Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 23:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0d020facf2bfe69125543fff52825c68a16671a2201acc3e20c4eb549c20fc92N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
0d020facf2bfe69125543fff52825c68a16671a2201acc3e20c4eb549c20fc92N.exe
-
Size
453KB
-
MD5
6faa190b65fbd925c6ee7b31bc25eba0
-
SHA1
17c96ad75b13b2f54bafa788d6af7ff24ccd659b
-
SHA256
0d020facf2bfe69125543fff52825c68a16671a2201acc3e20c4eb549c20fc92
-
SHA512
e5d3259c9b0c07a8cb2c07f4ebed9b33fff3838a4f7068c4b616105770d98c6196c12fab595eb53143e9c57ccea3912b044eb8030a4551dc97e461fb841507ab
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeM:q7Tc2NYHUrAwfMp3CDM
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/2840-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2256-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1608-73-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/1416-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1416-87-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2020-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1040-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1076-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2496-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1272-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2032-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1748-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2284-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2316-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-343-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2828-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-393-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2648-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/836-423-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/836-430-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2028-437-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/352-462-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/352-465-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2008-483-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2196-490-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-543-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2488-544-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-569-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-687-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-727-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-894-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1696-1004-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2256 ttnhbn.exe 2804 3vpvd.exe 2676 3llflrf.exe 2668 1bbhhh.exe 2572 dvvdv.exe 2828 frlrflf.exe 1608 1nnbth.exe 3036 5vpvd.exe 1416 hhhnbh.exe 3012 vpdjp.exe 2020 nnbbbb.exe 2028 ffffxxr.exe 1040 rlfrffr.exe 1076 fllxrlx.exe 2640 tnbbhh.exe 2884 rxfrrfx.exe 2204 bhhhhh.exe 2496 lrfrrll.exe 1600 nthnhn.exe 2996 rrxrlxf.exe 2988 bhhbnh.exe 932 pvpvv.exe 884 fxxlxff.exe 1272 bhthth.exe 1748 7xlxfxf.exe 2032 jjpdv.exe 2500 rlxrlxx.exe 2284 5bnthn.exe 2932 1flrffx.exe 2316 dddpj.exe 1836 xfrllff.exe 2948 dvvjv.exe 2692 djjjd.exe 1540 tbnhnb.exe 2812 jvpdp.exe 2748 9dpvd.exe 2772 rlxxrll.exe 2696 hbbhtb.exe 2688 jjjdv.exe 2664 fxrrflx.exe 2828 nntnhb.exe 2600 jddjp.exe 1160 xxrfxlr.exe 2796 lrrxrxx.exe 2924 hbnnbb.exe 1932 7vjjp.exe 2648 rllrfrx.exe 2512 tbhnbh.exe 2028 1tntbb.exe 2348 dddjv.exe 864 fffxxxx.exe 836 3bhnnt.exe 2880 7ddjv.exe 1412 lfxrxxl.exe 1424 xrfxflr.exe 2128 hbbbnt.exe 2392 jvvpj.exe 352 lrrlxlf.exe 1796 xrrxrxl.exe 2008 5tbnnb.exe 2196 5dpvj.exe 1016 9xrxrfx.exe 2436 nnbbnn.exe 824 ddjpp.exe -
resource yara_rule behavioral1/memory/2840-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1416-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1416-87-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2028-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1076-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1040-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1076-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1272-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/836-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/836-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-437-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/352-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-483-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1016-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-544-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-569-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-660-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-687-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-727-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-823-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-869-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-933-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-972-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrflrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7llfxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rlrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ppdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fxfllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rrxlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbbnh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2840 wrote to memory of 2256 2840 0d020facf2bfe69125543fff52825c68a16671a2201acc3e20c4eb549c20fc92N.exe 30 PID 2840 wrote to memory of 2256 2840 0d020facf2bfe69125543fff52825c68a16671a2201acc3e20c4eb549c20fc92N.exe 30 PID 2840 wrote to memory of 2256 2840 0d020facf2bfe69125543fff52825c68a16671a2201acc3e20c4eb549c20fc92N.exe 30 PID 2840 wrote to memory of 2256 2840 0d020facf2bfe69125543fff52825c68a16671a2201acc3e20c4eb549c20fc92N.exe 30 PID 2256 wrote to memory of 2804 2256 ttnhbn.exe 31 PID 2256 wrote to memory of 2804 2256 ttnhbn.exe 31 PID 2256 wrote to memory of 2804 2256 ttnhbn.exe 31 PID 2256 wrote to memory of 2804 2256 ttnhbn.exe 31 PID 2804 wrote to memory of 2676 2804 3vpvd.exe 32 PID 2804 wrote to memory of 2676 2804 3vpvd.exe 32 PID 2804 wrote to memory of 2676 2804 3vpvd.exe 32 PID 2804 wrote to memory of 2676 2804 3vpvd.exe 32 PID 2676 wrote to memory of 2668 2676 3llflrf.exe 33 PID 2676 wrote to memory of 2668 2676 3llflrf.exe 33 PID 2676 wrote to memory of 2668 2676 3llflrf.exe 33 PID 2676 wrote to memory of 2668 2676 3llflrf.exe 33 PID 2668 wrote to memory of 2572 2668 1bbhhh.exe 34 PID 2668 wrote to memory of 2572 2668 1bbhhh.exe 34 PID 2668 wrote to memory of 2572 2668 1bbhhh.exe 34 PID 2668 wrote to memory of 2572 2668 1bbhhh.exe 34 PID 2572 wrote to memory of 2828 2572 dvvdv.exe 35 PID 2572 wrote to memory of 2828 2572 dvvdv.exe 35 PID 2572 wrote to memory of 2828 2572 dvvdv.exe 35 PID 2572 wrote to memory of 2828 2572 dvvdv.exe 35 PID 2828 wrote to memory of 1608 2828 frlrflf.exe 36 PID 2828 wrote to memory of 1608 2828 frlrflf.exe 36 PID 2828 wrote to memory of 1608 2828 frlrflf.exe 36 PID 2828 wrote to memory of 1608 2828 frlrflf.exe 36 PID 1608 wrote to memory of 3036 1608 1nnbth.exe 37 PID 1608 wrote to memory of 3036 1608 1nnbth.exe 37 PID 1608 wrote to memory of 3036 1608 1nnbth.exe 37 PID 1608 wrote to memory of 3036 1608 1nnbth.exe 37 PID 3036 wrote to memory of 1416 3036 5vpvd.exe 38 PID 3036 wrote to memory of 1416 3036 5vpvd.exe 38 PID 3036 wrote to memory of 1416 3036 5vpvd.exe 38 PID 3036 wrote to memory of 1416 3036 5vpvd.exe 38 PID 1416 wrote to memory of 3012 1416 hhhnbh.exe 39 PID 1416 wrote to memory of 3012 1416 hhhnbh.exe 39 PID 1416 wrote to memory of 3012 1416 hhhnbh.exe 39 PID 1416 wrote to memory of 3012 1416 hhhnbh.exe 39 PID 3012 wrote to memory of 2020 3012 vpdjp.exe 40 PID 3012 wrote to memory of 2020 3012 vpdjp.exe 40 PID 3012 wrote to memory of 2020 3012 vpdjp.exe 40 PID 3012 wrote to memory of 2020 3012 vpdjp.exe 40 PID 2020 wrote to memory of 2028 2020 nnbbbb.exe 41 PID 2020 wrote to memory of 2028 2020 nnbbbb.exe 41 PID 2020 wrote to memory of 2028 2020 nnbbbb.exe 41 PID 2020 wrote to memory of 2028 2020 nnbbbb.exe 41 PID 2028 wrote to memory of 1040 2028 ffffxxr.exe 42 PID 2028 wrote to memory of 1040 2028 ffffxxr.exe 42 PID 2028 wrote to memory of 1040 2028 ffffxxr.exe 42 PID 2028 wrote to memory of 1040 2028 ffffxxr.exe 42 PID 1040 wrote to memory of 1076 1040 rlfrffr.exe 43 PID 1040 wrote to memory of 1076 1040 rlfrffr.exe 43 PID 1040 wrote to memory of 1076 1040 rlfrffr.exe 43 PID 1040 wrote to memory of 1076 1040 rlfrffr.exe 43 PID 1076 wrote to memory of 2640 1076 fllxrlx.exe 44 PID 1076 wrote to memory of 2640 1076 fllxrlx.exe 44 PID 1076 wrote to memory of 2640 1076 fllxrlx.exe 44 PID 1076 wrote to memory of 2640 1076 fllxrlx.exe 44 PID 2640 wrote to memory of 2884 2640 tnbbhh.exe 45 PID 2640 wrote to memory of 2884 2640 tnbbhh.exe 45 PID 2640 wrote to memory of 2884 2640 tnbbhh.exe 45 PID 2640 wrote to memory of 2884 2640 tnbbhh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d020facf2bfe69125543fff52825c68a16671a2201acc3e20c4eb549c20fc92N.exe"C:\Users\Admin\AppData\Local\Temp\0d020facf2bfe69125543fff52825c68a16671a2201acc3e20c4eb549c20fc92N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\ttnhbn.exec:\ttnhbn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\3vpvd.exec:\3vpvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\3llflrf.exec:\3llflrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\1bbhhh.exec:\1bbhhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\dvvdv.exec:\dvvdv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\frlrflf.exec:\frlrflf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\1nnbth.exec:\1nnbth.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\5vpvd.exec:\5vpvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\hhhnbh.exec:\hhhnbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
\??\c:\vpdjp.exec:\vpdjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\nnbbbb.exec:\nnbbbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\ffffxxr.exec:\ffffxxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\rlfrffr.exec:\rlfrffr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
\??\c:\fllxrlx.exec:\fllxrlx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
\??\c:\tnbbhh.exec:\tnbbhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\rxfrrfx.exec:\rxfrrfx.exe17⤵
- Executes dropped EXE
PID:2884 -
\??\c:\bhhhhh.exec:\bhhhhh.exe18⤵
- Executes dropped EXE
PID:2204 -
\??\c:\lrfrrll.exec:\lrfrrll.exe19⤵
- Executes dropped EXE
PID:2496 -
\??\c:\nthnhn.exec:\nthnhn.exe20⤵
- Executes dropped EXE
PID:1600 -
\??\c:\rrxrlxf.exec:\rrxrlxf.exe21⤵
- Executes dropped EXE
PID:2996 -
\??\c:\bhhbnh.exec:\bhhbnh.exe22⤵
- Executes dropped EXE
PID:2988 -
\??\c:\pvpvv.exec:\pvpvv.exe23⤵
- Executes dropped EXE
PID:932 -
\??\c:\fxxlxff.exec:\fxxlxff.exe24⤵
- Executes dropped EXE
PID:884 -
\??\c:\bhthth.exec:\bhthth.exe25⤵
- Executes dropped EXE
PID:1272 -
\??\c:\7xlxfxf.exec:\7xlxfxf.exe26⤵
- Executes dropped EXE
PID:1748 -
\??\c:\jjpdv.exec:\jjpdv.exe27⤵
- Executes dropped EXE
PID:2032 -
\??\c:\rlxrlxx.exec:\rlxrlxx.exe28⤵
- Executes dropped EXE
PID:2500 -
\??\c:\5bnthn.exec:\5bnthn.exe29⤵
- Executes dropped EXE
PID:2284 -
\??\c:\1flrffx.exec:\1flrffx.exe30⤵
- Executes dropped EXE
PID:2932 -
\??\c:\dddpj.exec:\dddpj.exe31⤵
- Executes dropped EXE
PID:2316 -
\??\c:\xfrllff.exec:\xfrllff.exe32⤵
- Executes dropped EXE
PID:1836 -
\??\c:\dvvjv.exec:\dvvjv.exe33⤵
- Executes dropped EXE
PID:2948 -
\??\c:\djjjd.exec:\djjjd.exe34⤵
- Executes dropped EXE
PID:2692 -
\??\c:\tbnhnb.exec:\tbnhnb.exe35⤵
- Executes dropped EXE
PID:1540 -
\??\c:\jvpdp.exec:\jvpdp.exe36⤵
- Executes dropped EXE
PID:2812 -
\??\c:\9dpvd.exec:\9dpvd.exe37⤵
- Executes dropped EXE
PID:2748 -
\??\c:\rlxxrll.exec:\rlxxrll.exe38⤵
- Executes dropped EXE
PID:2772 -
\??\c:\hbbhtb.exec:\hbbhtb.exe39⤵
- Executes dropped EXE
PID:2696 -
\??\c:\jjjdv.exec:\jjjdv.exe40⤵
- Executes dropped EXE
PID:2688 -
\??\c:\fxrrflx.exec:\fxrrflx.exe41⤵
- Executes dropped EXE
PID:2664 -
\??\c:\nntnhb.exec:\nntnhb.exe42⤵
- Executes dropped EXE
PID:2828 -
\??\c:\jddjp.exec:\jddjp.exe43⤵
- Executes dropped EXE
PID:2600 -
\??\c:\xxrfxlr.exec:\xxrfxlr.exe44⤵
- Executes dropped EXE
PID:1160 -
\??\c:\lrrxrxx.exec:\lrrxrxx.exe45⤵
- Executes dropped EXE
PID:2796 -
\??\c:\hbnnbb.exec:\hbnnbb.exe46⤵
- Executes dropped EXE
PID:2924 -
\??\c:\7vjjp.exec:\7vjjp.exe47⤵
- Executes dropped EXE
PID:1932 -
\??\c:\rllrfrx.exec:\rllrfrx.exe48⤵
- Executes dropped EXE
PID:2648 -
\??\c:\tbhnbh.exec:\tbhnbh.exe49⤵
- Executes dropped EXE
PID:2512 -
\??\c:\1tntbb.exec:\1tntbb.exe50⤵
- Executes dropped EXE
PID:2028 -
\??\c:\dddjv.exec:\dddjv.exe51⤵
- Executes dropped EXE
PID:2348 -
\??\c:\fffxxxx.exec:\fffxxxx.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:864 -
\??\c:\3bhnnt.exec:\3bhnnt.exe53⤵
- Executes dropped EXE
PID:836 -
\??\c:\7ddjv.exec:\7ddjv.exe54⤵
- Executes dropped EXE
PID:2880 -
\??\c:\lfxrxxl.exec:\lfxrxxl.exe55⤵
- Executes dropped EXE
PID:1412 -
\??\c:\xrfxflr.exec:\xrfxflr.exe56⤵
- Executes dropped EXE
PID:1424 -
\??\c:\hbbbnt.exec:\hbbbnt.exe57⤵
- Executes dropped EXE
PID:2128 -
\??\c:\jvvpj.exec:\jvvpj.exe58⤵
- Executes dropped EXE
PID:2392 -
\??\c:\lrrlxlf.exec:\lrrlxlf.exe59⤵
- Executes dropped EXE
PID:352 -
\??\c:\xrrxrxl.exec:\xrrxrxl.exe60⤵
- Executes dropped EXE
PID:1796 -
\??\c:\5tbnnb.exec:\5tbnnb.exe61⤵
- Executes dropped EXE
PID:2008 -
\??\c:\5dpvj.exec:\5dpvj.exe62⤵
- Executes dropped EXE
PID:2196 -
\??\c:\9xrxrfx.exec:\9xrxrfx.exe63⤵
- Executes dropped EXE
PID:1016 -
\??\c:\nnbbnn.exec:\nnbbnn.exe64⤵
- Executes dropped EXE
PID:2436 -
\??\c:\ddjpp.exec:\ddjpp.exe65⤵
- Executes dropped EXE
PID:824 -
\??\c:\xxllllr.exec:\xxllllr.exe66⤵PID:1240
-
\??\c:\nhhhbb.exec:\nhhhbb.exe67⤵PID:756
-
\??\c:\hbtbtb.exec:\hbtbtb.exe68⤵PID:1720
-
\??\c:\ppppv.exec:\ppppv.exe69⤵PID:2480
-
\??\c:\fffrffx.exec:\fffrffx.exe70⤵PID:2980
-
\??\c:\nnhhnn.exec:\nnhhnn.exe71⤵PID:2488
-
\??\c:\7pppv.exec:\7pppv.exe72⤵PID:3056
-
\??\c:\djdpv.exec:\djdpv.exe73⤵PID:1012
-
\??\c:\lflffrl.exec:\lflffrl.exe74⤵PID:1436
-
\??\c:\3bbhnb.exec:\3bbhnb.exe75⤵PID:2164
-
\??\c:\pppdp.exec:\pppdp.exe76⤵PID:1512
-
\??\c:\rlfrlrf.exec:\rlfrlrf.exe77⤵PID:2692
-
\??\c:\ffrrxlx.exec:\ffrrxlx.exe78⤵PID:2776
-
\??\c:\bbbnbh.exec:\bbbnbh.exe79⤵PID:2556
-
\??\c:\vvvjv.exec:\vvvjv.exe80⤵PID:2576
-
\??\c:\pvvvp.exec:\pvvvp.exe81⤵PID:2772
-
\??\c:\lfxxflx.exec:\lfxxflx.exe82⤵PID:2716
-
\??\c:\htnbbn.exec:\htnbbn.exe83⤵PID:2688
-
\??\c:\bhhbbt.exec:\bhhbbt.exe84⤵PID:2664
-
\??\c:\jjjpd.exec:\jjjpd.exe85⤵PID:2064
-
\??\c:\5rlrflx.exec:\5rlrflx.exe86⤵
- System Location Discovery: System Language Discovery
PID:1608 -
\??\c:\btnbnt.exec:\btnbnt.exe87⤵PID:2876
-
\??\c:\bbtbnh.exec:\bbtbnh.exe88⤵PID:2788
-
\??\c:\dddvv.exec:\dddvv.exe89⤵PID:2900
-
\??\c:\ffxfrrl.exec:\ffxfrrl.exe90⤵PID:1932
-
\??\c:\tnhthn.exec:\tnhthn.exe91⤵PID:2844
-
\??\c:\bbhbtb.exec:\bbhbtb.exe92⤵PID:2372
-
\??\c:\7jdjp.exec:\7jdjp.exe93⤵PID:1712
-
\??\c:\llrxrxr.exec:\llrxrxr.exe94⤵PID:1604
-
\??\c:\hhbnth.exec:\hhbnth.exe95⤵PID:2868
-
\??\c:\nnntnt.exec:\nnntnt.exe96⤵PID:1496
-
\??\c:\jpvjd.exec:\jpvjd.exe97⤵PID:2952
-
\??\c:\fxxlxff.exec:\fxxlxff.exe98⤵PID:2964
-
\??\c:\3ttnnh.exec:\3ttnnh.exe99⤵PID:1632
-
\??\c:\hbhtht.exec:\hbhtht.exe100⤵PID:2128
-
\??\c:\5jjjv.exec:\5jjjv.exe101⤵PID:2740
-
\??\c:\xxxrxlf.exec:\xxxrxlf.exe102⤵PID:352
-
\??\c:\nnnhbt.exec:\nnnhbt.exe103⤵PID:936
-
\??\c:\1ddpd.exec:\1ddpd.exe104⤵PID:1668
-
\??\c:\jjjpv.exec:\jjjpv.exe105⤵PID:932
-
\??\c:\flrffrx.exec:\flrffrx.exe106⤵PID:556
-
\??\c:\bttbnt.exec:\bttbnt.exe107⤵PID:2408
-
\??\c:\5bbhtb.exec:\5bbhtb.exe108⤵PID:2092
-
\??\c:\jjjpj.exec:\jjjpj.exe109⤵PID:1224
-
\??\c:\9lrxrfx.exec:\9lrxrfx.exe110⤵PID:2032
-
\??\c:\rllxlrl.exec:\rllxlrl.exe111⤵PID:2472
-
\??\c:\pjjpd.exec:\pjjpd.exe112⤵PID:3048
-
\??\c:\xxrfrxl.exec:\xxrfrxl.exe113⤵PID:1640
-
\??\c:\frrfxlf.exec:\frrfxlf.exe114⤵PID:2304
-
\??\c:\tthbtb.exec:\tthbtb.exe115⤵PID:1736
-
\??\c:\vppvj.exec:\vppvj.exe116⤵PID:1808
-
\??\c:\rxlxxrx.exec:\rxlxxrx.exe117⤵PID:1812
-
\??\c:\hntbht.exec:\hntbht.exe118⤵PID:2340
-
\??\c:\vvvdv.exec:\vvvdv.exe119⤵PID:2660
-
\??\c:\ddvvp.exec:\ddvvp.exe120⤵PID:1536
-
\??\c:\5xflfll.exec:\5xflfll.exe121⤵PID:2944
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-