Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 23:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b010cf987b58c4443e3016bc8fb17f4bfdca8822d4e89b2fbab7a782bd82e5deN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
b010cf987b58c4443e3016bc8fb17f4bfdca8822d4e89b2fbab7a782bd82e5deN.exe
-
Size
453KB
-
MD5
5ca8ae7dc84e9b099872a3a294845a00
-
SHA1
7fa0d97fe84b66897f0ebe34d0a13d704818f8c8
-
SHA256
b010cf987b58c4443e3016bc8fb17f4bfdca8822d4e89b2fbab7a782bd82e5de
-
SHA512
03e5d828918b458528b08a8c04130a3eb303d142389ba3c570f942c8b6f9962fd89b07bbf41d4abd4cfa3b522c7c1c2fada092604af4abebefd770b3bd60750c
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbef:q7Tc2NYHUrAwfMp3CDf
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/2756-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2560-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1724-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/560-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1700-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1720-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1720-98-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2152-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1720-102-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2880-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/544-156-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2188-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2232-174-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2232-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1560-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1228-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/632-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2072-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-373-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2640-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-379-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2888-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-426-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1968-506-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1968-507-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3028-575-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1536-582-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2680-604-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1616-655-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2832-669-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-677-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2160-710-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2260-791-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-816-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-831-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2804 xrllrxl.exe 2364 7nnbtt.exe 2632 1llxlll.exe 2680 ttbtnn.exe 2560 1dpvd.exe 1724 bhbhnt.exe 560 9ntbhn.exe 1700 rlxflrx.exe 2152 5tnthn.exe 1720 xxxfxlf.exe 3000 9ffrflx.exe 672 1vdpp.exe 2880 xrrxlrf.exe 2916 xxrflxl.exe 2988 bnhbnh.exe 544 3lllrxx.exe 2188 bttnbh.exe 2232 frffflr.exe 2392 tthntb.exe 1140 fxrrffl.exe 2380 xrllrxl.exe 1560 lflrxxl.exe 1228 3ththn.exe 1660 7rlxllf.exe 632 ffxrrfx.exe 2040 jjjpd.exe 2012 9lrxlxr.exe 1416 1dvjv.exe 2732 llffrrl.exe 2072 bbthtb.exe 2696 jppvp.exe 2668 bbtbhh.exe 2676 vvjpv.exe 2568 lfflxfr.exe 2572 3nhnbh.exe 2740 vpppd.exe 2544 pdppd.exe 2712 rrffrxf.exe 2532 nnntnn.exe 1252 ppvjv.exe 1404 1rllrxf.exe 2204 hnhhbb.exe 2640 pjvdp.exe 2888 djdjp.exe 700 flflffr.exe 848 hnhhhn.exe 2644 pdpdj.exe 2900 lfxxllx.exe 1444 ttthtt.exe 2836 pjjpd.exe 1784 5lxlrrf.exe 1840 xxflrxf.exe 2512 tbbnbh.exe 2404 lrxrrrx.exe 2376 fxrlfrr.exe 2392 btnthn.exe 2044 5jjvj.exe 1640 1fflxfr.exe 2492 llfrxfr.exe 1760 nttbtb.exe 2308 pppdj.exe 1968 xxlrlff.exe 1924 nbtnhh.exe 1052 vdvpv.exe -
resource yara_rule behavioral1/memory/2756-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/560-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/672-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1560-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1228-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/632-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1416-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-379-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2888-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/848-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1444-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1840-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-486-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-493-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/1968-506-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1536-553-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-575-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-583-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-597-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-604-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-655-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2832-662-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-669-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-677-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-710-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-717-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-791-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-817-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-816-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1000-824-0x0000000000430000-0x000000000045A000-memory.dmp upx behavioral1/memory/2808-831-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrrrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrxlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2756 wrote to memory of 2804 2756 b010cf987b58c4443e3016bc8fb17f4bfdca8822d4e89b2fbab7a782bd82e5deN.exe 31 PID 2756 wrote to memory of 2804 2756 b010cf987b58c4443e3016bc8fb17f4bfdca8822d4e89b2fbab7a782bd82e5deN.exe 31 PID 2756 wrote to memory of 2804 2756 b010cf987b58c4443e3016bc8fb17f4bfdca8822d4e89b2fbab7a782bd82e5deN.exe 31 PID 2756 wrote to memory of 2804 2756 b010cf987b58c4443e3016bc8fb17f4bfdca8822d4e89b2fbab7a782bd82e5deN.exe 31 PID 2804 wrote to memory of 2364 2804 xrllrxl.exe 32 PID 2804 wrote to memory of 2364 2804 xrllrxl.exe 32 PID 2804 wrote to memory of 2364 2804 xrllrxl.exe 32 PID 2804 wrote to memory of 2364 2804 xrllrxl.exe 32 PID 2364 wrote to memory of 2632 2364 7nnbtt.exe 33 PID 2364 wrote to memory of 2632 2364 7nnbtt.exe 33 PID 2364 wrote to memory of 2632 2364 7nnbtt.exe 33 PID 2364 wrote to memory of 2632 2364 7nnbtt.exe 33 PID 2632 wrote to memory of 2680 2632 1llxlll.exe 34 PID 2632 wrote to memory of 2680 2632 1llxlll.exe 34 PID 2632 wrote to memory of 2680 2632 1llxlll.exe 34 PID 2632 wrote to memory of 2680 2632 1llxlll.exe 34 PID 2680 wrote to memory of 2560 2680 ttbtnn.exe 35 PID 2680 wrote to memory of 2560 2680 ttbtnn.exe 35 PID 2680 wrote to memory of 2560 2680 ttbtnn.exe 35 PID 2680 wrote to memory of 2560 2680 ttbtnn.exe 35 PID 2560 wrote to memory of 1724 2560 1dpvd.exe 36 PID 2560 wrote to memory of 1724 2560 1dpvd.exe 36 PID 2560 wrote to memory of 1724 2560 1dpvd.exe 36 PID 2560 wrote to memory of 1724 2560 1dpvd.exe 36 PID 1724 wrote to memory of 560 1724 bhbhnt.exe 37 PID 1724 wrote to memory of 560 1724 bhbhnt.exe 37 PID 1724 wrote to memory of 560 1724 bhbhnt.exe 37 PID 1724 wrote to memory of 560 1724 bhbhnt.exe 37 PID 560 wrote to memory of 1700 560 9ntbhn.exe 38 PID 560 wrote to memory of 1700 560 9ntbhn.exe 38 PID 560 wrote to memory of 1700 560 9ntbhn.exe 38 PID 560 wrote to memory of 1700 560 9ntbhn.exe 38 PID 1700 wrote to memory of 2152 1700 rlxflrx.exe 39 PID 1700 wrote to memory of 2152 1700 rlxflrx.exe 39 PID 1700 wrote to memory of 2152 1700 rlxflrx.exe 39 PID 1700 wrote to memory of 2152 1700 rlxflrx.exe 39 PID 2152 wrote to memory of 1720 2152 5tnthn.exe 40 PID 2152 wrote to memory of 1720 2152 5tnthn.exe 40 PID 2152 wrote to memory of 1720 2152 5tnthn.exe 40 PID 2152 wrote to memory of 1720 2152 5tnthn.exe 40 PID 1720 wrote to memory of 3000 1720 xxxfxlf.exe 41 PID 1720 wrote to memory of 3000 1720 xxxfxlf.exe 41 PID 1720 wrote to memory of 3000 1720 xxxfxlf.exe 41 PID 1720 wrote to memory of 3000 1720 xxxfxlf.exe 41 PID 3000 wrote to memory of 672 3000 9ffrflx.exe 42 PID 3000 wrote to memory of 672 3000 9ffrflx.exe 42 PID 3000 wrote to memory of 672 3000 9ffrflx.exe 42 PID 3000 wrote to memory of 672 3000 9ffrflx.exe 42 PID 672 wrote to memory of 2880 672 1vdpp.exe 43 PID 672 wrote to memory of 2880 672 1vdpp.exe 43 PID 672 wrote to memory of 2880 672 1vdpp.exe 43 PID 672 wrote to memory of 2880 672 1vdpp.exe 43 PID 2880 wrote to memory of 2916 2880 xrrxlrf.exe 44 PID 2880 wrote to memory of 2916 2880 xrrxlrf.exe 44 PID 2880 wrote to memory of 2916 2880 xrrxlrf.exe 44 PID 2880 wrote to memory of 2916 2880 xrrxlrf.exe 44 PID 2916 wrote to memory of 2988 2916 xxrflxl.exe 45 PID 2916 wrote to memory of 2988 2916 xxrflxl.exe 45 PID 2916 wrote to memory of 2988 2916 xxrflxl.exe 45 PID 2916 wrote to memory of 2988 2916 xxrflxl.exe 45 PID 2988 wrote to memory of 544 2988 bnhbnh.exe 46 PID 2988 wrote to memory of 544 2988 bnhbnh.exe 46 PID 2988 wrote to memory of 544 2988 bnhbnh.exe 46 PID 2988 wrote to memory of 544 2988 bnhbnh.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\b010cf987b58c4443e3016bc8fb17f4bfdca8822d4e89b2fbab7a782bd82e5deN.exe"C:\Users\Admin\AppData\Local\Temp\b010cf987b58c4443e3016bc8fb17f4bfdca8822d4e89b2fbab7a782bd82e5deN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\xrllrxl.exec:\xrllrxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\7nnbtt.exec:\7nnbtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\1llxlll.exec:\1llxlll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\ttbtnn.exec:\ttbtnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\1dpvd.exec:\1dpvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\bhbhnt.exec:\bhbhnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\9ntbhn.exec:\9ntbhn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
\??\c:\rlxflrx.exec:\rlxflrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\5tnthn.exec:\5tnthn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\xxxfxlf.exec:\xxxfxlf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
\??\c:\9ffrflx.exec:\9ffrflx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\1vdpp.exec:\1vdpp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:672 -
\??\c:\xrrxlrf.exec:\xrrxlrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\xxrflxl.exec:\xxrflxl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\bnhbnh.exec:\bnhbnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\3lllrxx.exec:\3lllrxx.exe17⤵
- Executes dropped EXE
PID:544 -
\??\c:\bttnbh.exec:\bttnbh.exe18⤵
- Executes dropped EXE
PID:2188 -
\??\c:\frffflr.exec:\frffflr.exe19⤵
- Executes dropped EXE
PID:2232 -
\??\c:\tthntb.exec:\tthntb.exe20⤵
- Executes dropped EXE
PID:2392 -
\??\c:\fxrrffl.exec:\fxrrffl.exe21⤵
- Executes dropped EXE
PID:1140 -
\??\c:\xrllrxl.exec:\xrllrxl.exe22⤵
- Executes dropped EXE
PID:2380 -
\??\c:\lflrxxl.exec:\lflrxxl.exe23⤵
- Executes dropped EXE
PID:1560 -
\??\c:\3ththn.exec:\3ththn.exe24⤵
- Executes dropped EXE
PID:1228 -
\??\c:\7rlxllf.exec:\7rlxllf.exe25⤵
- Executes dropped EXE
PID:1660 -
\??\c:\ffxrrfx.exec:\ffxrrfx.exe26⤵
- Executes dropped EXE
PID:632 -
\??\c:\jjjpd.exec:\jjjpd.exe27⤵
- Executes dropped EXE
PID:2040 -
\??\c:\9lrxlxr.exec:\9lrxlxr.exe28⤵
- Executes dropped EXE
PID:2012 -
\??\c:\1dvjv.exec:\1dvjv.exe29⤵
- Executes dropped EXE
PID:1416 -
\??\c:\llffrrl.exec:\llffrrl.exe30⤵
- Executes dropped EXE
PID:2732 -
\??\c:\bbthtb.exec:\bbthtb.exe31⤵
- Executes dropped EXE
PID:2072 -
\??\c:\jppvp.exec:\jppvp.exe32⤵
- Executes dropped EXE
PID:2696 -
\??\c:\bbtbhh.exec:\bbtbhh.exe33⤵
- Executes dropped EXE
PID:2668 -
\??\c:\vvjpv.exec:\vvjpv.exe34⤵
- Executes dropped EXE
PID:2676 -
\??\c:\lfflxfr.exec:\lfflxfr.exe35⤵
- Executes dropped EXE
PID:2568 -
\??\c:\3nhnbh.exec:\3nhnbh.exe36⤵
- Executes dropped EXE
PID:2572 -
\??\c:\vpppd.exec:\vpppd.exe37⤵
- Executes dropped EXE
PID:2740 -
\??\c:\pdppd.exec:\pdppd.exe38⤵
- Executes dropped EXE
PID:2544 -
\??\c:\rrffrxf.exec:\rrffrxf.exe39⤵
- Executes dropped EXE
PID:2712 -
\??\c:\nnntnn.exec:\nnntnn.exe40⤵
- Executes dropped EXE
PID:2532 -
\??\c:\ppvjv.exec:\ppvjv.exe41⤵
- Executes dropped EXE
PID:1252 -
\??\c:\1rllrxf.exec:\1rllrxf.exe42⤵
- Executes dropped EXE
PID:1404 -
\??\c:\hnhhbb.exec:\hnhhbb.exe43⤵
- Executes dropped EXE
PID:2204 -
\??\c:\pjvdp.exec:\pjvdp.exe44⤵
- Executes dropped EXE
PID:2640 -
\??\c:\djdjp.exec:\djdjp.exe45⤵
- Executes dropped EXE
PID:2888 -
\??\c:\flflffr.exec:\flflffr.exe46⤵
- Executes dropped EXE
PID:700 -
\??\c:\hnhhhn.exec:\hnhhhn.exe47⤵
- Executes dropped EXE
PID:848 -
\??\c:\pdpdj.exec:\pdpdj.exe48⤵
- Executes dropped EXE
PID:2644 -
\??\c:\lfxxllx.exec:\lfxxllx.exe49⤵
- Executes dropped EXE
PID:2900 -
\??\c:\ttthtt.exec:\ttthtt.exe50⤵
- Executes dropped EXE
PID:1444 -
\??\c:\pjjpd.exec:\pjjpd.exe51⤵
- Executes dropped EXE
PID:2836 -
\??\c:\5lxlrrf.exec:\5lxlrrf.exe52⤵
- Executes dropped EXE
PID:1784 -
\??\c:\xxflrxf.exec:\xxflrxf.exe53⤵
- Executes dropped EXE
PID:1840 -
\??\c:\tbbnbh.exec:\tbbnbh.exe54⤵
- Executes dropped EXE
PID:2512 -
\??\c:\lrxrrrx.exec:\lrxrrrx.exe55⤵
- Executes dropped EXE
PID:2404 -
\??\c:\fxrlfrr.exec:\fxrlfrr.exe56⤵
- Executes dropped EXE
PID:2376 -
\??\c:\btnthn.exec:\btnthn.exe57⤵
- Executes dropped EXE
PID:2392 -
\??\c:\5jjvj.exec:\5jjvj.exe58⤵
- Executes dropped EXE
PID:2044 -
\??\c:\1fflxfr.exec:\1fflxfr.exe59⤵
- Executes dropped EXE
PID:1640 -
\??\c:\llfrxfr.exec:\llfrxfr.exe60⤵
- Executes dropped EXE
PID:2492 -
\??\c:\nttbtb.exec:\nttbtb.exe61⤵
- Executes dropped EXE
PID:1760 -
\??\c:\pppdj.exec:\pppdj.exe62⤵
- Executes dropped EXE
PID:2308 -
\??\c:\xxlrlff.exec:\xxlrlff.exe63⤵
- Executes dropped EXE
PID:1968 -
\??\c:\nbtnhh.exec:\nbtnhh.exe64⤵
- Executes dropped EXE
PID:1924 -
\??\c:\vdvpv.exec:\vdvpv.exe65⤵
- Executes dropped EXE
PID:1052 -
\??\c:\xlxxlrf.exec:\xlxxlrf.exe66⤵PID:2468
-
\??\c:\nnbtbb.exec:\nnbtbb.exe67⤵PID:2128
-
\??\c:\jvjpd.exec:\jvjpd.exe68⤵PID:2012
-
\??\c:\vddjv.exec:\vddjv.exe69⤵PID:1432
-
\??\c:\7nhnth.exec:\7nhnth.exe70⤵PID:1772
-
\??\c:\nhhhtt.exec:\nhhhtt.exe71⤵PID:1536
-
\??\c:\5vddd.exec:\5vddd.exe72⤵PID:1532
-
\??\c:\rrrxfxf.exec:\rrrxfxf.exe73⤵PID:3028
-
\??\c:\nhnhtn.exec:\nhnhtn.exe74⤵PID:2976
-
\??\c:\pvvdp.exec:\pvvdp.exe75⤵PID:1740
-
\??\c:\xlfffxr.exec:\xlfffxr.exe76⤵PID:2708
-
\??\c:\5nhnnn.exec:\5nhnnn.exe77⤵PID:2680
-
\??\c:\vvdvp.exec:\vvdvp.exe78⤵PID:2564
-
\??\c:\lrrxxrf.exec:\lrrxxrf.exe79⤵PID:2712
-
\??\c:\thtbnt.exec:\thtbnt.exe80⤵PID:648
-
\??\c:\vvvpj.exec:\vvvpj.exe81⤵PID:1124
-
\??\c:\pvddj.exec:\pvddj.exe82⤵PID:2148
-
\??\c:\fxfxllf.exec:\fxfxllf.exe83⤵PID:2140
-
\??\c:\nnhnbb.exec:\nnhnbb.exe84⤵PID:776
-
\??\c:\nnhtbh.exec:\nnhtbh.exe85⤵PID:1616
-
\??\c:\1vdjj.exec:\1vdjj.exe86⤵PID:2848
-
\??\c:\3fxflxf.exec:\3fxflxf.exe87⤵PID:2832
-
\??\c:\xrrxlrl.exec:\xrrxlrl.exe88⤵PID:2844
-
\??\c:\9hnbbn.exec:\9hnbbn.exe89⤵PID:2932
-
\??\c:\jjdpv.exec:\jjdpv.exe90⤵
- System Location Discovery: System Language Discovery
PID:2936 -
\??\c:\lxllrrr.exec:\lxllrrr.exe91⤵PID:2760
-
\??\c:\xrrxlrl.exec:\xrrxlrl.exe92⤵PID:996
-
\??\c:\tbhbhh.exec:\tbhbhh.exe93⤵PID:2160
-
\??\c:\dvjdp.exec:\dvjdp.exe94⤵PID:1884
-
\??\c:\fllfxrr.exec:\fllfxrr.exe95⤵PID:2512
-
\??\c:\nbhnth.exec:\nbhnth.exe96⤵PID:2056
-
\??\c:\bbbnht.exec:\bbbnht.exe97⤵PID:2480
-
\??\c:\pppdp.exec:\pppdp.exe98⤵PID:2516
-
\??\c:\rxrxlxl.exec:\rxrxlxl.exe99⤵PID:2044
-
\??\c:\1bbthn.exec:\1bbthn.exe100⤵PID:2180
-
\??\c:\nnhnnn.exec:\nnhnnn.exe101⤵PID:2492
-
\??\c:\pdjdv.exec:\pdjdv.exe102⤵PID:1464
-
\??\c:\rrrxrrf.exec:\rrrxrrf.exe103⤵PID:2184
-
\??\c:\bttnnn.exec:\bttnnn.exe104⤵PID:1660
-
\??\c:\jdjpj.exec:\jdjpj.exe105⤵PID:632
-
\??\c:\vpddp.exec:\vpddp.exe106⤵PID:2260
-
\??\c:\3xxflrx.exec:\3xxflrx.exe107⤵PID:1000
-
\??\c:\hnbbhb.exec:\hnbbhb.exe108⤵PID:880
-
\??\c:\djjpd.exec:\djjpd.exe109⤵PID:1580
-
\??\c:\ffxxrfl.exec:\ffxxrfl.exe110⤵PID:2164
-
\??\c:\dvddj.exec:\dvddj.exe111⤵PID:3068
-
\??\c:\fflrlrx.exec:\fflrlrx.exe112⤵PID:1892
-
\??\c:\vdpjv.exec:\vdpjv.exe113⤵PID:2808
-
\??\c:\lfllrll.exec:\lfllrll.exe114⤵PID:2668
-
\??\c:\xfrlrll.exec:\xfrlrll.exe115⤵PID:2796
-
\??\c:\9nnhtb.exec:\9nnhtb.exe116⤵PID:2840
-
\??\c:\jjpvv.exec:\jjpvv.exe117⤵PID:2656
-
\??\c:\rrxrrfx.exec:\rrxrrfx.exe118⤵PID:2664
-
\??\c:\tttbnb.exec:\tttbnb.exe119⤵PID:2816
-
\??\c:\pjvdp.exec:\pjvdp.exe120⤵PID:1260
-
\??\c:\5vpvd.exec:\5vpvd.exe121⤵PID:2996
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-