Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 01:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
acd5f6be16fd28828f0c53f02b03e17bc2573ee9ea3021236c7d4ac7f1c9d7af.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
acd5f6be16fd28828f0c53f02b03e17bc2573ee9ea3021236c7d4ac7f1c9d7af.exe
-
Size
453KB
-
MD5
5cb0fe068e0095b13380f6a762545866
-
SHA1
0114c744a2dacf2c8f7f5535e833855a0dd30037
-
SHA256
acd5f6be16fd28828f0c53f02b03e17bc2573ee9ea3021236c7d4ac7f1c9d7af
-
SHA512
8b864fb4b72ecb8b9d418e8075bb533530679322b096988cde43035a1c80f3e64ea6c8ba7cc350559ba278ed19e2c7eae7aa2798d047b435a04d7cf3c98a211d
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeV:q7Tc2NYHUrAwfMp3CDV
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/2032-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-35-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2700-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2176-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-73-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/2608-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-96-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2608-94-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/980-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/980-114-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1948-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1488-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2248-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1352-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1880-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1636-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2436-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1420-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2052-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2096-301-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2100-305-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2516-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-390-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2268-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-423-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1916-456-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1040-482-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-651-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/632-682-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-1107-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2300-1206-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2900 xlflrfx.exe 1616 xxxfrrx.exe 2116 tntnth.exe 2700 jjpdv.exe 2796 llflxfl.exe 2176 dpddj.exe 2944 7frlrrl.exe 2756 ttnbtt.exe 2608 jddpd.exe 3068 5xlrxxr.exe 980 7dppv.exe 1560 fxlxlrf.exe 1948 jvpvp.exe 2848 nbnhtt.exe 2816 dvppd.exe 2948 tthtbn.exe 2224 3vpjp.exe 264 vjpdv.exe 1040 1lxfrrf.exe 1488 nnbhnn.exe 2248 jdvjv.exe 1136 rlfxrrx.exe 1352 nhbhbn.exe 772 pppdv.exe 1880 nhbnbb.exe 1636 rllxlrx.exe 2436 9bthbt.exe 1420 lllxflf.exe 2100 5hbhnn.exe 2052 xfrflxf.exe 2420 tnnbnt.exe 2096 5lrxxll.exe 2032 9nhnbb.exe 1596 jjdvp.exe 2516 7lxlrrf.exe 1732 bnbbnt.exe 2484 3hthnt.exe 2988 dvdvj.exe 2748 3frflxr.exe 2792 7thntt.exe 2984 dddpv.exe 2960 pdvpv.exe 2800 lxxxflx.exe 2884 tnhthh.exe 2664 pdvpv.exe 2868 rfxfffl.exe 1884 xflflxl.exe 2268 thhnnn.exe 1368 dvvdj.exe 2940 vjpvj.exe 2580 3frfrrx.exe 2920 nhbhtb.exe 2840 tbnhnn.exe 2692 ddvdp.exe 1916 lfxlrfx.exe 2064 xrfrflx.exe 568 5hnbnb.exe 1812 ppppp.exe 1040 fflflff.exe 1488 hbtbhh.exe 752 bnhhhb.exe 1956 1pppv.exe 2480 rrlrrrx.exe 1752 tnhtnn.exe -
resource yara_rule behavioral1/memory/2032-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-94-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/980-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1948-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1488-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1352-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1880-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1420-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1884-399-0x00000000002A0000-0x00000000002CA000-memory.dmp upx behavioral1/memory/2268-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1040-482-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-502-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-581-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-651-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/632-682-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-727-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/812-863-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-926-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/464-1074-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-1120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-1139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-1249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-1347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-1354-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrxlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrfflfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlrrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllxlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2032 wrote to memory of 2900 2032 acd5f6be16fd28828f0c53f02b03e17bc2573ee9ea3021236c7d4ac7f1c9d7af.exe 30 PID 2032 wrote to memory of 2900 2032 acd5f6be16fd28828f0c53f02b03e17bc2573ee9ea3021236c7d4ac7f1c9d7af.exe 30 PID 2032 wrote to memory of 2900 2032 acd5f6be16fd28828f0c53f02b03e17bc2573ee9ea3021236c7d4ac7f1c9d7af.exe 30 PID 2032 wrote to memory of 2900 2032 acd5f6be16fd28828f0c53f02b03e17bc2573ee9ea3021236c7d4ac7f1c9d7af.exe 30 PID 2900 wrote to memory of 1616 2900 xlflrfx.exe 31 PID 2900 wrote to memory of 1616 2900 xlflrfx.exe 31 PID 2900 wrote to memory of 1616 2900 xlflrfx.exe 31 PID 2900 wrote to memory of 1616 2900 xlflrfx.exe 31 PID 1616 wrote to memory of 2116 1616 xxxfrrx.exe 32 PID 1616 wrote to memory of 2116 1616 xxxfrrx.exe 32 PID 1616 wrote to memory of 2116 1616 xxxfrrx.exe 32 PID 1616 wrote to memory of 2116 1616 xxxfrrx.exe 32 PID 2116 wrote to memory of 2700 2116 tntnth.exe 33 PID 2116 wrote to memory of 2700 2116 tntnth.exe 33 PID 2116 wrote to memory of 2700 2116 tntnth.exe 33 PID 2116 wrote to memory of 2700 2116 tntnth.exe 33 PID 2700 wrote to memory of 2796 2700 jjpdv.exe 34 PID 2700 wrote to memory of 2796 2700 jjpdv.exe 34 PID 2700 wrote to memory of 2796 2700 jjpdv.exe 34 PID 2700 wrote to memory of 2796 2700 jjpdv.exe 34 PID 2796 wrote to memory of 2176 2796 llflxfl.exe 35 PID 2796 wrote to memory of 2176 2796 llflxfl.exe 35 PID 2796 wrote to memory of 2176 2796 llflxfl.exe 35 PID 2796 wrote to memory of 2176 2796 llflxfl.exe 35 PID 2176 wrote to memory of 2944 2176 dpddj.exe 36 PID 2176 wrote to memory of 2944 2176 dpddj.exe 36 PID 2176 wrote to memory of 2944 2176 dpddj.exe 36 PID 2176 wrote to memory of 2944 2176 dpddj.exe 36 PID 2944 wrote to memory of 2756 2944 7frlrrl.exe 37 PID 2944 wrote to memory of 2756 2944 7frlrrl.exe 37 PID 2944 wrote to memory of 2756 2944 7frlrrl.exe 37 PID 2944 wrote to memory of 2756 2944 7frlrrl.exe 37 PID 2756 wrote to memory of 2608 2756 ttnbtt.exe 38 PID 2756 wrote to memory of 2608 2756 ttnbtt.exe 38 PID 2756 wrote to memory of 2608 2756 ttnbtt.exe 38 PID 2756 wrote to memory of 2608 2756 ttnbtt.exe 38 PID 2608 wrote to memory of 3068 2608 jddpd.exe 39 PID 2608 wrote to memory of 3068 2608 jddpd.exe 39 PID 2608 wrote to memory of 3068 2608 jddpd.exe 39 PID 2608 wrote to memory of 3068 2608 jddpd.exe 39 PID 3068 wrote to memory of 980 3068 5xlrxxr.exe 40 PID 3068 wrote to memory of 980 3068 5xlrxxr.exe 40 PID 3068 wrote to memory of 980 3068 5xlrxxr.exe 40 PID 3068 wrote to memory of 980 3068 5xlrxxr.exe 40 PID 980 wrote to memory of 1560 980 7dppv.exe 41 PID 980 wrote to memory of 1560 980 7dppv.exe 41 PID 980 wrote to memory of 1560 980 7dppv.exe 41 PID 980 wrote to memory of 1560 980 7dppv.exe 41 PID 1560 wrote to memory of 1948 1560 fxlxlrf.exe 42 PID 1560 wrote to memory of 1948 1560 fxlxlrf.exe 42 PID 1560 wrote to memory of 1948 1560 fxlxlrf.exe 42 PID 1560 wrote to memory of 1948 1560 fxlxlrf.exe 42 PID 1948 wrote to memory of 2848 1948 jvpvp.exe 43 PID 1948 wrote to memory of 2848 1948 jvpvp.exe 43 PID 1948 wrote to memory of 2848 1948 jvpvp.exe 43 PID 1948 wrote to memory of 2848 1948 jvpvp.exe 43 PID 2848 wrote to memory of 2816 2848 nbnhtt.exe 44 PID 2848 wrote to memory of 2816 2848 nbnhtt.exe 44 PID 2848 wrote to memory of 2816 2848 nbnhtt.exe 44 PID 2848 wrote to memory of 2816 2848 nbnhtt.exe 44 PID 2816 wrote to memory of 2948 2816 dvppd.exe 45 PID 2816 wrote to memory of 2948 2816 dvppd.exe 45 PID 2816 wrote to memory of 2948 2816 dvppd.exe 45 PID 2816 wrote to memory of 2948 2816 dvppd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\acd5f6be16fd28828f0c53f02b03e17bc2573ee9ea3021236c7d4ac7f1c9d7af.exe"C:\Users\Admin\AppData\Local\Temp\acd5f6be16fd28828f0c53f02b03e17bc2573ee9ea3021236c7d4ac7f1c9d7af.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\xlflrfx.exec:\xlflrfx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\xxxfrrx.exec:\xxxfrrx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\tntnth.exec:\tntnth.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\jjpdv.exec:\jjpdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\llflxfl.exec:\llflxfl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\dpddj.exec:\dpddj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\7frlrrl.exec:\7frlrrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\ttnbtt.exec:\ttnbtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\jddpd.exec:\jddpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\5xlrxxr.exec:\5xlrxxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\7dppv.exec:\7dppv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
\??\c:\fxlxlrf.exec:\fxlxlrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\jvpvp.exec:\jvpvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\nbnhtt.exec:\nbnhtt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\dvppd.exec:\dvppd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\tthtbn.exec:\tthtbn.exe17⤵
- Executes dropped EXE
PID:2948 -
\??\c:\3vpjp.exec:\3vpjp.exe18⤵
- Executes dropped EXE
PID:2224 -
\??\c:\vjpdv.exec:\vjpdv.exe19⤵
- Executes dropped EXE
PID:264 -
\??\c:\1lxfrrf.exec:\1lxfrrf.exe20⤵
- Executes dropped EXE
PID:1040 -
\??\c:\nnbhnn.exec:\nnbhnn.exe21⤵
- Executes dropped EXE
PID:1488 -
\??\c:\jdvjv.exec:\jdvjv.exe22⤵
- Executes dropped EXE
PID:2248 -
\??\c:\rlfxrrx.exec:\rlfxrrx.exe23⤵
- Executes dropped EXE
PID:1136 -
\??\c:\nhbhbn.exec:\nhbhbn.exe24⤵
- Executes dropped EXE
PID:1352 -
\??\c:\pppdv.exec:\pppdv.exe25⤵
- Executes dropped EXE
PID:772 -
\??\c:\nhbnbb.exec:\nhbnbb.exe26⤵
- Executes dropped EXE
PID:1880 -
\??\c:\rllxlrx.exec:\rllxlrx.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1636 -
\??\c:\9bthbt.exec:\9bthbt.exe28⤵
- Executes dropped EXE
PID:2436 -
\??\c:\lllxflf.exec:\lllxflf.exe29⤵
- Executes dropped EXE
PID:1420 -
\??\c:\5hbhnn.exec:\5hbhnn.exe30⤵
- Executes dropped EXE
PID:2100 -
\??\c:\xfrflxf.exec:\xfrflxf.exe31⤵
- Executes dropped EXE
PID:2052 -
\??\c:\tnnbnt.exec:\tnnbnt.exe32⤵
- Executes dropped EXE
PID:2420 -
\??\c:\5lrxxll.exec:\5lrxxll.exe33⤵
- Executes dropped EXE
PID:2096 -
\??\c:\9nhnbb.exec:\9nhnbb.exe34⤵
- Executes dropped EXE
PID:2032 -
\??\c:\jjdvp.exec:\jjdvp.exe35⤵
- Executes dropped EXE
PID:1596 -
\??\c:\7lxlrrf.exec:\7lxlrrf.exe36⤵
- Executes dropped EXE
PID:2516 -
\??\c:\bnbbnt.exec:\bnbbnt.exe37⤵
- Executes dropped EXE
PID:1732 -
\??\c:\3hthnt.exec:\3hthnt.exe38⤵
- Executes dropped EXE
PID:2484 -
\??\c:\dvdvj.exec:\dvdvj.exe39⤵
- Executes dropped EXE
PID:2988 -
\??\c:\3frflxr.exec:\3frflxr.exe40⤵
- Executes dropped EXE
PID:2748 -
\??\c:\7thntt.exec:\7thntt.exe41⤵
- Executes dropped EXE
PID:2792 -
\??\c:\dddpv.exec:\dddpv.exe42⤵
- Executes dropped EXE
PID:2984 -
\??\c:\pdvpv.exec:\pdvpv.exe43⤵
- Executes dropped EXE
PID:2960 -
\??\c:\lxxxflx.exec:\lxxxflx.exe44⤵
- Executes dropped EXE
PID:2800 -
\??\c:\tnhthh.exec:\tnhthh.exe45⤵
- Executes dropped EXE
PID:2884 -
\??\c:\pdvpv.exec:\pdvpv.exe46⤵
- Executes dropped EXE
PID:2664 -
\??\c:\rfxfffl.exec:\rfxfffl.exe47⤵
- Executes dropped EXE
PID:2868 -
\??\c:\xflflxl.exec:\xflflxl.exe48⤵
- Executes dropped EXE
PID:1884 -
\??\c:\thhnnn.exec:\thhnnn.exe49⤵
- Executes dropped EXE
PID:2268 -
\??\c:\dvvdj.exec:\dvvdj.exe50⤵
- Executes dropped EXE
PID:1368 -
\??\c:\vjpvj.exec:\vjpvj.exe51⤵
- Executes dropped EXE
PID:2940 -
\??\c:\3frfrrx.exec:\3frfrrx.exe52⤵
- Executes dropped EXE
PID:2580 -
\??\c:\nhbhtb.exec:\nhbhtb.exe53⤵
- Executes dropped EXE
PID:2920 -
\??\c:\tbnhnn.exec:\tbnhnn.exe54⤵
- Executes dropped EXE
PID:2840 -
\??\c:\ddvdp.exec:\ddvdp.exe55⤵
- Executes dropped EXE
PID:2692 -
\??\c:\lfxlrfx.exec:\lfxlrfx.exe56⤵
- Executes dropped EXE
PID:1916 -
\??\c:\xrfrflx.exec:\xrfrflx.exe57⤵
- Executes dropped EXE
PID:2064 -
\??\c:\5hnbnb.exec:\5hnbnb.exe58⤵
- Executes dropped EXE
PID:568 -
\??\c:\ppppp.exec:\ppppp.exe59⤵
- Executes dropped EXE
PID:1812 -
\??\c:\fflflff.exec:\fflflff.exe60⤵
- Executes dropped EXE
PID:1040 -
\??\c:\hbtbhh.exec:\hbtbhh.exe61⤵
- Executes dropped EXE
PID:1488 -
\??\c:\bnhhhb.exec:\bnhhhb.exe62⤵
- Executes dropped EXE
PID:752 -
\??\c:\1pppv.exec:\1pppv.exe63⤵
- Executes dropped EXE
PID:1956 -
\??\c:\rrlrrrx.exec:\rrlrrrx.exe64⤵
- Executes dropped EXE
PID:2480 -
\??\c:\tnhtnn.exec:\tnhtnn.exe65⤵
- Executes dropped EXE
PID:1752 -
\??\c:\thnnbb.exec:\thnnbb.exe66⤵PID:688
-
\??\c:\vvjpv.exec:\vvjpv.exe67⤵PID:1544
-
\??\c:\dvjdd.exec:\dvjdd.exe68⤵PID:492
-
\??\c:\rlxxlxf.exec:\rlxxlxf.exe69⤵PID:892
-
\??\c:\bhhhtt.exec:\bhhhtt.exe70⤵PID:2104
-
\??\c:\jdvvp.exec:\jdvvp.exe71⤵PID:2504
-
\??\c:\vjjjp.exec:\vjjjp.exe72⤵PID:2140
-
\??\c:\frllxxr.exec:\frllxxr.exe73⤵PID:2428
-
\??\c:\7bthbh.exec:\7bthbh.exe74⤵PID:2180
-
\??\c:\bbttbt.exec:\bbttbt.exe75⤵PID:1748
-
\??\c:\jjvdv.exec:\jjvdv.exe76⤵PID:1756
-
\??\c:\1fxrxlx.exec:\1fxrxlx.exe77⤵PID:2004
-
\??\c:\3xlxfrx.exec:\3xlxfrx.exe78⤵PID:2500
-
\??\c:\bbtthh.exec:\bbtthh.exe79⤵PID:2032
-
\??\c:\tnhbhh.exec:\tnhbhh.exe80⤵PID:2560
-
\??\c:\jvdjv.exec:\jvdjv.exe81⤵PID:2516
-
\??\c:\9frrxff.exec:\9frrxff.exe82⤵PID:2520
-
\??\c:\tnhtnt.exec:\tnhtnt.exe83⤵PID:2776
-
\??\c:\nbnntt.exec:\nbnntt.exe84⤵PID:2988
-
\??\c:\dpddp.exec:\dpddp.exe85⤵PID:2724
-
\??\c:\3frrrxx.exec:\3frrrxx.exe86⤵PID:2744
-
\??\c:\1fxflrl.exec:\1fxflrl.exe87⤵PID:2176
-
\??\c:\tnbbhh.exec:\tnbbhh.exe88⤵PID:2876
-
\??\c:\jvjpj.exec:\jvjpj.exe89⤵PID:2640
-
\??\c:\dpjjv.exec:\dpjjv.exe90⤵PID:2588
-
\??\c:\1lfxxxf.exec:\1lfxxxf.exe91⤵PID:2644
-
\??\c:\7nnnhh.exec:\7nnnhh.exe92⤵PID:1044
-
\??\c:\btnbbh.exec:\btnbbh.exe93⤵PID:632
-
\??\c:\ddjpp.exec:\ddjpp.exe94⤵PID:1884
-
\??\c:\1lrrrlx.exec:\1lrrrlx.exe95⤵PID:1480
-
\??\c:\9bbhtt.exec:\9bbhtt.exe96⤵PID:1092
-
\??\c:\nhbbhh.exec:\nhbbhh.exe97⤵PID:2940
-
\??\c:\dvjjd.exec:\dvjjd.exe98⤵PID:2660
-
\??\c:\xllfxrr.exec:\xllfxrr.exe99⤵PID:1744
-
\??\c:\5thntt.exec:\5thntt.exe100⤵PID:1664
-
\??\c:\vpvjd.exec:\vpvjd.exe101⤵PID:2692
-
\??\c:\fxrxlrx.exec:\fxrxlrx.exe102⤵PID:1916
-
\??\c:\tnhthn.exec:\tnhthn.exe103⤵PID:1496
-
\??\c:\bhhhnb.exec:\bhhhnb.exe104⤵PID:2092
-
\??\c:\pjddp.exec:\pjddp.exe105⤵PID:984
-
\??\c:\vvvpd.exec:\vvvpd.exe106⤵PID:1372
-
\??\c:\flfrfrr.exec:\flfrfrr.exe107⤵PID:1060
-
\??\c:\3hnbbn.exec:\3hnbbn.exe108⤵PID:1960
-
\??\c:\vdvdv.exec:\vdvdv.exe109⤵PID:1136
-
\??\c:\lflxlrl.exec:\lflxlrl.exe110⤵PID:608
-
\??\c:\frlrfrf.exec:\frlrfrf.exe111⤵PID:464
-
\??\c:\bbbhbb.exec:\bbbhbb.exe112⤵PID:1656
-
\??\c:\vpddp.exec:\vpddp.exe113⤵PID:1604
-
\??\c:\lrrxflx.exec:\lrrxflx.exe114⤵PID:2328
-
\??\c:\rrrxrlf.exec:\rrrxrlf.exe115⤵PID:1540
-
\??\c:\1htttb.exec:\1htttb.exe116⤵PID:2124
-
\??\c:\1vppv.exec:\1vppv.exe117⤵PID:1608
-
\??\c:\1lfrfxl.exec:\1lfrfxl.exe118⤵PID:2120
-
\??\c:\7flxlrf.exec:\7flxlrf.exe119⤵PID:1492
-
\??\c:\nhbbtb.exec:\nhbbtb.exe120⤵PID:1912
-
\??\c:\7jvdj.exec:\7jvdj.exe121⤵PID:1928
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-