Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18-12-2024 04:03
Behavioral task
behavioral1
Sample
b146928b30228b12238fdb94b0ab8179518acff903bb31fb360b0189d2f2c7e7.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
b146928b30228b12238fdb94b0ab8179518acff903bb31fb360b0189d2f2c7e7.exe
-
Size
333KB
-
MD5
0ec537d5a7ff2301be0b68bf73f26562
-
SHA1
0a532336db28d622c9c5f1b270386985aa38d8d9
-
SHA256
b146928b30228b12238fdb94b0ab8179518acff903bb31fb360b0189d2f2c7e7
-
SHA512
13ba6de4cbf05c7ef841a901a6717c3f936459c07d13430b0cbe8f5e15de88675dfd7c0bee9fa51fbaac563e6effab3824d343d921936ad2acb38a4491fc4b2a
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeTq:R4wFHoSHYHUrAwfMp3CD+
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/2452-0-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2452-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2104-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1628-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2988-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2184-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2552-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2552-49-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2840-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2884-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2604-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2604-68-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2600-95-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2640-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2960-121-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/604-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/896-154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/996-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2324-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1996-186-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1996-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2512-195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1240-210-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1772-226-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2052-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1264-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2500-258-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2044-267-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1776-293-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1612-304-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2612-370-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2940-391-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/540-438-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1792-508-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1312-519-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1608-565-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1728-15420-0x0000000077340000-0x000000007745F000-memory.dmp family_blackmoon behavioral1/memory/1728-22603-0x0000000077340000-0x000000007745F000-memory.dmp family_blackmoon behavioral1/memory/1728-25924-0x0000000077340000-0x000000007745F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2104 jvjjv.exe 2988 xrrrfxl.exe 1628 nnntbh.exe 2184 5dpvj.exe 2552 frrffll.exe 2840 nbntbb.exe 2604 dvpjp.exe 2884 7xxfxff.exe 2824 bnhthh.exe 2600 ffffxxx.exe 1328 lfxfxfl.exe 2640 tnttnt.exe 2960 dvjjd.exe 604 rrlfrxf.exe 2932 nhnnbb.exe 2036 5pjjv.exe 896 fxxxllx.exe 996 3bnbtb.exe 1152 ppjdj.exe 2324 xxrxffl.exe 1996 bthhtt.exe 2512 fxrfrlr.exe 1132 7fxlxxl.exe 1240 7pjjj.exe 1084 5jdvv.exe 1772 frllfxf.exe 2564 bhntbt.exe 2052 lfxrlxl.exe 1264 3xfxfxf.exe 2500 vjpvj.exe 2044 rfxxflf.exe 1696 3tnthn.exe 884 pdddj.exe 2192 1pddv.exe 1776 3rlrxfr.exe 2388 tnntnn.exe 1612 3btbhh.exe 2408 dvvdp.exe 1856 ffrlxxf.exe 2468 lfrrxff.exe 2344 tnntht.exe 2724 3jjpp.exe 2748 3fxrflx.exe 2252 rlxflrx.exe 2728 hbtthn.exe 2856 7btttt.exe 2644 1jjpv.exe 1748 7frffrr.exe 2612 xxrrfrf.exe 2120 hbhtbn.exe 1328 vpdjv.exe 1924 lxxxxxl.exe 2940 9lxxfll.exe 2140 bnbhnn.exe 2984 dddjp.exe 1960 7jjjj.exe 2924 1xrlfxr.exe 1592 9nbbnt.exe 2780 nhtbbh.exe 2656 pjdvv.exe 2308 lfxflrf.exe 540 9bhntt.exe 2404 1tnthn.exe 856 dpjvd.exe -
resource yara_rule behavioral1/memory/2452-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2104-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000a00000001202a-7.dat upx behavioral1/memory/2452-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2104-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000800000001743a-16.dat upx behavioral1/memory/2988-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1628-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000900000001747d-26.dat upx behavioral1/memory/2988-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000017491-33.dat upx behavioral1/memory/2184-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2552-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000018669-42.dat upx behavioral1/files/0x001500000001866f-52.dat upx behavioral1/memory/2552-49-0x00000000003C0000-0x00000000003E7000-memory.dmp upx behavioral1/memory/2840-58-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0012000000018682-62.dat upx behavioral1/memory/2604-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2840-59-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2884-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000800000001868b-71.dat upx behavioral1/memory/2604-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000186f2-78.dat upx behavioral1/memory/2600-87-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001939d-88.dat upx behavioral1/memory/1328-96-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2600-95-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193a4-94.dat upx behavioral1/files/0x00050000000193ac-103.dat upx behavioral1/memory/2640-104-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001942c-112.dat upx behavioral1/memory/2640-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019438-120.dat upx behavioral1/memory/604-122-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2960-121-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019456-130.dat upx behavioral1/memory/604-129-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001945c-137.dat upx behavioral1/memory/2036-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019467-145.dat upx behavioral1/memory/896-152-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0005000000019496-153.dat upx behavioral1/memory/996-155-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/896-154-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194ad-163.dat upx behavioral1/memory/996-162-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194d0-171.dat upx behavioral1/files/0x00050000000194ef-179.dat upx behavioral1/memory/2324-178-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194fc-187.dat upx behavioral1/memory/1996-188-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019506-196.dat upx behavioral1/memory/2512-195-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000016dea-203.dat upx behavioral1/files/0x000500000001952f-211.dat upx behavioral1/files/0x000500000001957e-218.dat upx behavioral1/memory/1772-219-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195a7-227.dat upx behavioral1/memory/1772-226-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195e6-234.dat upx behavioral1/files/0x000500000001961d-243.dat upx behavioral1/memory/2052-242-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1264-250-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lrllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bntbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrlllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2452 wrote to memory of 2104 2452 b146928b30228b12238fdb94b0ab8179518acff903bb31fb360b0189d2f2c7e7.exe 30 PID 2452 wrote to memory of 2104 2452 b146928b30228b12238fdb94b0ab8179518acff903bb31fb360b0189d2f2c7e7.exe 30 PID 2452 wrote to memory of 2104 2452 b146928b30228b12238fdb94b0ab8179518acff903bb31fb360b0189d2f2c7e7.exe 30 PID 2452 wrote to memory of 2104 2452 b146928b30228b12238fdb94b0ab8179518acff903bb31fb360b0189d2f2c7e7.exe 30 PID 2104 wrote to memory of 2988 2104 jvjjv.exe 31 PID 2104 wrote to memory of 2988 2104 jvjjv.exe 31 PID 2104 wrote to memory of 2988 2104 jvjjv.exe 31 PID 2104 wrote to memory of 2988 2104 jvjjv.exe 31 PID 2988 wrote to memory of 1628 2988 xrrrfxl.exe 32 PID 2988 wrote to memory of 1628 2988 xrrrfxl.exe 32 PID 2988 wrote to memory of 1628 2988 xrrrfxl.exe 32 PID 2988 wrote to memory of 1628 2988 xrrrfxl.exe 32 PID 1628 wrote to memory of 2184 1628 nnntbh.exe 33 PID 1628 wrote to memory of 2184 1628 nnntbh.exe 33 PID 1628 wrote to memory of 2184 1628 nnntbh.exe 33 PID 1628 wrote to memory of 2184 1628 nnntbh.exe 33 PID 2184 wrote to memory of 2552 2184 5dpvj.exe 34 PID 2184 wrote to memory of 2552 2184 5dpvj.exe 34 PID 2184 wrote to memory of 2552 2184 5dpvj.exe 34 PID 2184 wrote to memory of 2552 2184 5dpvj.exe 34 PID 2552 wrote to memory of 2840 2552 frrffll.exe 35 PID 2552 wrote to memory of 2840 2552 frrffll.exe 35 PID 2552 wrote to memory of 2840 2552 frrffll.exe 35 PID 2552 wrote to memory of 2840 2552 frrffll.exe 35 PID 2840 wrote to memory of 2604 2840 nbntbb.exe 36 PID 2840 wrote to memory of 2604 2840 nbntbb.exe 36 PID 2840 wrote to memory of 2604 2840 nbntbb.exe 36 PID 2840 wrote to memory of 2604 2840 nbntbb.exe 36 PID 2604 wrote to memory of 2884 2604 dvpjp.exe 37 PID 2604 wrote to memory of 2884 2604 dvpjp.exe 37 PID 2604 wrote to memory of 2884 2604 dvpjp.exe 37 PID 2604 wrote to memory of 2884 2604 dvpjp.exe 37 PID 2884 wrote to memory of 2824 2884 7xxfxff.exe 38 PID 2884 wrote to memory of 2824 2884 7xxfxff.exe 38 PID 2884 wrote to memory of 2824 2884 7xxfxff.exe 38 PID 2884 wrote to memory of 2824 2884 7xxfxff.exe 38 PID 2824 wrote to memory of 2600 2824 bnhthh.exe 39 PID 2824 wrote to memory of 2600 2824 bnhthh.exe 39 PID 2824 wrote to memory of 2600 2824 bnhthh.exe 39 PID 2824 wrote to memory of 2600 2824 bnhthh.exe 39 PID 2600 wrote to memory of 1328 2600 ffffxxx.exe 40 PID 2600 wrote to memory of 1328 2600 ffffxxx.exe 40 PID 2600 wrote to memory of 1328 2600 ffffxxx.exe 40 PID 2600 wrote to memory of 1328 2600 ffffxxx.exe 40 PID 1328 wrote to memory of 2640 1328 lfxfxfl.exe 41 PID 1328 wrote to memory of 2640 1328 lfxfxfl.exe 41 PID 1328 wrote to memory of 2640 1328 lfxfxfl.exe 41 PID 1328 wrote to memory of 2640 1328 lfxfxfl.exe 41 PID 2640 wrote to memory of 2960 2640 tnttnt.exe 42 PID 2640 wrote to memory of 2960 2640 tnttnt.exe 42 PID 2640 wrote to memory of 2960 2640 tnttnt.exe 42 PID 2640 wrote to memory of 2960 2640 tnttnt.exe 42 PID 2960 wrote to memory of 604 2960 dvjjd.exe 43 PID 2960 wrote to memory of 604 2960 dvjjd.exe 43 PID 2960 wrote to memory of 604 2960 dvjjd.exe 43 PID 2960 wrote to memory of 604 2960 dvjjd.exe 43 PID 604 wrote to memory of 2932 604 rrlfrxf.exe 44 PID 604 wrote to memory of 2932 604 rrlfrxf.exe 44 PID 604 wrote to memory of 2932 604 rrlfrxf.exe 44 PID 604 wrote to memory of 2932 604 rrlfrxf.exe 44 PID 2932 wrote to memory of 2036 2932 nhnnbb.exe 45 PID 2932 wrote to memory of 2036 2932 nhnnbb.exe 45 PID 2932 wrote to memory of 2036 2932 nhnnbb.exe 45 PID 2932 wrote to memory of 2036 2932 nhnnbb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\b146928b30228b12238fdb94b0ab8179518acff903bb31fb360b0189d2f2c7e7.exe"C:\Users\Admin\AppData\Local\Temp\b146928b30228b12238fdb94b0ab8179518acff903bb31fb360b0189d2f2c7e7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\jvjjv.exec:\jvjjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\xrrrfxl.exec:\xrrrfxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\nnntbh.exec:\nnntbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\5dpvj.exec:\5dpvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\frrffll.exec:\frrffll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\nbntbb.exec:\nbntbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\dvpjp.exec:\dvpjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\7xxfxff.exec:\7xxfxff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\bnhthh.exec:\bnhthh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\ffffxxx.exec:\ffffxxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\lfxfxfl.exec:\lfxfxfl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
\??\c:\tnttnt.exec:\tnttnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\dvjjd.exec:\dvjjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\rrlfrxf.exec:\rrlfrxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:604 -
\??\c:\nhnnbb.exec:\nhnnbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\5pjjv.exec:\5pjjv.exe17⤵
- Executes dropped EXE
PID:2036 -
\??\c:\fxxxllx.exec:\fxxxllx.exe18⤵
- Executes dropped EXE
PID:896 -
\??\c:\3bnbtb.exec:\3bnbtb.exe19⤵
- Executes dropped EXE
PID:996 -
\??\c:\ppjdj.exec:\ppjdj.exe20⤵
- Executes dropped EXE
PID:1152 -
\??\c:\xxrxffl.exec:\xxrxffl.exe21⤵
- Executes dropped EXE
PID:2324 -
\??\c:\bthhtt.exec:\bthhtt.exe22⤵
- Executes dropped EXE
PID:1996 -
\??\c:\fxrfrlr.exec:\fxrfrlr.exe23⤵
- Executes dropped EXE
PID:2512 -
\??\c:\7fxlxxl.exec:\7fxlxxl.exe24⤵
- Executes dropped EXE
PID:1132 -
\??\c:\7pjjj.exec:\7pjjj.exe25⤵
- Executes dropped EXE
PID:1240 -
\??\c:\5jdvv.exec:\5jdvv.exe26⤵
- Executes dropped EXE
PID:1084 -
\??\c:\frllfxf.exec:\frllfxf.exe27⤵
- Executes dropped EXE
PID:1772 -
\??\c:\bhntbt.exec:\bhntbt.exe28⤵
- Executes dropped EXE
PID:2564 -
\??\c:\lfxrlxl.exec:\lfxrlxl.exe29⤵
- Executes dropped EXE
PID:2052 -
\??\c:\3xfxfxf.exec:\3xfxfxf.exe30⤵
- Executes dropped EXE
PID:1264 -
\??\c:\vjpvj.exec:\vjpvj.exe31⤵
- Executes dropped EXE
PID:2500 -
\??\c:\rfxxflf.exec:\rfxxflf.exe32⤵
- Executes dropped EXE
PID:2044 -
\??\c:\3tnthn.exec:\3tnthn.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1696 -
\??\c:\pdddj.exec:\pdddj.exe34⤵
- Executes dropped EXE
PID:884 -
\??\c:\1pddv.exec:\1pddv.exe35⤵
- Executes dropped EXE
PID:2192 -
\??\c:\3rlrxfr.exec:\3rlrxfr.exe36⤵
- Executes dropped EXE
PID:1776 -
\??\c:\tnntnn.exec:\tnntnn.exe37⤵
- Executes dropped EXE
PID:2388 -
\??\c:\3btbhh.exec:\3btbhh.exe38⤵
- Executes dropped EXE
PID:1612 -
\??\c:\dvvdp.exec:\dvvdp.exe39⤵
- Executes dropped EXE
PID:2408 -
\??\c:\ffrlxxf.exec:\ffrlxxf.exe40⤵
- Executes dropped EXE
PID:1856 -
\??\c:\lfrrxff.exec:\lfrrxff.exe41⤵
- Executes dropped EXE
PID:2468 -
\??\c:\tnntht.exec:\tnntht.exe42⤵
- Executes dropped EXE
PID:2344 -
\??\c:\3jjpp.exec:\3jjpp.exe43⤵
- Executes dropped EXE
PID:2724 -
\??\c:\3fxrflx.exec:\3fxrflx.exe44⤵
- Executes dropped EXE
PID:2748 -
\??\c:\rlxflrx.exec:\rlxflrx.exe45⤵
- Executes dropped EXE
PID:2252 -
\??\c:\hbtthn.exec:\hbtthn.exe46⤵
- Executes dropped EXE
PID:2728 -
\??\c:\7btttt.exec:\7btttt.exe47⤵
- Executes dropped EXE
PID:2856 -
\??\c:\1jjpv.exec:\1jjpv.exe48⤵
- Executes dropped EXE
PID:2644 -
\??\c:\7frffrr.exec:\7frffrr.exe49⤵
- Executes dropped EXE
PID:1748 -
\??\c:\xxrrfrf.exec:\xxrrfrf.exe50⤵
- Executes dropped EXE
PID:2612 -
\??\c:\hbhtbn.exec:\hbhtbn.exe51⤵
- Executes dropped EXE
PID:2120 -
\??\c:\vpdjv.exec:\vpdjv.exe52⤵
- Executes dropped EXE
PID:1328 -
\??\c:\lxxxxxl.exec:\lxxxxxl.exe53⤵
- Executes dropped EXE
PID:1924 -
\??\c:\9lxxfll.exec:\9lxxfll.exe54⤵
- Executes dropped EXE
PID:2940 -
\??\c:\bnbhnn.exec:\bnbhnn.exe55⤵
- Executes dropped EXE
PID:2140 -
\??\c:\dddjp.exec:\dddjp.exe56⤵
- Executes dropped EXE
PID:2984 -
\??\c:\7jjjj.exec:\7jjjj.exe57⤵
- Executes dropped EXE
PID:1960 -
\??\c:\1xrlfxr.exec:\1xrlfxr.exe58⤵
- Executes dropped EXE
PID:2924 -
\??\c:\9nbbnt.exec:\9nbbnt.exe59⤵
- Executes dropped EXE
PID:1592 -
\??\c:\nhtbbh.exec:\nhtbbh.exe60⤵
- Executes dropped EXE
PID:2780 -
\??\c:\pjdvv.exec:\pjdvv.exe61⤵
- Executes dropped EXE
PID:2656 -
\??\c:\lfxflrf.exec:\lfxflrf.exe62⤵
- Executes dropped EXE
PID:2308 -
\??\c:\9bhntt.exec:\9bhntt.exe63⤵
- Executes dropped EXE
PID:540 -
\??\c:\1tnthn.exec:\1tnthn.exe64⤵
- Executes dropped EXE
PID:2404 -
\??\c:\dpjvd.exec:\dpjvd.exe65⤵
- Executes dropped EXE
PID:856 -
\??\c:\rfxxlrr.exec:\rfxxlrr.exe66⤵PID:2056
-
\??\c:\frflllr.exec:\frflllr.exe67⤵PID:2512
-
\??\c:\nhtbhh.exec:\nhtbhh.exe68⤵PID:2108
-
\??\c:\jdppj.exec:\jdppj.exe69⤵PID:1644
-
\??\c:\vpjpd.exec:\vpjpd.exe70⤵PID:840
-
\??\c:\rfxfffl.exec:\rfxfffl.exe71⤵PID:1556
-
\??\c:\lfrfffx.exec:\lfrfffx.exe72⤵PID:1744
-
\??\c:\bthbnt.exec:\bthbnt.exe73⤵PID:1732
-
\??\c:\5djjp.exec:\5djjp.exe74⤵PID:916
-
\??\c:\9flrrrr.exec:\9flrrrr.exe75⤵PID:1792
-
\??\c:\llxxfrr.exec:\llxxfrr.exe76⤵PID:2676
-
\??\c:\bthnbb.exec:\bthnbb.exe77⤵PID:1312
-
\??\c:\3bhbht.exec:\3bhbht.exe78⤵PID:2228
-
\??\c:\pdjpp.exec:\pdjpp.exe79⤵PID:872
-
\??\c:\fxxxrfr.exec:\fxxxrfr.exe80⤵PID:2956
-
\??\c:\rrlxlxl.exec:\rrlxlxl.exe81⤵PID:1708
-
\??\c:\hbnthn.exec:\hbnthn.exe82⤵PID:1728
-
\??\c:\tbhhhb.exec:\tbhhhb.exe83⤵PID:1804
-
\??\c:\vvjpv.exec:\vvjpv.exe84⤵PID:2136
-
\??\c:\frllfrf.exec:\frllfrf.exe85⤵PID:2352
-
\??\c:\nnbntb.exec:\nnbntb.exe86⤵PID:1608
-
\??\c:\9ntttt.exec:\9ntttt.exe87⤵PID:1612
-
\??\c:\7vdjj.exec:\7vdjj.exe88⤵PID:2532
-
\??\c:\jvjjj.exec:\jvjjj.exe89⤵PID:1628
-
\??\c:\xrllrxf.exec:\xrllrxf.exe90⤵PID:2808
-
\??\c:\tnbbhh.exec:\tnbbhh.exe91⤵PID:2552
-
\??\c:\ntthhn.exec:\ntthhn.exe92⤵PID:2816
-
\??\c:\vvjdj.exec:\vvjdj.exe93⤵PID:2748
-
\??\c:\3dvvv.exec:\3dvvv.exe94⤵PID:2976
-
\??\c:\xrxllrx.exec:\xrxllrx.exe95⤵PID:2728
-
\??\c:\7xxrrxl.exec:\7xxrrxl.exe96⤵PID:2856
-
\??\c:\hbthnt.exec:\hbthnt.exe97⤵PID:2708
-
\??\c:\vvpvv.exec:\vvpvv.exe98⤵PID:1748
-
\??\c:\jvjjp.exec:\jvjjp.exe99⤵PID:2660
-
\??\c:\xlfflrf.exec:\xlfflrf.exe100⤵PID:1916
-
\??\c:\frfxffx.exec:\frfxffx.exe101⤵PID:2788
-
\??\c:\1htthh.exec:\1htthh.exe102⤵PID:2300
-
\??\c:\jdvdd.exec:\jdvdd.exe103⤵PID:2584
-
\??\c:\lfxrrrx.exec:\lfxrrrx.exe104⤵PID:596
-
\??\c:\xrfffxf.exec:\xrfffxf.exe105⤵PID:2952
-
\??\c:\bbttnh.exec:\bbttnh.exe106⤵PID:2900
-
\??\c:\1vjjd.exec:\1vjjd.exe107⤵
- System Location Discovery: System Language Discovery
PID:1688 -
\??\c:\jvjjp.exec:\jvjjp.exe108⤵PID:264
-
\??\c:\5xllrrf.exec:\5xllrrf.exe109⤵PID:1108
-
\??\c:\lflrxfr.exec:\lflrxfr.exe110⤵PID:1920
-
\??\c:\ttbnnn.exec:\ttbnnn.exe111⤵PID:1908
-
\??\c:\vpjjj.exec:\vpjjj.exe112⤵PID:2308
-
\??\c:\dvppp.exec:\dvppp.exe113⤵PID:2196
-
\??\c:\fxrrxxl.exec:\fxrrxxl.exe114⤵PID:2296
-
\??\c:\xlrrxlr.exec:\xlrrxlr.exe115⤵PID:2156
-
\??\c:\hbhhnh.exec:\hbhhnh.exe116⤵PID:1996
-
\??\c:\ppjjd.exec:\ppjjd.exe117⤵PID:2512
-
\??\c:\7djjp.exec:\7djjp.exe118⤵PID:620
-
\??\c:\lflllxl.exec:\lflllxl.exe119⤵PID:1240
-
\??\c:\3tnhnt.exec:\3tnhnt.exe120⤵PID:444
-
\??\c:\bththh.exec:\bththh.exe121⤵PID:1560
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-