Analysis
-
max time kernel
150s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
18-12-2024 10:30
Behavioral task
behavioral1
Sample
5efbb62d1a0268309fcd2508ef9fad903dab119118acef18c9a496cb59e0a433.exe
Resource
win7-20240729-en
windows7-x64
9 signatures
150 seconds
General
-
Target
5efbb62d1a0268309fcd2508ef9fad903dab119118acef18c9a496cb59e0a433.exe
-
Size
3.7MB
-
MD5
b2c4e5410373864a8694f5e3aaee1e21
-
SHA1
0bff784fd0b215a22414f6ab941a58f2ffbcd805
-
SHA256
5efbb62d1a0268309fcd2508ef9fad903dab119118acef18c9a496cb59e0a433
-
SHA512
6bc4bb815036cfa76b2cb531f99ecf5da4018ca831332203dca86ac461f7cd5c938cba73632d0f44bcdd0d792f947d051b2290bd5078000594372d580c714df2
-
SSDEEP
49152:gCOfN6X5tLLQTg20ITS/PPs/1kS4eKRL/SRsj0Zuur1T75YqVUrmNF98Q:U6XLq/qPPslzKx/dJg1ErmNJ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/2420-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2108-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2056-24-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2056-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2892-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2760-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2824-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2636-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2672-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1820-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/636-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2512-110-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2512-113-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2104-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1264-150-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1196-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2644-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2088-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2272-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2372-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2372-203-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1632-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1852-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/616-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2284-283-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2776-343-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3048-381-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2592-418-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2060-477-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2100-496-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2180-522-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1540-535-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/992-543-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1480-550-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2092-551-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2028-603-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2028-606-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2068-691-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2148-725-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2648-807-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2288-902-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2288-900-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon -
Njrat family
-
Executes dropped EXE 64 IoCs
pid Process 2108 5vjpd.exe 2056 flrxlxl.exe 2892 xfxfflr.exe 1528 lxrflxx.exe 2760 xxxlxrl.exe 2824 1pdjv.exe 2672 1pdpv.exe 2636 llxlxlx.exe 1820 rlflrfl.exe 636 bbtbnn.exe 2512 tthnbn.exe 372 xrlrrlr.exe 1376 rllfrfr.exe 2104 jpvpv.exe 576 bthnth.exe 1264 3nthnt.exe 1196 vvjpv.exe 2644 bbttbt.exe 2088 xfrrfrl.exe 2272 pddjv.exe 2372 1thtbh.exe 2076 hnnnhb.exe 1632 tbbhth.exe 1896 dvpvd.exe 1852 1vdpp.exe 2336 7pdpv.exe 616 hbntnb.exe 1696 llllrll.exe 924 xfxxrfx.exe 2400 xfffrlr.exe 2284 djdpv.exe 2380 vvdpd.exe 2496 xlxrfrf.exe 2580 jpvvp.exe 2584 rxflrfr.exe 2844 jpvjp.exe 2804 7vjvd.exe 2056 bhnbht.exe 2876 lfxxrxr.exe 2776 1rxxrxr.exe 2884 dddpd.exe 2828 ppdvj.exe 2656 bhnbbh.exe 2724 rflffxx.exe 3048 ffxxxll.exe 832 pvdpd.exe 2540 9jvjv.exe 2068 ntbnth.exe 1908 rrlrllx.exe 300 xlfrlrf.exe 1692 vjddd.exe 2592 vvjvj.exe 2452 bbtthh.exe 1724 lrlxlfr.exe 2384 lrlrfrf.exe 1792 jjjjd.exe 1572 nnbttb.exe 1256 htnhnh.exe 2152 xrllxlr.exe 2060 jvjpp.exe 1484 5vjvd.exe 1136 bnbthb.exe 2064 3nhthn.exe 2100 fllfxfx.exe -
resource yara_rule behavioral1/memory/2420-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000120fd-5.dat upx behavioral1/memory/2108-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2420-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2108-13-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0008000000016ae9-17.dat upx behavioral1/memory/2108-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2056-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016be9-30.dat upx behavioral1/memory/2056-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2892-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00300000000162f6-39.dat upx behavioral1/files/0x0008000000016c66-47.dat upx behavioral1/files/0x0007000000016c75-56.dat upx behavioral1/memory/2760-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2824-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016ce4-66.dat upx behavioral1/memory/2636-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016cff-76.dat upx behavioral1/memory/2672-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016dc9-84.dat upx behavioral1/memory/1820-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/636-95-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019374-94.dat upx behavioral1/files/0x000500000001939b-103.dat upx behavioral1/memory/636-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193b3-111.dat upx behavioral1/memory/2512-113-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193b5-121.dat upx behavioral1/memory/1376-122-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193e8-129.dat upx behavioral1/memory/2104-132-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193f7-141.dat upx behavioral1/memory/2104-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1264-150-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001949e-149.dat upx behavioral1/files/0x00050000000194c4-159.dat upx behavioral1/memory/1196-160-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2644-169-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194cd-167.dat upx behavioral1/files/0x00050000000194d2-176.dat upx behavioral1/memory/2088-178-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2272-187-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194db-186.dat upx behavioral1/files/0x00050000000194e3-194.dat upx behavioral1/memory/2372-196-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194e7-205.dat upx behavioral1/files/0x00050000000194e9-212.dat upx behavioral1/memory/1632-220-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194ef-221.dat upx behavioral1/files/0x00050000000194f3-230.dat upx behavioral1/files/0x0005000000019524-240.dat upx behavioral1/memory/1852-239-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001954e-248.dat upx behavioral1/memory/616-250-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001956c-257.dat upx behavioral1/files/0x0005000000019570-265.dat upx behavioral1/files/0x000500000001958e-274.dat upx behavioral1/files/0x00050000000195d6-281.dat upx behavioral1/memory/2284-283-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019604-290.dat upx behavioral1/memory/2580-304-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2844-317-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2056-330-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflfxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntthbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1thtbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfrflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllxfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xrxxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnttbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntttht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rllxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxxrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxrlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bththn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ttbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rrllfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfrllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxlfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tntbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnntbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nhthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbttbn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2420 wrote to memory of 2108 2420 5efbb62d1a0268309fcd2508ef9fad903dab119118acef18c9a496cb59e0a433.exe 29 PID 2420 wrote to memory of 2108 2420 5efbb62d1a0268309fcd2508ef9fad903dab119118acef18c9a496cb59e0a433.exe 29 PID 2420 wrote to memory of 2108 2420 5efbb62d1a0268309fcd2508ef9fad903dab119118acef18c9a496cb59e0a433.exe 29 PID 2420 wrote to memory of 2108 2420 5efbb62d1a0268309fcd2508ef9fad903dab119118acef18c9a496cb59e0a433.exe 29 PID 2108 wrote to memory of 2056 2108 5vjpd.exe 30 PID 2108 wrote to memory of 2056 2108 5vjpd.exe 30 PID 2108 wrote to memory of 2056 2108 5vjpd.exe 30 PID 2108 wrote to memory of 2056 2108 5vjpd.exe 30 PID 2056 wrote to memory of 2892 2056 flrxlxl.exe 31 PID 2056 wrote to memory of 2892 2056 flrxlxl.exe 31 PID 2056 wrote to memory of 2892 2056 flrxlxl.exe 31 PID 2056 wrote to memory of 2892 2056 flrxlxl.exe 31 PID 2892 wrote to memory of 1528 2892 xfxfflr.exe 32 PID 2892 wrote to memory of 1528 2892 xfxfflr.exe 32 PID 2892 wrote to memory of 1528 2892 xfxfflr.exe 32 PID 2892 wrote to memory of 1528 2892 xfxfflr.exe 32 PID 1528 wrote to memory of 2760 1528 lxrflxx.exe 33 PID 1528 wrote to memory of 2760 1528 lxrflxx.exe 33 PID 1528 wrote to memory of 2760 1528 lxrflxx.exe 33 PID 1528 wrote to memory of 2760 1528 lxrflxx.exe 33 PID 2760 wrote to memory of 2824 2760 xxxlxrl.exe 34 PID 2760 wrote to memory of 2824 2760 xxxlxrl.exe 34 PID 2760 wrote to memory of 2824 2760 xxxlxrl.exe 34 PID 2760 wrote to memory of 2824 2760 xxxlxrl.exe 34 PID 2824 wrote to memory of 2672 2824 1pdjv.exe 35 PID 2824 wrote to memory of 2672 2824 1pdjv.exe 35 PID 2824 wrote to memory of 2672 2824 1pdjv.exe 35 PID 2824 wrote to memory of 2672 2824 1pdjv.exe 35 PID 2672 wrote to memory of 2636 2672 1pdpv.exe 36 PID 2672 wrote to memory of 2636 2672 1pdpv.exe 36 PID 2672 wrote to memory of 2636 2672 1pdpv.exe 36 PID 2672 wrote to memory of 2636 2672 1pdpv.exe 36 PID 2636 wrote to memory of 1820 2636 llxlxlx.exe 37 PID 2636 wrote to memory of 1820 2636 llxlxlx.exe 37 PID 2636 wrote to memory of 1820 2636 llxlxlx.exe 37 PID 2636 wrote to memory of 1820 2636 llxlxlx.exe 37 PID 1820 wrote to memory of 636 1820 rlflrfl.exe 38 PID 1820 wrote to memory of 636 1820 rlflrfl.exe 38 PID 1820 wrote to memory of 636 1820 rlflrfl.exe 38 PID 1820 wrote to memory of 636 1820 rlflrfl.exe 38 PID 636 wrote to memory of 2512 636 bbtbnn.exe 39 PID 636 wrote to memory of 2512 636 bbtbnn.exe 39 PID 636 wrote to memory of 2512 636 bbtbnn.exe 39 PID 636 wrote to memory of 2512 636 bbtbnn.exe 39 PID 2512 wrote to memory of 372 2512 tthnbn.exe 40 PID 2512 wrote to memory of 372 2512 tthnbn.exe 40 PID 2512 wrote to memory of 372 2512 tthnbn.exe 40 PID 2512 wrote to memory of 372 2512 tthnbn.exe 40 PID 372 wrote to memory of 1376 372 xrlrrlr.exe 41 PID 372 wrote to memory of 1376 372 xrlrrlr.exe 41 PID 372 wrote to memory of 1376 372 xrlrrlr.exe 41 PID 372 wrote to memory of 1376 372 xrlrrlr.exe 41 PID 1376 wrote to memory of 2104 1376 rllfrfr.exe 42 PID 1376 wrote to memory of 2104 1376 rllfrfr.exe 42 PID 1376 wrote to memory of 2104 1376 rllfrfr.exe 42 PID 1376 wrote to memory of 2104 1376 rllfrfr.exe 42 PID 2104 wrote to memory of 576 2104 jpvpv.exe 43 PID 2104 wrote to memory of 576 2104 jpvpv.exe 43 PID 2104 wrote to memory of 576 2104 jpvpv.exe 43 PID 2104 wrote to memory of 576 2104 jpvpv.exe 43 PID 576 wrote to memory of 1264 576 bthnth.exe 44 PID 576 wrote to memory of 1264 576 bthnth.exe 44 PID 576 wrote to memory of 1264 576 bthnth.exe 44 PID 576 wrote to memory of 1264 576 bthnth.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\5efbb62d1a0268309fcd2508ef9fad903dab119118acef18c9a496cb59e0a433.exe"C:\Users\Admin\AppData\Local\Temp\5efbb62d1a0268309fcd2508ef9fad903dab119118acef18c9a496cb59e0a433.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\5vjpd.exec:\5vjpd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\flrxlxl.exec:\flrxlxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\xfxfflr.exec:\xfxfflr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\lxrflxx.exec:\lxrflxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\xxxlxrl.exec:\xxxlxrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\1pdjv.exec:\1pdjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\1pdpv.exec:\1pdpv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\llxlxlx.exec:\llxlxlx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\rlflrfl.exec:\rlflrfl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\bbtbnn.exec:\bbtbnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
\??\c:\tthnbn.exec:\tthnbn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\xrlrrlr.exec:\xrlrrlr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:372 -
\??\c:\rllfrfr.exec:\rllfrfr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
\??\c:\jpvpv.exec:\jpvpv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\bthnth.exec:\bthnth.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:576 -
\??\c:\3nthnt.exec:\3nthnt.exe17⤵
- Executes dropped EXE
PID:1264 -
\??\c:\vvjpv.exec:\vvjpv.exe18⤵
- Executes dropped EXE
PID:1196 -
\??\c:\bbttbt.exec:\bbttbt.exe19⤵
- Executes dropped EXE
PID:2644 -
\??\c:\xfrrfrl.exec:\xfrrfrl.exe20⤵
- Executes dropped EXE
PID:2088 -
\??\c:\pddjv.exec:\pddjv.exe21⤵
- Executes dropped EXE
PID:2272 -
\??\c:\1thtbh.exec:\1thtbh.exe22⤵
- Executes dropped EXE
PID:2372 -
\??\c:\hnnnhb.exec:\hnnnhb.exe23⤵
- Executes dropped EXE
PID:2076 -
\??\c:\tbbhth.exec:\tbbhth.exe24⤵
- Executes dropped EXE
PID:1632 -
\??\c:\dvpvd.exec:\dvpvd.exe25⤵
- Executes dropped EXE
PID:1896 -
\??\c:\1vdpp.exec:\1vdpp.exe26⤵
- Executes dropped EXE
PID:1852 -
\??\c:\7pdpv.exec:\7pdpv.exe27⤵
- Executes dropped EXE
PID:2336 -
\??\c:\hbntnb.exec:\hbntnb.exe28⤵
- Executes dropped EXE
PID:616 -
\??\c:\llllrll.exec:\llllrll.exe29⤵
- Executes dropped EXE
PID:1696 -
\??\c:\xfxxrfx.exec:\xfxxrfx.exe30⤵
- Executes dropped EXE
PID:924 -
\??\c:\xfffrlr.exec:\xfffrlr.exe31⤵
- Executes dropped EXE
PID:2400 -
\??\c:\djdpv.exec:\djdpv.exe32⤵
- Executes dropped EXE
PID:2284 -
\??\c:\vvdpd.exec:\vvdpd.exe33⤵
- Executes dropped EXE
PID:2380 -
\??\c:\xlxrfrf.exec:\xlxrfrf.exe34⤵
- Executes dropped EXE
PID:2496 -
\??\c:\jpvvp.exec:\jpvvp.exe35⤵
- Executes dropped EXE
PID:2580 -
\??\c:\rxflrfr.exec:\rxflrfr.exe36⤵
- Executes dropped EXE
PID:2584 -
\??\c:\jpvjp.exec:\jpvjp.exe37⤵
- Executes dropped EXE
PID:2844 -
\??\c:\7vjvd.exec:\7vjvd.exe38⤵
- Executes dropped EXE
PID:2804 -
\??\c:\bhnbht.exec:\bhnbht.exe39⤵
- Executes dropped EXE
PID:2056 -
\??\c:\lfxxrxr.exec:\lfxxrxr.exe40⤵
- Executes dropped EXE
PID:2876 -
\??\c:\1rxxrxr.exec:\1rxxrxr.exe41⤵
- Executes dropped EXE
PID:2776 -
\??\c:\dddpd.exec:\dddpd.exe42⤵
- Executes dropped EXE
PID:2884 -
\??\c:\ppdvj.exec:\ppdvj.exe43⤵
- Executes dropped EXE
PID:2828 -
\??\c:\bhnbbh.exec:\bhnbbh.exe44⤵
- Executes dropped EXE
PID:2656 -
\??\c:\rflffxx.exec:\rflffxx.exe45⤵
- Executes dropped EXE
PID:2724 -
\??\c:\ffxxxll.exec:\ffxxxll.exe46⤵
- Executes dropped EXE
PID:3048 -
\??\c:\pvdpd.exec:\pvdpd.exe47⤵
- Executes dropped EXE
PID:832 -
\??\c:\9jvjv.exec:\9jvjv.exe48⤵
- Executes dropped EXE
PID:2540 -
\??\c:\ntbnth.exec:\ntbnth.exe49⤵
- Executes dropped EXE
PID:2068 -
\??\c:\rrlrllx.exec:\rrlrllx.exe50⤵
- Executes dropped EXE
PID:1908 -
\??\c:\xlfrlrf.exec:\xlfrlrf.exe51⤵
- Executes dropped EXE
PID:300 -
\??\c:\vjddd.exec:\vjddd.exe52⤵
- Executes dropped EXE
PID:1692 -
\??\c:\vvjvj.exec:\vvjvj.exe53⤵
- Executes dropped EXE
PID:2592 -
\??\c:\bbtthh.exec:\bbtthh.exe54⤵
- Executes dropped EXE
PID:2452 -
\??\c:\lrlxlfr.exec:\lrlxlfr.exe55⤵
- Executes dropped EXE
PID:1724 -
\??\c:\lrlrfrf.exec:\lrlrfrf.exe56⤵
- Executes dropped EXE
PID:2384 -
\??\c:\jjjjd.exec:\jjjjd.exe57⤵
- Executes dropped EXE
PID:1792 -
\??\c:\nnbttb.exec:\nnbttb.exe58⤵
- Executes dropped EXE
PID:1572 -
\??\c:\htnhnh.exec:\htnhnh.exe59⤵
- Executes dropped EXE
PID:1256 -
\??\c:\xrllxlr.exec:\xrllxlr.exe60⤵
- Executes dropped EXE
PID:2152 -
\??\c:\jvjpp.exec:\jvjpp.exe61⤵
- Executes dropped EXE
PID:2060 -
\??\c:\5vjvd.exec:\5vjvd.exe62⤵
- Executes dropped EXE
PID:1484 -
\??\c:\bnbthb.exec:\bnbthb.exe63⤵
- Executes dropped EXE
PID:1136 -
\??\c:\3nhthn.exec:\3nhthn.exe64⤵
- Executes dropped EXE
PID:2064 -
\??\c:\fllfxfx.exec:\fllfxfx.exe65⤵
- Executes dropped EXE
PID:2100 -
\??\c:\pjpdp.exec:\pjpdp.exe66⤵PID:2552
-
\??\c:\5thtth.exec:\5thtth.exe67⤵PID:2980
-
\??\c:\ntbhnb.exec:\ntbhnb.exe68⤵PID:1896
-
\??\c:\9fflflr.exec:\9fflflr.exe69⤵PID:2180
-
\??\c:\1xlrflr.exec:\1xlrflr.exe70⤵PID:1540
-
\??\c:\3jdpv.exec:\3jdpv.exe71⤵PID:992
-
\??\c:\hnnnbh.exec:\hnnnbh.exe72⤵PID:1480
-
\??\c:\9hhbnb.exec:\9hhbnb.exe73⤵PID:2092
-
\??\c:\llxrxxl.exec:\llxrxxl.exe74⤵PID:1532
-
\??\c:\vvpdp.exec:\vvpdp.exe75⤵PID:1180
-
\??\c:\hntbht.exec:\hntbht.exe76⤵PID:388
-
\??\c:\ttbnht.exec:\ttbnht.exe77⤵PID:1936
-
\??\c:\llxlfrf.exec:\llxlfrf.exe78⤵PID:2144
-
\??\c:\fxfflrx.exec:\fxfflrx.exe79⤵PID:1664
-
\??\c:\9dddp.exec:\9dddp.exe80⤵PID:580
-
\??\c:\tthnnn.exec:\tthnnn.exe81⤵PID:2028
-
\??\c:\rxlxfrx.exec:\rxlxfrx.exe82⤵PID:2872
-
\??\c:\1xfrlxl.exec:\1xfrlxl.exe83⤵PID:2800
-
\??\c:\jpjvd.exec:\jpjvd.exe84⤵PID:2852
-
\??\c:\btnnnh.exec:\btnnnh.exe85⤵PID:2972
-
\??\c:\9bbbht.exec:\9bbbht.exe86⤵PID:2688
-
\??\c:\xflfxlf.exec:\xflfxlf.exe87⤵PID:304
-
\??\c:\vvdpv.exec:\vvdpv.exe88⤵PID:2680
-
\??\c:\vddjv.exec:\vddjv.exe89⤵PID:3052
-
\??\c:\llrxflr.exec:\llrxflr.exe90⤵PID:568
-
\??\c:\7rrlrfx.exec:\7rrlrfx.exe91⤵PID:2160
-
\??\c:\vvjvd.exec:\vvjvd.exe92⤵PID:3032
-
\??\c:\ttbbnn.exec:\ttbbnn.exe93⤵PID:2068
-
\??\c:\tbbhnb.exec:\tbbhnb.exe94⤵PID:484
-
\??\c:\5xflxlx.exec:\5xflxlx.exe95⤵PID:300
-
\??\c:\vdpvd.exec:\vdpvd.exe96⤵PID:1692
-
\??\c:\jjvdj.exec:\jjvdj.exe97⤵PID:2560
-
\??\c:\9tntnt.exec:\9tntnt.exe98⤵PID:1004
-
\??\c:\xrrfrfr.exec:\xrrfrfr.exe99⤵PID:2148
-
\??\c:\xfxlrrl.exec:\xfxlrrl.exe100⤵PID:2384
-
\??\c:\1dpdv.exec:\1dpdv.exe101⤵PID:1156
-
\??\c:\hhhtht.exec:\hhhtht.exe102⤵PID:1752
-
\??\c:\flxxflr.exec:\flxxflr.exe103⤵PID:584
-
\??\c:\rrrllrf.exec:\rrrllrf.exe104⤵PID:2232
-
\??\c:\5jvvd.exec:\5jvvd.exe105⤵PID:2360
-
\??\c:\1thtbn.exec:\1thtbn.exe106⤵
- System Location Discovery: System Language Discovery
PID:2492 -
\??\c:\llrrxlx.exec:\llrrxlx.exe107⤵PID:1748
-
\??\c:\xxrxlxf.exec:\xxrxlxf.exe108⤵PID:1604
-
\??\c:\vpjjv.exec:\vpjjv.exe109⤵PID:664
-
\??\c:\hnhntb.exec:\hnhntb.exe110⤵PID:1632
-
\??\c:\nnttnt.exec:\nnttnt.exe111⤵
- System Location Discovery: System Language Discovery
PID:2648 -
\??\c:\frxlxrx.exec:\frxlxrx.exe112⤵PID:828
-
\??\c:\5jjpv.exec:\5jjpv.exe113⤵
- System Location Discovery: System Language Discovery
PID:2248 -
\??\c:\3ddpv.exec:\3ddpv.exe114⤵PID:836
-
\??\c:\nnttbh.exec:\nnttbh.exe115⤵PID:1708
-
\??\c:\7xlxrfr.exec:\7xlxrfr.exe116⤵PID:2632
-
\??\c:\xxlxlxx.exec:\xxlxlxx.exe117⤵PID:924
-
\??\c:\jjddj.exec:\jjddj.exe118⤵
- System Location Discovery: System Language Discovery
PID:1172 -
\??\c:\bbthnb.exec:\bbthnb.exe119⤵PID:1532
-
\??\c:\thtnht.exec:\thtnht.exe120⤵PID:1888
-
\??\c:\xfrlxlr.exec:\xfrlxlr.exe121⤵PID:1636
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-