Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 01:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
abff855862c1ee7ad2007a2b7c7468726f6e3004fc4425255deb221fa7e9ae7c.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
abff855862c1ee7ad2007a2b7c7468726f6e3004fc4425255deb221fa7e9ae7c.exe
-
Size
454KB
-
MD5
a283e376125e3a47c88b2e7c1d5f6c4e
-
SHA1
ead8f9437a61757c2da005fcc3570ea1c36e30e2
-
SHA256
abff855862c1ee7ad2007a2b7c7468726f6e3004fc4425255deb221fa7e9ae7c
-
SHA512
14b4f957f96c71423ab2c757e12a9cc5342d9c9eeaa6e13458efb2284c868a463e0b0a09b133f4e28c32cf97268be81e5e7734d39df652e62387dcb6e7ba468d
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe1R:q7Tc2NYHUrAwfMp3CD1R
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/1960-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2052-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1804-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1440-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-45-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2716-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2356-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1720-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2028-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-184-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2672-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-182-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2668-203-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/912-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/908-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/852-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2248-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2004-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2496-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2196-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-399-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1204-442-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1204-441-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2028-456-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-464-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-465-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-484-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1036-504-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-664-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2808-678-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/988-686-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-685-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/396-699-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-743-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2052 xrlrflx.exe 1804 ffrfxll.exe 1440 tbnthh.exe 2500 jppvj.exe 2756 1thtbn.exe 2716 vvjpv.exe 2804 bbtbnt.exe 2952 rrxffxl.exe 2840 nhnhth.exe 2736 jdpvj.exe 2584 fxrxfxl.exe 2164 pjpvp.exe 2356 xrllrxf.exe 1720 7dvjv.exe 2380 fxxxxxf.exe 2324 nhbnhn.exe 2028 ffrxfxl.exe 2488 btntnn.exe 1792 xrllrxf.exe 2672 nhbhnt.exe 1668 xlrlxlf.exe 2668 flfxrfl.exe 2760 vvpvj.exe 912 xrllflx.exe 1504 7jvdj.exe 852 xrflxxl.exe 908 jjvvj.exe 2420 rlflrrl.exe 2148 tthntt.exe 1636 9pddp.exe 2320 hbntbb.exe 2248 vpddj.exe 1960 5hbtbb.exe 1976 pjdjd.exe 2052 flfrflx.exe 2004 ntnhnt.exe 2496 hhbtnb.exe 2196 9jdjj.exe 1932 flfflrx.exe 2772 5thhnn.exe 2768 3pppv.exe 2848 vjdjd.exe 2608 xxxfflx.exe 2872 ttnbnt.exe 2288 hhbbbh.exe 2568 vppdv.exe 2692 rlxxffl.exe 2128 xrfflfr.exe 2116 bbntbb.exe 2356 9pdpd.exe 1784 xxxxxfl.exe 1796 nbnhnh.exe 1204 hhhhtb.exe 1816 pjvvd.exe 2028 ffxrxxf.exe 2488 3nhnbn.exe 2632 ppvpv.exe 3032 3dvpd.exe 2224 3rxxxxl.exe 2932 hhbhhh.exe 760 jjdvj.exe 1036 vjddj.exe 1632 7rfffrx.exe 1540 tntttt.exe -
resource yara_rule behavioral1/memory/1960-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1440-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-201-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/912-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1504-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/908-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/852-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-317-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2004-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-399-0x0000000000430000-0x000000000045A000-memory.dmp upx behavioral1/memory/2116-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1204-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-456-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-464-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-465-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-484-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/760-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1036-504-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/760-519-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-596-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-657-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-671-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-678-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/988-686-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/396-699-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/324-776-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/532-826-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-833-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-840-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-866-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-893-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1060-942-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnttbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ffflrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlrfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7httbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbtth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lrflff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1960 wrote to memory of 2052 1960 abff855862c1ee7ad2007a2b7c7468726f6e3004fc4425255deb221fa7e9ae7c.exe 30 PID 1960 wrote to memory of 2052 1960 abff855862c1ee7ad2007a2b7c7468726f6e3004fc4425255deb221fa7e9ae7c.exe 30 PID 1960 wrote to memory of 2052 1960 abff855862c1ee7ad2007a2b7c7468726f6e3004fc4425255deb221fa7e9ae7c.exe 30 PID 1960 wrote to memory of 2052 1960 abff855862c1ee7ad2007a2b7c7468726f6e3004fc4425255deb221fa7e9ae7c.exe 30 PID 2052 wrote to memory of 1804 2052 xrlrflx.exe 31 PID 2052 wrote to memory of 1804 2052 xrlrflx.exe 31 PID 2052 wrote to memory of 1804 2052 xrlrflx.exe 31 PID 2052 wrote to memory of 1804 2052 xrlrflx.exe 31 PID 1804 wrote to memory of 1440 1804 ffrfxll.exe 32 PID 1804 wrote to memory of 1440 1804 ffrfxll.exe 32 PID 1804 wrote to memory of 1440 1804 ffrfxll.exe 32 PID 1804 wrote to memory of 1440 1804 ffrfxll.exe 32 PID 1440 wrote to memory of 2500 1440 tbnthh.exe 33 PID 1440 wrote to memory of 2500 1440 tbnthh.exe 33 PID 1440 wrote to memory of 2500 1440 tbnthh.exe 33 PID 1440 wrote to memory of 2500 1440 tbnthh.exe 33 PID 2500 wrote to memory of 2756 2500 jppvj.exe 34 PID 2500 wrote to memory of 2756 2500 jppvj.exe 34 PID 2500 wrote to memory of 2756 2500 jppvj.exe 34 PID 2500 wrote to memory of 2756 2500 jppvj.exe 34 PID 2756 wrote to memory of 2716 2756 1thtbn.exe 35 PID 2756 wrote to memory of 2716 2756 1thtbn.exe 35 PID 2756 wrote to memory of 2716 2756 1thtbn.exe 35 PID 2756 wrote to memory of 2716 2756 1thtbn.exe 35 PID 2716 wrote to memory of 2804 2716 vvjpv.exe 36 PID 2716 wrote to memory of 2804 2716 vvjpv.exe 36 PID 2716 wrote to memory of 2804 2716 vvjpv.exe 36 PID 2716 wrote to memory of 2804 2716 vvjpv.exe 36 PID 2804 wrote to memory of 2952 2804 bbtbnt.exe 37 PID 2804 wrote to memory of 2952 2804 bbtbnt.exe 37 PID 2804 wrote to memory of 2952 2804 bbtbnt.exe 37 PID 2804 wrote to memory of 2952 2804 bbtbnt.exe 37 PID 2952 wrote to memory of 2840 2952 rrxffxl.exe 38 PID 2952 wrote to memory of 2840 2952 rrxffxl.exe 38 PID 2952 wrote to memory of 2840 2952 rrxffxl.exe 38 PID 2952 wrote to memory of 2840 2952 rrxffxl.exe 38 PID 2840 wrote to memory of 2736 2840 nhnhth.exe 39 PID 2840 wrote to memory of 2736 2840 nhnhth.exe 39 PID 2840 wrote to memory of 2736 2840 nhnhth.exe 39 PID 2840 wrote to memory of 2736 2840 nhnhth.exe 39 PID 2736 wrote to memory of 2584 2736 jdpvj.exe 40 PID 2736 wrote to memory of 2584 2736 jdpvj.exe 40 PID 2736 wrote to memory of 2584 2736 jdpvj.exe 40 PID 2736 wrote to memory of 2584 2736 jdpvj.exe 40 PID 2584 wrote to memory of 2164 2584 fxrxfxl.exe 41 PID 2584 wrote to memory of 2164 2584 fxrxfxl.exe 41 PID 2584 wrote to memory of 2164 2584 fxrxfxl.exe 41 PID 2584 wrote to memory of 2164 2584 fxrxfxl.exe 41 PID 2164 wrote to memory of 2356 2164 pjpvp.exe 42 PID 2164 wrote to memory of 2356 2164 pjpvp.exe 42 PID 2164 wrote to memory of 2356 2164 pjpvp.exe 42 PID 2164 wrote to memory of 2356 2164 pjpvp.exe 42 PID 2356 wrote to memory of 1720 2356 xrllrxf.exe 43 PID 2356 wrote to memory of 1720 2356 xrllrxf.exe 43 PID 2356 wrote to memory of 1720 2356 xrllrxf.exe 43 PID 2356 wrote to memory of 1720 2356 xrllrxf.exe 43 PID 1720 wrote to memory of 2380 1720 7dvjv.exe 44 PID 1720 wrote to memory of 2380 1720 7dvjv.exe 44 PID 1720 wrote to memory of 2380 1720 7dvjv.exe 44 PID 1720 wrote to memory of 2380 1720 7dvjv.exe 44 PID 2380 wrote to memory of 2324 2380 fxxxxxf.exe 45 PID 2380 wrote to memory of 2324 2380 fxxxxxf.exe 45 PID 2380 wrote to memory of 2324 2380 fxxxxxf.exe 45 PID 2380 wrote to memory of 2324 2380 fxxxxxf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\abff855862c1ee7ad2007a2b7c7468726f6e3004fc4425255deb221fa7e9ae7c.exe"C:\Users\Admin\AppData\Local\Temp\abff855862c1ee7ad2007a2b7c7468726f6e3004fc4425255deb221fa7e9ae7c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\xrlrflx.exec:\xrlrflx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\ffrfxll.exec:\ffrfxll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\tbnthh.exec:\tbnthh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
\??\c:\jppvj.exec:\jppvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\1thtbn.exec:\1thtbn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\vvjpv.exec:\vvjpv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\bbtbnt.exec:\bbtbnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\rrxffxl.exec:\rrxffxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\nhnhth.exec:\nhnhth.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\jdpvj.exec:\jdpvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\fxrxfxl.exec:\fxrxfxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\pjpvp.exec:\pjpvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\xrllrxf.exec:\xrllrxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\7dvjv.exec:\7dvjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
\??\c:\fxxxxxf.exec:\fxxxxxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\nhbnhn.exec:\nhbnhn.exe17⤵
- Executes dropped EXE
PID:2324 -
\??\c:\ffrxfxl.exec:\ffrxfxl.exe18⤵
- Executes dropped EXE
PID:2028 -
\??\c:\btntnn.exec:\btntnn.exe19⤵
- Executes dropped EXE
PID:2488 -
\??\c:\xrllrxf.exec:\xrllrxf.exe20⤵
- Executes dropped EXE
PID:1792 -
\??\c:\nhbhnt.exec:\nhbhnt.exe21⤵
- Executes dropped EXE
PID:2672 -
\??\c:\xlrlxlf.exec:\xlrlxlf.exe22⤵
- Executes dropped EXE
PID:1668 -
\??\c:\flfxrfl.exec:\flfxrfl.exe23⤵
- Executes dropped EXE
PID:2668 -
\??\c:\vvpvj.exec:\vvpvj.exe24⤵
- Executes dropped EXE
PID:2760 -
\??\c:\xrllflx.exec:\xrllflx.exe25⤵
- Executes dropped EXE
PID:912 -
\??\c:\7jvdj.exec:\7jvdj.exe26⤵
- Executes dropped EXE
PID:1504 -
\??\c:\xrflxxl.exec:\xrflxxl.exe27⤵
- Executes dropped EXE
PID:852 -
\??\c:\jjvvj.exec:\jjvvj.exe28⤵
- Executes dropped EXE
PID:908 -
\??\c:\rlflrrl.exec:\rlflrrl.exe29⤵
- Executes dropped EXE
PID:2420 -
\??\c:\tthntt.exec:\tthntt.exe30⤵
- Executes dropped EXE
PID:2148 -
\??\c:\9pddp.exec:\9pddp.exe31⤵
- Executes dropped EXE
PID:1636 -
\??\c:\hbntbb.exec:\hbntbb.exe32⤵
- Executes dropped EXE
PID:2320 -
\??\c:\vpddj.exec:\vpddj.exe33⤵
- Executes dropped EXE
PID:2248 -
\??\c:\5hbtbb.exec:\5hbtbb.exe34⤵
- Executes dropped EXE
PID:1960 -
\??\c:\pjdjd.exec:\pjdjd.exe35⤵
- Executes dropped EXE
PID:1976 -
\??\c:\flfrflx.exec:\flfrflx.exe36⤵
- Executes dropped EXE
PID:2052 -
\??\c:\ntnhnt.exec:\ntnhnt.exe37⤵
- Executes dropped EXE
PID:2004 -
\??\c:\hhbtnb.exec:\hhbtnb.exe38⤵
- Executes dropped EXE
PID:2496 -
\??\c:\9jdjj.exec:\9jdjj.exe39⤵
- Executes dropped EXE
PID:2196 -
\??\c:\flfflrx.exec:\flfflrx.exe40⤵
- Executes dropped EXE
PID:1932 -
\??\c:\5thhnn.exec:\5thhnn.exe41⤵
- Executes dropped EXE
PID:2772 -
\??\c:\3pppv.exec:\3pppv.exe42⤵
- Executes dropped EXE
PID:2768 -
\??\c:\vjdjd.exec:\vjdjd.exe43⤵
- Executes dropped EXE
PID:2848 -
\??\c:\xxxfflx.exec:\xxxfflx.exe44⤵
- Executes dropped EXE
PID:2608 -
\??\c:\ttnbnt.exec:\ttnbnt.exe45⤵
- Executes dropped EXE
PID:2872 -
\??\c:\hhbbbh.exec:\hhbbbh.exe46⤵
- Executes dropped EXE
PID:2288 -
\??\c:\vppdv.exec:\vppdv.exe47⤵
- Executes dropped EXE
PID:2568 -
\??\c:\rlxxffl.exec:\rlxxffl.exe48⤵
- Executes dropped EXE
PID:2692 -
\??\c:\xrfflfr.exec:\xrfflfr.exe49⤵
- Executes dropped EXE
PID:2128 -
\??\c:\bbntbb.exec:\bbntbb.exe50⤵
- Executes dropped EXE
PID:2116 -
\??\c:\9pdpd.exec:\9pdpd.exe51⤵
- Executes dropped EXE
PID:2356 -
\??\c:\xxxxxfl.exec:\xxxxxfl.exe52⤵
- Executes dropped EXE
PID:1784 -
\??\c:\nbnhnh.exec:\nbnhnh.exe53⤵
- Executes dropped EXE
PID:1796 -
\??\c:\hhhhtb.exec:\hhhhtb.exe54⤵
- Executes dropped EXE
PID:1204 -
\??\c:\pjvvd.exec:\pjvvd.exe55⤵
- Executes dropped EXE
PID:1816 -
\??\c:\ffxrxxf.exec:\ffxrxxf.exe56⤵
- Executes dropped EXE
PID:2028 -
\??\c:\3nhnbn.exec:\3nhnbn.exe57⤵
- Executes dropped EXE
PID:2488 -
\??\c:\ppvpv.exec:\ppvpv.exe58⤵
- Executes dropped EXE
PID:2632 -
\??\c:\3dvpd.exec:\3dvpd.exe59⤵
- Executes dropped EXE
PID:3032 -
\??\c:\3rxxxxl.exec:\3rxxxxl.exe60⤵
- Executes dropped EXE
PID:2224 -
\??\c:\hhbhhh.exec:\hhbhhh.exe61⤵
- Executes dropped EXE
PID:2932 -
\??\c:\jjdvj.exec:\jjdvj.exe62⤵
- Executes dropped EXE
PID:760 -
\??\c:\vjddj.exec:\vjddj.exe63⤵
- Executes dropped EXE
PID:1036 -
\??\c:\7rfffrx.exec:\7rfffrx.exe64⤵
- Executes dropped EXE
PID:1632 -
\??\c:\tntttt.exec:\tntttt.exe65⤵
- Executes dropped EXE
PID:1540 -
\??\c:\nhbbtn.exec:\nhbbtn.exe66⤵PID:1360
-
\??\c:\vpjpv.exec:\vpjpv.exe67⤵PID:2788
-
\??\c:\llllxll.exec:\llllxll.exe68⤵PID:2420
-
\??\c:\nnhnhn.exec:\nnhnhn.exe69⤵PID:2172
-
\??\c:\vddvv.exec:\vddvv.exe70⤵PID:2524
-
\??\c:\5vjpv.exec:\5vjpv.exe71⤵PID:756
-
\??\c:\lxfrxxf.exec:\lxfrxxf.exe72⤵PID:2400
-
\??\c:\5nhnhn.exec:\5nhnhn.exe73⤵PID:2236
-
\??\c:\jdjpv.exec:\jdjpv.exe74⤵PID:1596
-
\??\c:\5jvdj.exec:\5jvdj.exe75⤵PID:1584
-
\??\c:\lxfflxl.exec:\lxfflxl.exe76⤵PID:1692
-
\??\c:\btbhtb.exec:\btbhtb.exe77⤵PID:2512
-
\??\c:\1nhntb.exec:\1nhntb.exe78⤵PID:844
-
\??\c:\9jdjv.exec:\9jdjv.exe79⤵PID:2328
-
\??\c:\fxflrlr.exec:\fxflrlr.exe80⤵PID:2504
-
\??\c:\fxlrxrl.exec:\fxlrxrl.exe81⤵PID:2184
-
\??\c:\nhhthh.exec:\nhhthh.exe82⤵PID:2776
-
\??\c:\ppdvj.exec:\ppdvj.exe83⤵PID:2716
-
\??\c:\pjvdv.exec:\pjvdv.exe84⤵PID:2720
-
\??\c:\rfrxxlr.exec:\rfrxxlr.exe85⤵PID:2308
-
\??\c:\9thhtt.exec:\9thhtt.exe86⤵PID:2952
-
\??\c:\nnttbh.exec:\nnttbh.exe87⤵
- System Location Discovery: System Language Discovery
PID:2744 -
\??\c:\vpvpv.exec:\vpvpv.exe88⤵PID:2572
-
\??\c:\rrlxxxl.exec:\rrlxxxl.exe89⤵PID:2648
-
\??\c:\llrflll.exec:\llrflll.exe90⤵PID:3048
-
\??\c:\thtntt.exec:\thtntt.exe91⤵PID:2808
-
\??\c:\jdvdj.exec:\jdvdj.exe92⤵PID:2464
-
\??\c:\xrllxxl.exec:\xrllxxl.exe93⤵PID:988
-
\??\c:\ttnbhn.exec:\ttnbhn.exe94⤵PID:396
-
\??\c:\jpjjp.exec:\jpjjp.exe95⤵PID:308
-
\??\c:\vvvvv.exec:\vvvvv.exe96⤵PID:1608
-
\??\c:\1xllrrl.exec:\1xllrrl.exe97⤵PID:2096
-
\??\c:\hbtbhn.exec:\hbtbhn.exe98⤵PID:1956
-
\??\c:\hbtbnh.exec:\hbtbnh.exe99⤵PID:1760
-
\??\c:\ppdjp.exec:\ppdjp.exe100⤵PID:2828
-
\??\c:\7rllxxl.exec:\7rllxxl.exe101⤵PID:2892
-
\??\c:\xxfrfrx.exec:\xxfrfrx.exe102⤵PID:1600
-
\??\c:\nnhbnt.exec:\nnhbnt.exe103⤵PID:2220
-
\??\c:\ppppd.exec:\ppppd.exe104⤵PID:2228
-
\??\c:\ffrrflx.exec:\ffrrflx.exe105⤵PID:1852
-
\??\c:\rlffllf.exec:\rlffllf.exe106⤵PID:1504
-
\??\c:\hbhtbb.exec:\hbhtbb.exe107⤵PID:324
-
\??\c:\vddjd.exec:\vddjd.exe108⤵PID:1532
-
\??\c:\dvpvd.exec:\dvpvd.exe109⤵PID:704
-
\??\c:\3llxrxr.exec:\3llxrxr.exe110⤵PID:940
-
\??\c:\nhtbnn.exec:\nhtbnn.exe111⤵PID:2068
-
\??\c:\bbbbbh.exec:\bbbbbh.exe112⤵PID:2264
-
\??\c:\7ddvd.exec:\7ddvd.exe113⤵PID:2396
-
\??\c:\rxxxrrl.exec:\rxxxrrl.exe114⤵PID:2088
-
\??\c:\hnbhnt.exec:\hnbhnt.exe115⤵PID:532
-
\??\c:\nhtbtt.exec:\nhtbtt.exe116⤵PID:2248
-
\??\c:\9dppv.exec:\9dppv.exe117⤵PID:1592
-
\??\c:\rllxrfl.exec:\rllxrfl.exe118⤵PID:1584
-
\??\c:\bbbbnt.exec:\bbbbnt.exe119⤵PID:1692
-
\??\c:\vvppj.exec:\vvppj.exe120⤵PID:1980
-
\??\c:\fffrrrf.exec:\fffrrrf.exe121⤵PID:2492
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-