Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 01:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a9e70e52ae16cfafda4973fc762c16f143ad5057d94aedcfbfd31615e8f9f822.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
a9e70e52ae16cfafda4973fc762c16f143ad5057d94aedcfbfd31615e8f9f822.exe
-
Size
455KB
-
MD5
cea7f83c18ba553af131d7f9b25942b7
-
SHA1
8941504acd8cdc4f72a0cec54dc80cfdc160a1af
-
SHA256
a9e70e52ae16cfafda4973fc762c16f143ad5057d94aedcfbfd31615e8f9f822
-
SHA512
6a51961d20dba6eaabd9b43ea6b0592bb225b22d4a5d4df8b200ac09aafa0d4a59f2c363450e3cd361ceb4bc3ad67a2b45a52356c1f11f74dbbf49d7843feb89
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbea:q7Tc2NYHUrAwfMp3CDa
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 53 IoCs
resource yara_rule behavioral1/memory/2672-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-15-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2264-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-64-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1728-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1556-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/524-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2040-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2036-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-222-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2956-220-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2488-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/892-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2472-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2320-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1912-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-336-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2840-343-0x00000000001C0000-0x00000000001EA000-memory.dmp family_blackmoon behavioral1/memory/2840-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1556-403-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/1780-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1780-439-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2788-448-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2372-463-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-462-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2928-471-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1684-517-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/960-531-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1020-549-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1424-563-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2624-652-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/840-673-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/408-747-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1200-784-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1732-831-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-947-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2064-1038-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1804-1089-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/484-1139-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon behavioral1/memory/2544-1379-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2172 bththn.exe 2320 rxxfxxx.exe 2264 tbnhbt.exe 2684 bbntbt.exe 2892 lxrrflf.exe 2716 hthhnn.exe 1916 5pddv.exe 1728 3thhnn.exe 2704 ppdvj.exe 2664 thttbb.exe 1556 vpdjv.exe 524 jvvpp.exe 1220 5htttn.exe 2040 xrffllx.exe 1540 7nhntn.exe 284 fxxxlrf.exe 2824 frlrflr.exe 2216 jjvpj.exe 2956 lrrxlrf.exe 1132 ppjjp.exe 2968 rlxrxxf.exe 2036 ntnthh.exe 2944 rlxfrxx.exe 1272 dvdjv.exe 912 1rlxlrr.exe 2488 flrxlxx.exe 1468 vjvvd.exe 2092 ddvjp.exe 1976 frflllr.exe 892 bnhhnn.exe 2396 pjjjp.exe 592 pjvvd.exe 1524 tnhntb.exe 2236 1rrrlrf.exe 2472 llxlrrx.exe 2320 tnnnhh.exe 1912 dpdvv.exe 2904 rlxrxxf.exe 2840 fxrrffl.exe 2892 tnhhbb.exe 2696 vpjjv.exe 2964 jjdvd.exe 2728 7frrrll.exe 2588 tbhtbt.exe 2712 dvvvv.exe 588 jdpvd.exe 2568 3xlfllr.exe 1556 tnhhtt.exe 1720 pjdjj.exe 2120 fxrrxxx.exe 1968 lflrxxf.exe 1184 9bnnnn.exe 1692 9vdjp.exe 1780 7vpvv.exe 2788 lfrrlrr.exe 2208 bhnnhh.exe 2372 dpjjp.exe 2928 dvpvv.exe 3032 1fxxfxr.exe 1180 7nhbbt.exe 1532 dpjpp.exe 1208 lfxrlfl.exe 2944 rfrxfxl.exe 1272 htntbb.exe -
resource yara_rule behavioral1/memory/2672-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-15-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2684-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1556-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/524-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1220-132-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2040-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1132-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/892-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1912-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1780-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1780-439-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2372-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1208-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-517-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-518-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/960-531-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-564-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-597-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-660-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/840-673-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-728-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/408-747-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1200-784-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-821-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-831-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/532-857-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-872-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-880-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-941-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-947-0x00000000002B0000-0x00000000002DA000-memory.dmp upx behavioral1/memory/2064-1038-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/596-1120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-1213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-1244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-1354-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xlrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxxlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxxlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rfllxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llflxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xlxfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2672 wrote to memory of 2172 2672 a9e70e52ae16cfafda4973fc762c16f143ad5057d94aedcfbfd31615e8f9f822.exe 30 PID 2672 wrote to memory of 2172 2672 a9e70e52ae16cfafda4973fc762c16f143ad5057d94aedcfbfd31615e8f9f822.exe 30 PID 2672 wrote to memory of 2172 2672 a9e70e52ae16cfafda4973fc762c16f143ad5057d94aedcfbfd31615e8f9f822.exe 30 PID 2672 wrote to memory of 2172 2672 a9e70e52ae16cfafda4973fc762c16f143ad5057d94aedcfbfd31615e8f9f822.exe 30 PID 2172 wrote to memory of 2320 2172 bththn.exe 31 PID 2172 wrote to memory of 2320 2172 bththn.exe 31 PID 2172 wrote to memory of 2320 2172 bththn.exe 31 PID 2172 wrote to memory of 2320 2172 bththn.exe 31 PID 2320 wrote to memory of 2264 2320 rxxfxxx.exe 32 PID 2320 wrote to memory of 2264 2320 rxxfxxx.exe 32 PID 2320 wrote to memory of 2264 2320 rxxfxxx.exe 32 PID 2320 wrote to memory of 2264 2320 rxxfxxx.exe 32 PID 2264 wrote to memory of 2684 2264 tbnhbt.exe 33 PID 2264 wrote to memory of 2684 2264 tbnhbt.exe 33 PID 2264 wrote to memory of 2684 2264 tbnhbt.exe 33 PID 2264 wrote to memory of 2684 2264 tbnhbt.exe 33 PID 2684 wrote to memory of 2892 2684 bbntbt.exe 34 PID 2684 wrote to memory of 2892 2684 bbntbt.exe 34 PID 2684 wrote to memory of 2892 2684 bbntbt.exe 34 PID 2684 wrote to memory of 2892 2684 bbntbt.exe 34 PID 2892 wrote to memory of 2716 2892 lxrrflf.exe 35 PID 2892 wrote to memory of 2716 2892 lxrrflf.exe 35 PID 2892 wrote to memory of 2716 2892 lxrrflf.exe 35 PID 2892 wrote to memory of 2716 2892 lxrrflf.exe 35 PID 2716 wrote to memory of 1916 2716 hthhnn.exe 36 PID 2716 wrote to memory of 1916 2716 hthhnn.exe 36 PID 2716 wrote to memory of 1916 2716 hthhnn.exe 36 PID 2716 wrote to memory of 1916 2716 hthhnn.exe 36 PID 1916 wrote to memory of 1728 1916 5pddv.exe 37 PID 1916 wrote to memory of 1728 1916 5pddv.exe 37 PID 1916 wrote to memory of 1728 1916 5pddv.exe 37 PID 1916 wrote to memory of 1728 1916 5pddv.exe 37 PID 1728 wrote to memory of 2704 1728 3thhnn.exe 38 PID 1728 wrote to memory of 2704 1728 3thhnn.exe 38 PID 1728 wrote to memory of 2704 1728 3thhnn.exe 38 PID 1728 wrote to memory of 2704 1728 3thhnn.exe 38 PID 2704 wrote to memory of 2664 2704 ppdvj.exe 39 PID 2704 wrote to memory of 2664 2704 ppdvj.exe 39 PID 2704 wrote to memory of 2664 2704 ppdvj.exe 39 PID 2704 wrote to memory of 2664 2704 ppdvj.exe 39 PID 2664 wrote to memory of 1556 2664 thttbb.exe 40 PID 2664 wrote to memory of 1556 2664 thttbb.exe 40 PID 2664 wrote to memory of 1556 2664 thttbb.exe 40 PID 2664 wrote to memory of 1556 2664 thttbb.exe 40 PID 1556 wrote to memory of 524 1556 vpdjv.exe 41 PID 1556 wrote to memory of 524 1556 vpdjv.exe 41 PID 1556 wrote to memory of 524 1556 vpdjv.exe 41 PID 1556 wrote to memory of 524 1556 vpdjv.exe 41 PID 524 wrote to memory of 1220 524 jvvpp.exe 42 PID 524 wrote to memory of 1220 524 jvvpp.exe 42 PID 524 wrote to memory of 1220 524 jvvpp.exe 42 PID 524 wrote to memory of 1220 524 jvvpp.exe 42 PID 1220 wrote to memory of 2040 1220 5htttn.exe 43 PID 1220 wrote to memory of 2040 1220 5htttn.exe 43 PID 1220 wrote to memory of 2040 1220 5htttn.exe 43 PID 1220 wrote to memory of 2040 1220 5htttn.exe 43 PID 2040 wrote to memory of 1540 2040 xrffllx.exe 44 PID 2040 wrote to memory of 1540 2040 xrffllx.exe 44 PID 2040 wrote to memory of 1540 2040 xrffllx.exe 44 PID 2040 wrote to memory of 1540 2040 xrffllx.exe 44 PID 1540 wrote to memory of 284 1540 7nhntn.exe 45 PID 1540 wrote to memory of 284 1540 7nhntn.exe 45 PID 1540 wrote to memory of 284 1540 7nhntn.exe 45 PID 1540 wrote to memory of 284 1540 7nhntn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\a9e70e52ae16cfafda4973fc762c16f143ad5057d94aedcfbfd31615e8f9f822.exe"C:\Users\Admin\AppData\Local\Temp\a9e70e52ae16cfafda4973fc762c16f143ad5057d94aedcfbfd31615e8f9f822.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\bththn.exec:\bththn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\rxxfxxx.exec:\rxxfxxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\tbnhbt.exec:\tbnhbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\bbntbt.exec:\bbntbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\lxrrflf.exec:\lxrrflf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\hthhnn.exec:\hthhnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\5pddv.exec:\5pddv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\3thhnn.exec:\3thhnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\ppdvj.exec:\ppdvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\thttbb.exec:\thttbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\vpdjv.exec:\vpdjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
\??\c:\jvvpp.exec:\jvvpp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:524 -
\??\c:\5htttn.exec:\5htttn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
\??\c:\xrffllx.exec:\xrffllx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\7nhntn.exec:\7nhntn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
\??\c:\fxxxlrf.exec:\fxxxlrf.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:284 -
\??\c:\frlrflr.exec:\frlrflr.exe18⤵
- Executes dropped EXE
PID:2824 -
\??\c:\jjvpj.exec:\jjvpj.exe19⤵
- Executes dropped EXE
PID:2216 -
\??\c:\lrrxlrf.exec:\lrrxlrf.exe20⤵
- Executes dropped EXE
PID:2956 -
\??\c:\ppjjp.exec:\ppjjp.exe21⤵
- Executes dropped EXE
PID:1132 -
\??\c:\rlxrxxf.exec:\rlxrxxf.exe22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2968 -
\??\c:\ntnthh.exec:\ntnthh.exe23⤵
- Executes dropped EXE
PID:2036 -
\??\c:\rlxfrxx.exec:\rlxfrxx.exe24⤵
- Executes dropped EXE
PID:2944 -
\??\c:\dvdjv.exec:\dvdjv.exe25⤵
- Executes dropped EXE
PID:1272 -
\??\c:\1rlxlrr.exec:\1rlxlrr.exe26⤵
- Executes dropped EXE
PID:912 -
\??\c:\flrxlxx.exec:\flrxlxx.exe27⤵
- Executes dropped EXE
PID:2488 -
\??\c:\vjvvd.exec:\vjvvd.exe28⤵
- Executes dropped EXE
PID:1468 -
\??\c:\ddvjp.exec:\ddvjp.exe29⤵
- Executes dropped EXE
PID:2092 -
\??\c:\frflllr.exec:\frflllr.exe30⤵
- Executes dropped EXE
PID:1976 -
\??\c:\bnhhnn.exec:\bnhhnn.exe31⤵
- Executes dropped EXE
PID:892 -
\??\c:\pjjjp.exec:\pjjjp.exe32⤵
- Executes dropped EXE
PID:2396 -
\??\c:\pjvvd.exec:\pjvvd.exe33⤵
- Executes dropped EXE
PID:592 -
\??\c:\tnhntb.exec:\tnhntb.exe34⤵
- Executes dropped EXE
PID:1524 -
\??\c:\1rrrlrf.exec:\1rrrlrf.exe35⤵
- Executes dropped EXE
PID:2236 -
\??\c:\llxlrrx.exec:\llxlrrx.exe36⤵
- Executes dropped EXE
PID:2472 -
\??\c:\tnnnhh.exec:\tnnnhh.exe37⤵
- Executes dropped EXE
PID:2320 -
\??\c:\dpdvv.exec:\dpdvv.exe38⤵
- Executes dropped EXE
PID:1912 -
\??\c:\rlxrxxf.exec:\rlxrxxf.exe39⤵
- Executes dropped EXE
PID:2904 -
\??\c:\fxrrffl.exec:\fxrrffl.exe40⤵
- Executes dropped EXE
PID:2840 -
\??\c:\tnhhbb.exec:\tnhhbb.exe41⤵
- Executes dropped EXE
PID:2892 -
\??\c:\vpjjv.exec:\vpjjv.exe42⤵
- Executes dropped EXE
PID:2696 -
\??\c:\jjdvd.exec:\jjdvd.exe43⤵
- Executes dropped EXE
PID:2964 -
\??\c:\7frrrll.exec:\7frrrll.exe44⤵
- Executes dropped EXE
PID:2728 -
\??\c:\tbhtbt.exec:\tbhtbt.exe45⤵
- Executes dropped EXE
PID:2588 -
\??\c:\dvvvv.exec:\dvvvv.exe46⤵
- Executes dropped EXE
PID:2712 -
\??\c:\jdpvd.exec:\jdpvd.exe47⤵
- Executes dropped EXE
PID:588 -
\??\c:\3xlfllr.exec:\3xlfllr.exe48⤵
- Executes dropped EXE
PID:2568 -
\??\c:\tnhhtt.exec:\tnhhtt.exe49⤵
- Executes dropped EXE
PID:1556 -
\??\c:\pjdjj.exec:\pjdjj.exe50⤵
- Executes dropped EXE
PID:1720 -
\??\c:\fxrrxxx.exec:\fxrrxxx.exe51⤵
- Executes dropped EXE
PID:2120 -
\??\c:\lflrxxf.exec:\lflrxxf.exe52⤵
- Executes dropped EXE
PID:1968 -
\??\c:\9bnnnn.exec:\9bnnnn.exe53⤵
- Executes dropped EXE
PID:1184 -
\??\c:\9vdjp.exec:\9vdjp.exe54⤵
- Executes dropped EXE
PID:1692 -
\??\c:\7vpvv.exec:\7vpvv.exe55⤵
- Executes dropped EXE
PID:1780 -
\??\c:\lfrrlrr.exec:\lfrrlrr.exe56⤵
- Executes dropped EXE
PID:2788 -
\??\c:\bhnnhh.exec:\bhnnhh.exe57⤵
- Executes dropped EXE
PID:2208 -
\??\c:\dpjjp.exec:\dpjjp.exe58⤵
- Executes dropped EXE
PID:2372 -
\??\c:\dvpvv.exec:\dvpvv.exe59⤵
- Executes dropped EXE
PID:2928 -
\??\c:\1fxxfxr.exec:\1fxxfxr.exe60⤵
- Executes dropped EXE
PID:3032 -
\??\c:\7nhbbt.exec:\7nhbbt.exe61⤵
- Executes dropped EXE
PID:1180 -
\??\c:\dpjpp.exec:\dpjpp.exe62⤵
- Executes dropped EXE
PID:1532 -
\??\c:\lfxrlfl.exec:\lfxrlfl.exe63⤵
- Executes dropped EXE
PID:1208 -
\??\c:\rfrxfxl.exec:\rfrxfxl.exe64⤵
- Executes dropped EXE
PID:2944 -
\??\c:\htntbb.exec:\htntbb.exe65⤵
- Executes dropped EXE
PID:1272 -
\??\c:\djdvd.exec:\djdvd.exe66⤵PID:1684
-
\??\c:\3vpdd.exec:\3vpdd.exe67⤵PID:2008
-
\??\c:\lxlfffl.exec:\lxlfffl.exe68⤵PID:960
-
\??\c:\5hbnnt.exec:\5hbnnt.exe69⤵PID:784
-
\??\c:\jdpdd.exec:\jdpdd.exe70⤵PID:2100
-
\??\c:\9pjjp.exec:\9pjjp.exe71⤵PID:1020
-
\??\c:\ffflxfl.exec:\ffflxfl.exe72⤵PID:2084
-
\??\c:\hhttbt.exec:\hhttbt.exe73⤵PID:1424
-
\??\c:\jdjpj.exec:\jdjpj.exe74⤵PID:2396
-
\??\c:\pjjjp.exec:\pjjjp.exe75⤵PID:2004
-
\??\c:\1lrrrlr.exec:\1lrrrlr.exe76⤵PID:2324
-
\??\c:\nnbhnn.exec:\nnbhnn.exe77⤵PID:2236
-
\??\c:\pdvdp.exec:\pdvdp.exe78⤵PID:2292
-
\??\c:\jjddp.exec:\jjddp.exe79⤵PID:2320
-
\??\c:\7frrxxl.exec:\7frrxxl.exe80⤵PID:2684
-
\??\c:\hbhnnh.exec:\hbhnnh.exe81⤵PID:2908
-
\??\c:\9tnnnn.exec:\9tnnnn.exe82⤵PID:2848
-
\??\c:\5vpvj.exec:\5vpvj.exe83⤵PID:2532
-
\??\c:\1xlrrrr.exec:\1xlrrrr.exe84⤵PID:2692
-
\??\c:\3lfxflf.exec:\3lfxflf.exe85⤵PID:2852
-
\??\c:\1nhhhh.exec:\1nhhhh.exe86⤵PID:2592
-
\??\c:\vvppd.exec:\vvppd.exe87⤵PID:2624
-
\??\c:\vpdjp.exec:\vpdjp.exe88⤵PID:2604
-
\??\c:\3xrfrrx.exec:\3xrfrrx.exe89⤵PID:2388
-
\??\c:\nnhhnt.exec:\nnhhnt.exe90⤵PID:2412
-
\??\c:\dvjjj.exec:\dvjjj.exe91⤵PID:840
-
\??\c:\ppjpd.exec:\ppjpd.exe92⤵PID:1612
-
\??\c:\5fxxfxl.exec:\5fxxfxl.exe93⤵PID:2332
-
\??\c:\nbnnbb.exec:\nbnnbb.exe94⤵PID:2504
-
\??\c:\jdjpv.exec:\jdjpv.exe95⤵PID:2012
-
\??\c:\vpppd.exec:\vpppd.exe96⤵PID:1888
-
\??\c:\rxrrxfl.exec:\rxrrxfl.exe97⤵PID:284
-
\??\c:\nbhhbn.exec:\nbhhbn.exe98⤵PID:2184
-
\??\c:\9hnhnh.exec:\9hnhnh.exe99⤵PID:1716
-
\??\c:\vpjpv.exec:\vpjpv.exe100⤵PID:2116
-
\??\c:\3flfffl.exec:\3flfffl.exe101⤵PID:1396
-
\??\c:\xlfflxr.exec:\xlfflxr.exe102⤵PID:1128
-
\??\c:\9tnntt.exec:\9tnntt.exe103⤵PID:408
-
\??\c:\pjvvj.exec:\pjvvj.exe104⤵PID:1984
-
\??\c:\pjpvd.exec:\pjpvd.exe105⤵PID:1256
-
\??\c:\lfrffxx.exec:\lfrffxx.exe106⤵PID:2032
-
\??\c:\7tbttn.exec:\7tbttn.exe107⤵PID:1308
-
\??\c:\hthnhn.exec:\hthnhn.exe108⤵PID:1200
-
\??\c:\jdppv.exec:\jdppv.exe109⤵PID:1212
-
\??\c:\lfxflrx.exec:\lfxflrx.exe110⤵PID:688
-
\??\c:\lxfxxrl.exec:\lxfxxrl.exe111⤵PID:3024
-
\??\c:\3nbhnt.exec:\3nbhnt.exe112⤵PID:2768
-
\??\c:\jvvvv.exec:\jvvvv.exe113⤵PID:2456
-
\??\c:\9dppv.exec:\9dppv.exe114⤵PID:2100
-
\??\c:\rrrxxxl.exec:\rrrxxxl.exe115⤵PID:2356
-
\??\c:\hbtbhh.exec:\hbtbhh.exe116⤵PID:1732
-
\??\c:\vpppd.exec:\vpppd.exe117⤵PID:1496
-
\??\c:\dddjp.exec:\dddjp.exe118⤵PID:2544
-
\??\c:\7fffffl.exec:\7fffffl.exe119⤵PID:2508
-
\??\c:\9tnhtt.exec:\9tnhtt.exe120⤵PID:1920
-
\??\c:\3vpvv.exec:\3vpvv.exe121⤵PID:532
-
\??\c:\dpdvd.exec:\dpdvd.exe122⤵PID:2264
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-