2696 2832 9frxxxl.exe 36 PID 2832 wrote to memory of 2696 2832 9frxxxl.exe 36 PID 2832 wrote to memory of 2696 2832 9frxxxl.exe 36 PID 2832 wrote to memory of 2696 2832 9frxxxl.exe 36 PID 2696 wrote to memory of 2608 2696 bbnthb.exe 37 PID 2696 wrote to memory of 2608 2696 bbnthb.exe 37 PID 2696 wrote to memory of 2608 2696 bbnthb.exe 37 PID 2696 wrote to memory of 2608 2696 bbnthb.exe 37 PID 2608 wrote to memory of 2980 2608 pjvdj.exe 38 PID 2608 wrote to memory of 2980 2608 pjvdj.exe 38 PID 2608 wrote to memory of 2980 2608 pjvdj.exe 38 PID 2608 wrote to memory of 2980 2608 pjvdj.exe 38 PID 2980 wrote to memory of 2584 2980 lxllrxf.exe 39 PID 2980 wrote to memory of 2584 2980 lxllrxf.exe 39 PID 2980 wrote to memory of 2584 2980 lxllrxf.exe 39 PID 2980 wrote to memory of 2584 2980 lxllrxf.exe 39 PID 2584 wrote to memory of 644 2584 5vpvp.exe 40 PID 2584 wrote to memory of 644 2584 5vpvp.exe 40 PID 2584 wrote to memory of 644 2584 5vpvp.exe 40 PID 2584 wrote to memory of 644 2584 5vpvp.exe 40 PID 644 wrote to memory of 1252 644 dvjpv.exe 41 PID 644 wrote to memory of 1252 644 dvjpv.exe 41 PID 644 wrote to memory of 1252 644 dvjpv.exe 41 PID 644 wrote to memory of 1252 644 dvjpv.exe 41 PID 1252 wrote to memory of 2908 1252 bbbnbh.exe 42 PID 1252 wrote to memory of 2908 1252 bbbnbh.exe 42 PID 1252 wrote to memory of 2908 1252 bbbnbh.exe 42 PID 1252 wrote to memory of 2908 1252 bbbnbh.exe 42 PID 2908 wrote to memory of 2540 2908 dvdpd.exe 43 PID 2908 wrote to memory of 2540 2908 dvdpd.exe 43 PID 2908 wrote to memory of 2540 2908 dvdpd.exe 43 PID 2908 wrote to memory of 2540 2908 dvdpd.exe 43 PID 2540 wrote to memory of 2748 2540 lxxfrxr.exe 44 PID 2540 wrote to memory of 2748 2540 lxxfrxr.exe 44 PID 2540 wrote to memory of 2748 2540 lxxfrxr.exe 44 PID 2540 wrote to memory of 2748 2540 lxxfrxr.exe 44 PID 2748 wrote to memory of 2316 2748 hnbnhh.exe 45 PID 2748 wrote to memory of 2316 2748 hnbnhh.exe 45 PID 2748 wrote to memory of 2316 2748 hnbnhh.exe 45 PID 2748 wrote to memory of 2316 2748 hnbnhh.exe 45 PID 2316 wrote to memory of 2000 2316 lflrllx.exe 46 PID 2316 wrote to memory of 2000 2316 lflrllx.exe 46 PID 2316 wrote to memory of 2000 2316 lflrllx.exe 46 PID 2316 wrote to memory of 2000 2316 lflrllx.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\85e87e390e47689ae3053d7018b0b9728b615399aafc8be0e341400589ab788c.exe"C:\Users\Admin\AppData\Local\Temp\85e87e390e47689ae3053d7018b0b9728b615399aafc8be0e341400589ab788c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\3ffllxl.exec:\3ffllxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\vvpdp.exec:\vvpdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\fxlflrf.exec:\fxlflrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\hthhnn.exec:\hthhnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\9frxxxl.exec:\9frxxxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\bbnthb.exec:\bbnthb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\pjvdj.exec:\pjvdj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\lxllrxf.exec:\lxllrxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\5vpvp.exec:\5vpvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\dvjpv.exec:\dvjpv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:644 -
\??\c:\bbbnbh.exec:\bbbnbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\dvdpd.exec:\dvdpd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\lxxfrxr.exec:\lxxfrxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\hnbnhh.exec:\hnbnhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\lflrllx.exec:\lflrllx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\tntbbn.exec:\tntbbn.exe17⤵
- Executes dropped EXE
PID:2000 -
\??\c:\ppdjv.exec:\ppdjv.exe18⤵
- Executes dropped EXE
PID:2756 -
\??\c:\frllrxl.exec:\frllrxl.exe19⤵
- Executes dropped EXE
PID:2932 -
\??\c:\xlrxfxx.exec:\xlrxfxx.exe20⤵
- Executes dropped EXE
PID:1672 -
\??\c:\pjdjv.exec:\pjdjv.exe21⤵
- Executes dropped EXE
PID:2132 -
\??\c:\3lfrxxl.exec:\3lfrxxl.exe22⤵
- Executes dropped EXE
PID:2348 -
\??\c:\9hbhnn.exec:\9hbhnn.exe23⤵
- Executes dropped EXE
PID:1500 -
\??\c:\ffrxffl.exec:\ffrxffl.exe24⤵
- Executes dropped EXE
PID:2036 -
\??\c:\rrxlrrr.exec:\rrxlrrr.exe25⤵
- Executes dropped EXE
PID:308 -
\??\c:\pvjvd.exec:\pvjvd.exe26⤵
- Executes dropped EXE
PID:776 -
\??\c:\flxlxrr.exec:\flxlxrr.exe27⤵
- Executes dropped EXE
PID:3064 -
\??\c:\xlllrxl.exec:\xlllrxl.exe28⤵
- Executes dropped EXE
PID:2392 -
\??\c:\9htntt.exec:\9htntt.exe29⤵
- Executes dropped EXE
PID:1188 -
\??\c:\ddddp.exec:\ddddp.exe30⤵
- Executes dropped EXE
PID:2532 -
\??\c:\rlrfxfr.exec:\rlrfxfr.exe31⤵
- Executes dropped EXE
PID:1756 -
\??\c:\tnbhhh.exec:\tnbhhh.exe32⤵
- Executes dropped EXE
PID:2360 -
\??\c:\vvpvd.exec:\vvpvd.exe33⤵
- Executes dropped EXE
PID:764 -
\??\c:\rlxfrlf.exec:\rlxfrlf.exe34⤵
- Executes dropped EXE
PID:2308 -
\??\c:\tnbbhh.exec:\tnbbhh.exe35⤵
- Executes dropped EXE
PID:2488 -
\??\c:\lfxfrlx.exec:\lfxfrlx.exe36⤵
- Executes dropped EXE
PID:2680 -
\??\c:\nhtttt.exec:\nhtttt.exe37⤵
- Executes dropped EXE
PID:2296 -
\??\c:\hbnntt.exec:\hbnntt.exe38⤵
- Executes dropped EXE
PID:3016 -
\??\c:\5vjpv.exec:\5vjpv.exe39⤵
- Executes dropped EXE
PID:2832 -
\??\c:\xrflrxl.exec:\xrflrxl.exe40⤵
- Executes dropped EXE
PID:2884 -
\??\c:\7rrxxfr.exec:\7rrxxfr.exe41⤵
- Executes dropped EXE
PID:2848 -
\??\c:\nnthth.exec:\nnthth.exe42⤵
- Executes dropped EXE
PID:2596 -
\??\c:\vvppp.exec:\vvppp.exe43⤵
- Executes dropped EXE
PID:1932 -
\??\c:\lxlrxxr.exec:\lxlrxxr.exe44⤵
- Executes dropped EXE
PID:2200 -
\??\c:\nbttht.exec:\nbttht.exe45⤵
- Executes dropped EXE
PID:540 -
\??\c:\7pppp.exec:\7pppp.exe46⤵
- Executes dropped EXE
PID:1032 -
\??\c:\vpjvd.exec:\vpjvd.exe47⤵
- Executes dropped EXE
PID:548 -
\??\c:\frfrxxx.exec:\frfrxxx.exe48⤵
- Executes dropped EXE
PID:1428 -
\??\c:\bththn.exec:\bththn.exe49⤵
- Executes dropped EXE
PID:2904 -
\??\c:\ppjvj.exec:\ppjvj.exe50⤵
- Executes dropped EXE
PID:536 -
\??\c:\fxxflrl.exec:\fxxflrl.exe51⤵
- Executes dropped EXE
PID:2456 -
\??\c:\ffxlrff.exec:\ffxlrff.exe52⤵
- Executes dropped EXE
PID:2672 -
\??\c:\nhtbtb.exec:\nhtbtb.exe53⤵
- Executes dropped EXE
PID:1424 -
\??\c:\vvpvj.exec:\vvpvj.exe54⤵
- Executes dropped EXE
PID:2040 -
\??\c:\3frxlff.exec:\3frxlff.exe55⤵
- Executes dropped EXE
PID:2968 -
\??\c:\bnbnth.exec:\bnbnth.exe56⤵
- Executes dropped EXE
PID:2424 -
\??\c:\tnnbtb.exec:\tnnbtb.exe57⤵
- Executes dropped EXE
PID:2144 -
\??\c:\jpddj.exec:\jpddj.exe58⤵
- Executes dropped EXE
PID:2044 -
\??\c:\xrrlrfx.exec:\xrrlrfx.exe59⤵
- Executes dropped EXE
PID:1912 -
\??\c:\tnthht.exec:\tnthht.exe60⤵
- Executes dropped EXE
PID:2976 -
\??\c:\7dvdp.exec:\7dvdp.exe61⤵
- Executes dropped EXE
PID:316 -
\??\c:\lxrflrx.exec:\lxrflrx.exe62⤵
- Executes dropped EXE
PID:840 -
\??\c:\1ttnnh.exec:\1ttnnh.exe63⤵
- Executes dropped EXE
PID:1604 -
\??\c:\ddjdv.exec:\ddjdv.exe64⤵
- Executes dropped EXE
PID:2276 -
\??\c:\xxxxfxf.exec:\xxxxfxf.exe65⤵
- Executes dropped EXE
PID:2136 -
\??\c:\hhbbtt.exec:\hhbbtt.exe66⤵PID:2476
-
\??\c:\vpjvv.exec:\vpjvv.exe67⤵PID:1592
-
\??\c:\ffxxfxf.exec:\ffxxfxf.exe68⤵PID:2160
-
\??\c:\rlrfrxf.exec:\rlrfrxf.exe69⤵PID:900
-
\??\c:\5tbnbn.exec:\5tbnbn.exe70⤵PID:2996
-
\??\c:\vvvpv.exec:\vvvpv.exe71⤵PID:892
-
\??\c:\llffxrx.exec:\llffxrx.exe72⤵PID:2320
-
\??\c:\bhhhbn.exec:\bhhhbn.exe73⤵PID:1588
-
\??\c:\9hthnh.exec:\9hthnh.exe74⤵PID:2324
-
\??\c:\dvvdj.exec:\dvvdj.exe75⤵PID:1584
-
\??\c:\rrrfrfr.exec:\rrrfrfr.exe76⤵PID:2652
-
\??\c:\tnhtbh.exec:\tnhtbh.exe77⤵PID:2488
-
\??\c:\djpdd.exec:\djpdd.exe78⤵PID:2860
-
\??\c:\fxxxrlf.exec:\fxxxrlf.exe79⤵PID:2296
-
\??\c:\rxrxlrl.exec:\rxrxlrl.exe80⤵PID:3016
-
\??\c:\nnntbb.exec:\nnntbb.exe81⤵PID:2832
-
\??\c:\jvvpj.exec:\jvvpj.exe82⤵PID:2884
-
\??\c:\rxflffx.exec:\rxflffx.exe83⤵PID:1708
-
\??\c:\frlxrlr.exec:\frlxrlr.exe84⤵PID:2980
-
\??\c:\ttnbth.exec:\ttnbth.exe85⤵PID:2836
-
\??\c:\5jpvv.exec:\5jpvv.exe86⤵PID:2096
-
\??\c:\lxrxxfr.exec:\lxrxxfr.exe87⤵PID:644
-
\??\c:\btntbb.exec:\btntbb.exe88⤵PID:1624
-
\??\c:\nththb.exec:\nththb.exe89⤵PID:2900
-
\??\c:\jdvjp.exec:\jdvjp.exe90⤵PID:2956
-
\??\c:\7flrlfx.exec:\7flrlfx.exe91⤵PID:2820
-
\??\c:\bttbht.exec:\bttbht.exe92⤵PID:2972
-
\??\c:\vpjdp.exec:\vpjdp.exe93⤵PID:2868
-
\??\c:\5jdpv.exec:\5jdpv.exe94⤵PID:1940
-
\??\c:\llxrrfx.exec:\llxrrfx.exe95⤵PID:1944
-
\??\c:\9bnhbn.exec:\9bnhbn.exe96⤵PID:2924
-
\??\c:\1djvv.exec:\1djvv.exe97⤵PID:2612
-
\??\c:\1vpvj.exec:\1vpvj.exe98⤵PID:2920
-
\??\c:\rffxfrx.exec:\rffxfrx.exe99⤵PID:2424
-
\??\c:\tbhtbb.exec:\tbhtbb.exe100⤵PID:2132
-
\??\c:\vvdpj.exec:\vvdpj.exe101⤵PID:2044
-
\??\c:\vvjvp.exec:\vvjvp.exe102⤵PID:1916
-
\??\c:\xrlfllf.exec:\xrlfllf.exe103⤵PID:1840
-
\??\c:\nnhhht.exec:\nnhhht.exe104⤵PID:1600
-
\??\c:\dvddd.exec:\dvddd.exe105⤵PID:992
-
\??\c:\vpdjv.exec:\vpdjv.exe106⤵PID:1052
-
\??\c:\nbhhht.exec:\nbhhht.exe107⤵PID:1576
-
\??\c:\3hbbbb.exec:\3hbbbb.exe108⤵PID:3052
-
\??\c:\pppvp.exec:\pppvp.exe109⤵PID:1816
-
\??\c:\pppjv.exec:\pppjv.exe110⤵PID:1384
-
\??\c:\fxrflll.exec:\fxrflll.exe111⤵PID:2228
-
\??\c:\htbhnh.exec:\htbhnh.exe112⤵PID:1004
-
\??\c:\jjjdv.exec:\jjjdv.exe113⤵PID:1484
-
\??\c:\fffrlxr.exec:\fffrlxr.exe114⤵PID:2336
-
\??\c:\fxxfflx.exec:\fxxfflx.exe115⤵PID:3044
-
\??\c:\nhttbh.exec:\nhttbh.exe116⤵PID:2056
-
\??\c:\dvjvd.exec:\dvjvd.exe117⤵
- System Location Discovery: System Language Discovery
PID:764 -
\??\c:\vjvdp.exec:\vjvdp.exe118⤵PID:2764
-
\??\c:\rrflfxr.exec:\rrflfxr.exe119⤵PID:936
-
\??\c:\7bthbn.exec:\7bthbn.exe120⤵PID:1848
-
\??\c:\jddpj.exec:\jddpj.exe121⤵PID:2772
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-