Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 03:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4ee035a1c99acbc08f978adbcf231c9a3ec699fabaf4fe7967987c152b3a22c0.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
4ee035a1c99acbc08f978adbcf231c9a3ec699fabaf4fe7967987c152b3a22c0.exe
-
Size
453KB
-
MD5
7c4ee55372a70b6196c4e9f4e630c8f3
-
SHA1
0f74b176d10d0bf4b37aca649c3d30e4843f4324
-
SHA256
4ee035a1c99acbc08f978adbcf231c9a3ec699fabaf4fe7967987c152b3a22c0
-
SHA512
f69a48e34352aac3fe35d29e3c41045eddf667833d11e33803e064da38271070e5566c8edd2984c65509ff70c09175a1647b412274da7782922fe9b57622e984
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeY:q7Tc2NYHUrAwfMp3CDY
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/2540-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2428-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2192-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-71-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/300-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1388-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-193-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3036-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1016-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1248-227-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1016-212-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2336-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1248-232-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2168-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2052-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2356-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2008-301-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1628-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2192-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2296-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2524-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-422-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2452-436-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1768-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-482-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1416-558-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2408-571-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1956-590-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1956-591-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-617-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-930-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2900-970-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2900-969-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1800-1033-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1416-1108-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2972-1211-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/340-1280-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/444-1310-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2428 hbtthn.exe 2680 7dvjj.exe 2192 rrflrrl.exe 2740 nhbhhb.exe 2872 pjjvp.exe 2732 7xrrrlf.exe 2636 lfxfrrl.exe 2744 pdvvj.exe 2620 lfxfrxl.exe 2172 xlxfxfl.exe 2388 xrllflf.exe 300 1htbhb.exe 1388 jdvjd.exe 2844 pjvpv.exe 2784 1dvdv.exe 2304 lfxrflf.exe 2512 7dvdv.exe 2548 nhbbhn.exe 1612 pjjpd.exe 876 lrlrrxf.exe 3036 btbbtb.exe 480 jdppd.exe 1016 xxrrffx.exe 404 btnbhn.exe 1248 ffrflrf.exe 2336 xxlxrrf.exe 2168 rrlxlrf.exe 2052 fxrxlrl.exe 2368 ffrrrxr.exe 1416 pvppd.exe 1780 7lxrrxx.exe 2356 ppjvj.exe 2008 1vjjp.exe 1628 fxrrxrf.exe 2036 1djpd.exe 1976 3jjjd.exe 2192 7fxrffr.exe 2868 bbbntb.exe 2860 1nbhnn.exe 2608 pdvvv.exe 2876 rlrlrrx.exe 1904 fxfxxxf.exe 2796 1tnbnn.exe 2664 jpjdp.exe 1608 xrlxxrx.exe 2296 bhhthb.exe 2524 vjvdp.exe 488 1jvvv.exe 1252 7lrrffl.exe 2912 bhnttt.exe 2668 bntthh.exe 2980 jdppv.exe 2452 3xrrffl.exe 1768 rxfrrlx.exe 2012 hbtnhh.exe 1712 vpjjp.exe 2424 xlrllxr.exe 564 nhtbhn.exe 1972 5httbh.exe 2580 pdpvj.exe 480 1lrrffl.exe 2696 nnhthn.exe 2248 tnbbhn.exe 1280 vpjpv.exe -
resource yara_rule behavioral1/memory/2540-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/300-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1388-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/300-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1388-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/404-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1016-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1768-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1768-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/908-526-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1416-558-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-565-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-571-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-591-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-604-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-617-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/624-752-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1092-765-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-778-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1532-827-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-969-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1884-989-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-1033-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1416-1101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1416-1108-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1436-1212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-1237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1248-1326-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nhhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxfxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrrrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1btbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2540 wrote to memory of 2428 2540 4ee035a1c99acbc08f978adbcf231c9a3ec699fabaf4fe7967987c152b3a22c0.exe 30 PID 2540 wrote to memory of 2428 2540 4ee035a1c99acbc08f978adbcf231c9a3ec699fabaf4fe7967987c152b3a22c0.exe 30 PID 2540 wrote to memory of 2428 2540 4ee035a1c99acbc08f978adbcf231c9a3ec699fabaf4fe7967987c152b3a22c0.exe 30 PID 2540 wrote to memory of 2428 2540 4ee035a1c99acbc08f978adbcf231c9a3ec699fabaf4fe7967987c152b3a22c0.exe 30 PID 2428 wrote to memory of 2680 2428 hbtthn.exe 31 PID 2428 wrote to memory of 2680 2428 hbtthn.exe 31 PID 2428 wrote to memory of 2680 2428 hbtthn.exe 31 PID 2428 wrote to memory of 2680 2428 hbtthn.exe 31 PID 2680 wrote to memory of 2192 2680 7dvjj.exe 32 PID 2680 wrote to memory of 2192 2680 7dvjj.exe 32 PID 2680 wrote to memory of 2192 2680 7dvjj.exe 32 PID 2680 wrote to memory of 2192 2680 7dvjj.exe 32 PID 2192 wrote to memory of 2740 2192 rrflrrl.exe 33 PID 2192 wrote to memory of 2740 2192 rrflrrl.exe 33 PID 2192 wrote to memory of 2740 2192 rrflrrl.exe 33 PID 2192 wrote to memory of 2740 2192 rrflrrl.exe 33 PID 2740 wrote to memory of 2872 2740 nhbhhb.exe 34 PID 2740 wrote to memory of 2872 2740 nhbhhb.exe 34 PID 2740 wrote to memory of 2872 2740 nhbhhb.exe 34 PID 2740 wrote to memory of 2872 2740 nhbhhb.exe 34 PID 2872 wrote to memory of 2732 2872 pjjvp.exe 35 PID 2872 wrote to memory of 2732 2872 pjjvp.exe 35 PID 2872 wrote to memory of 2732 2872 pjjvp.exe 35 PID 2872 wrote to memory of 2732 2872 pjjvp.exe 35 PID 2732 wrote to memory of 2636 2732 7xrrrlf.exe 36 PID 2732 wrote to memory of 2636 2732 7xrrrlf.exe 36 PID 2732 wrote to memory of 2636 2732 7xrrrlf.exe 36 PID 2732 wrote to memory of 2636 2732 7xrrrlf.exe 36 PID 2636 wrote to memory of 2744 2636 lfxfrrl.exe 37 PID 2636 wrote to memory of 2744 2636 lfxfrrl.exe 37 PID 2636 wrote to memory of 2744 2636 lfxfrrl.exe 37 PID 2636 wrote to memory of 2744 2636 lfxfrrl.exe 37 PID 2744 wrote to memory of 2620 2744 pdvvj.exe 38 PID 2744 wrote to memory of 2620 2744 pdvvj.exe 38 PID 2744 wrote to memory of 2620 2744 pdvvj.exe 38 PID 2744 wrote to memory of 2620 2744 pdvvj.exe 38 PID 2620 wrote to memory of 2172 2620 lfxfrxl.exe 39 PID 2620 wrote to memory of 2172 2620 lfxfrxl.exe 39 PID 2620 wrote to memory of 2172 2620 lfxfrxl.exe 39 PID 2620 wrote to memory of 2172 2620 lfxfrxl.exe 39 PID 2172 wrote to memory of 2388 2172 xlxfxfl.exe 40 PID 2172 wrote to memory of 2388 2172 xlxfxfl.exe 40 PID 2172 wrote to memory of 2388 2172 xlxfxfl.exe 40 PID 2172 wrote to memory of 2388 2172 xlxfxfl.exe 40 PID 2388 wrote to memory of 300 2388 xrllflf.exe 41 PID 2388 wrote to memory of 300 2388 xrllflf.exe 41 PID 2388 wrote to memory of 300 2388 xrllflf.exe 41 PID 2388 wrote to memory of 300 2388 xrllflf.exe 41 PID 300 wrote to memory of 1388 300 1htbhb.exe 42 PID 300 wrote to memory of 1388 300 1htbhb.exe 42 PID 300 wrote to memory of 1388 300 1htbhb.exe 42 PID 300 wrote to memory of 1388 300 1htbhb.exe 42 PID 1388 wrote to memory of 2844 1388 jdvjd.exe 43 PID 1388 wrote to memory of 2844 1388 jdvjd.exe 43 PID 1388 wrote to memory of 2844 1388 jdvjd.exe 43 PID 1388 wrote to memory of 2844 1388 jdvjd.exe 43 PID 2844 wrote to memory of 2784 2844 pjvpv.exe 44 PID 2844 wrote to memory of 2784 2844 pjvpv.exe 44 PID 2844 wrote to memory of 2784 2844 pjvpv.exe 44 PID 2844 wrote to memory of 2784 2844 pjvpv.exe 44 PID 2784 wrote to memory of 2304 2784 1dvdv.exe 45 PID 2784 wrote to memory of 2304 2784 1dvdv.exe 45 PID 2784 wrote to memory of 2304 2784 1dvdv.exe 45 PID 2784 wrote to memory of 2304 2784 1dvdv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ee035a1c99acbc08f978adbcf231c9a3ec699fabaf4fe7967987c152b3a22c0.exe"C:\Users\Admin\AppData\Local\Temp\4ee035a1c99acbc08f978adbcf231c9a3ec699fabaf4fe7967987c152b3a22c0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\hbtthn.exec:\hbtthn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\7dvjj.exec:\7dvjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\rrflrrl.exec:\rrflrrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\nhbhhb.exec:\nhbhhb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\pjjvp.exec:\pjjvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\7xrrrlf.exec:\7xrrrlf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\lfxfrrl.exec:\lfxfrrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\pdvvj.exec:\pdvvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\lfxfrxl.exec:\lfxfrxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\xlxfxfl.exec:\xlxfxfl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\xrllflf.exec:\xrllflf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\1htbhb.exec:\1htbhb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:300 -
\??\c:\jdvjd.exec:\jdvjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\pjvpv.exec:\pjvpv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\1dvdv.exec:\1dvdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\lfxrflf.exec:\lfxrflf.exe17⤵
- Executes dropped EXE
PID:2304 -
\??\c:\7dvdv.exec:\7dvdv.exe18⤵
- Executes dropped EXE
PID:2512 -
\??\c:\nhbbhn.exec:\nhbbhn.exe19⤵
- Executes dropped EXE
PID:2548 -
\??\c:\pjjpd.exec:\pjjpd.exe20⤵
- Executes dropped EXE
PID:1612 -
\??\c:\lrlrrxf.exec:\lrlrrxf.exe21⤵
- Executes dropped EXE
PID:876 -
\??\c:\btbbtb.exec:\btbbtb.exe22⤵
- Executes dropped EXE
PID:3036 -
\??\c:\jdppd.exec:\jdppd.exe23⤵
- Executes dropped EXE
PID:480 -
\??\c:\xxrrffx.exec:\xxrrffx.exe24⤵
- Executes dropped EXE
PID:1016 -
\??\c:\btnbhn.exec:\btnbhn.exe25⤵
- Executes dropped EXE
PID:404 -
\??\c:\ffrflrf.exec:\ffrflrf.exe26⤵
- Executes dropped EXE
PID:1248 -
\??\c:\xxlxrrf.exec:\xxlxrrf.exe27⤵
- Executes dropped EXE
PID:2336 -
\??\c:\rrlxlrf.exec:\rrlxlrf.exe28⤵
- Executes dropped EXE
PID:2168 -
\??\c:\fxrxlrl.exec:\fxrxlrl.exe29⤵
- Executes dropped EXE
PID:2052 -
\??\c:\ffrrrxr.exec:\ffrrrxr.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2368 -
\??\c:\pvppd.exec:\pvppd.exe31⤵
- Executes dropped EXE
PID:1416 -
\??\c:\7lxrrxx.exec:\7lxrrxx.exe32⤵
- Executes dropped EXE
PID:1780 -
\??\c:\ppjvj.exec:\ppjvj.exe33⤵
- Executes dropped EXE
PID:2356 -
\??\c:\1vjjp.exec:\1vjjp.exe34⤵
- Executes dropped EXE
PID:2008 -
\??\c:\fxrrxrf.exec:\fxrrxrf.exe35⤵
- Executes dropped EXE
PID:1628 -
\??\c:\1djpd.exec:\1djpd.exe36⤵
- Executes dropped EXE
PID:2036 -
\??\c:\3jjjd.exec:\3jjjd.exe37⤵
- Executes dropped EXE
PID:1976 -
\??\c:\7fxrffr.exec:\7fxrffr.exe38⤵
- Executes dropped EXE
PID:2192 -
\??\c:\bbbntb.exec:\bbbntb.exe39⤵
- Executes dropped EXE
PID:2868 -
\??\c:\1nbhnn.exec:\1nbhnn.exe40⤵
- Executes dropped EXE
PID:2860 -
\??\c:\pdvvv.exec:\pdvvv.exe41⤵
- Executes dropped EXE
PID:2608 -
\??\c:\rlrlrrx.exec:\rlrlrrx.exe42⤵
- Executes dropped EXE
PID:2876 -
\??\c:\fxfxxxf.exec:\fxfxxxf.exe43⤵
- Executes dropped EXE
PID:1904 -
\??\c:\1tnbnn.exec:\1tnbnn.exe44⤵
- Executes dropped EXE
PID:2796 -
\??\c:\jpjdp.exec:\jpjdp.exe45⤵
- Executes dropped EXE
PID:2664 -
\??\c:\xrlxxrx.exec:\xrlxxrx.exe46⤵
- Executes dropped EXE
PID:1608 -
\??\c:\bhhthb.exec:\bhhthb.exe47⤵
- Executes dropped EXE
PID:2296 -
\??\c:\vjvdp.exec:\vjvdp.exe48⤵
- Executes dropped EXE
PID:2524 -
\??\c:\1jvvv.exec:\1jvvv.exe49⤵
- Executes dropped EXE
PID:488 -
\??\c:\7lrrffl.exec:\7lrrffl.exe50⤵
- Executes dropped EXE
PID:1252 -
\??\c:\bhnttt.exec:\bhnttt.exe51⤵
- Executes dropped EXE
PID:2912 -
\??\c:\bntthh.exec:\bntthh.exe52⤵
- Executes dropped EXE
PID:2668 -
\??\c:\jdppv.exec:\jdppv.exe53⤵
- Executes dropped EXE
PID:2980 -
\??\c:\3xrrffl.exec:\3xrrffl.exe54⤵
- Executes dropped EXE
PID:2452 -
\??\c:\rxfrrlx.exec:\rxfrrlx.exe55⤵
- Executes dropped EXE
PID:1768 -
\??\c:\hbtnhh.exec:\hbtnhh.exe56⤵
- Executes dropped EXE
PID:2012 -
\??\c:\vpjjp.exec:\vpjjp.exe57⤵
- Executes dropped EXE
PID:1712 -
\??\c:\xlrllxr.exec:\xlrllxr.exe58⤵
- Executes dropped EXE
PID:2424 -
\??\c:\nhtbhn.exec:\nhtbhn.exe59⤵
- Executes dropped EXE
PID:564 -
\??\c:\5httbh.exec:\5httbh.exe60⤵
- Executes dropped EXE
PID:1972 -
\??\c:\pdpvj.exec:\pdpvj.exe61⤵
- Executes dropped EXE
PID:2580 -
\??\c:\1lrrffl.exec:\1lrrffl.exe62⤵
- Executes dropped EXE
PID:480 -
\??\c:\nnhthn.exec:\nnhthn.exe63⤵
- Executes dropped EXE
PID:2696 -
\??\c:\tnbbhn.exec:\tnbbhn.exe64⤵
- Executes dropped EXE
PID:2248 -
\??\c:\vpjpv.exec:\vpjpv.exe65⤵
- Executes dropped EXE
PID:1280 -
\??\c:\llfrxxr.exec:\llfrxxr.exe66⤵PID:680
-
\??\c:\fffrxfl.exec:\fffrxfl.exe67⤵PID:684
-
\??\c:\hhnnht.exec:\hhnnht.exe68⤵PID:552
-
\??\c:\jjdjv.exec:\jjdjv.exe69⤵PID:908
-
\??\c:\llxrxrf.exec:\llxrxrf.exe70⤵PID:2504
-
\??\c:\hbttbh.exec:\hbttbh.exe71⤵PID:1844
-
\??\c:\3thnnt.exec:\3thnnt.exe72⤵PID:2284
-
\??\c:\djjvd.exec:\djjvd.exe73⤵PID:1416
-
\??\c:\xfxfxxl.exec:\xfxfxxl.exe74⤵PID:900
-
\??\c:\hhbnbn.exec:\hhbnbn.exe75⤵PID:2408
-
\??\c:\1btbnn.exec:\1btbnn.exe76⤵
- System Location Discovery: System Language Discovery
PID:1520 -
\??\c:\ddvdp.exec:\ddvdp.exe77⤵PID:1632
-
\??\c:\7fxxflr.exec:\7fxxflr.exe78⤵PID:1956
-
\??\c:\nnhtbb.exec:\nnhtbb.exe79⤵PID:2344
-
\??\c:\7htnbb.exec:\7htnbb.exe80⤵PID:1976
-
\??\c:\7jdjp.exec:\7jdjp.exe81⤵PID:2736
-
\??\c:\rrflfxr.exec:\rrflfxr.exe82⤵PID:2868
-
\??\c:\nhhtnt.exec:\nhhtnt.exe83⤵PID:2832
-
\??\c:\btbnbh.exec:\btbnbh.exe84⤵PID:2608
-
\??\c:\vpjvd.exec:\vpjvd.exe85⤵PID:940
-
\??\c:\5xlrrrf.exec:\5xlrrrf.exe86⤵PID:2712
-
\??\c:\xxxflrf.exec:\xxxflrf.exe87⤵PID:2632
-
\??\c:\hhtnhh.exec:\hhtnhh.exe88⤵PID:2500
-
\??\c:\jjdpv.exec:\jjdpv.exe89⤵PID:2556
-
\??\c:\rxlrffx.exec:\rxlrffx.exe90⤵PID:2904
-
\??\c:\rrllrxl.exec:\rrllrxl.exe91⤵PID:1760
-
\??\c:\nhbhbn.exec:\nhbhbn.exe92⤵PID:660
-
\??\c:\jjvdj.exec:\jjvdj.exe93⤵PID:1232
-
\??\c:\pdvpv.exec:\pdvpv.exe94⤵PID:2920
-
\??\c:\5frxxxr.exec:\5frxxxr.exe95⤵PID:2332
-
\??\c:\lxlrrlf.exec:\lxlrrlf.exe96⤵PID:2700
-
\??\c:\1hhtth.exec:\1hhtth.exe97⤵PID:2992
-
\??\c:\ppddp.exec:\ppddp.exe98⤵PID:2836
-
\??\c:\rxfxffr.exec:\rxfxffr.exe99⤵PID:2016
-
\??\c:\tnbtth.exec:\tnbtth.exe100⤵PID:1676
-
\??\c:\7bbnth.exec:\7bbnth.exe101⤵PID:1704
-
\??\c:\vdjdp.exec:\vdjdp.exe102⤵PID:1612
-
\??\c:\rrflxfr.exec:\rrflxfr.exe103⤵PID:876
-
\??\c:\3flfffr.exec:\3flfffr.exe104⤵PID:980
-
\??\c:\tttbbb.exec:\tttbbb.exe105⤵PID:624
-
\??\c:\pjdjv.exec:\pjdjv.exe106⤵PID:864
-
\??\c:\rfxfrxf.exec:\rfxfrxf.exe107⤵PID:1092
-
\??\c:\7rflrxf.exec:\7rflrxf.exe108⤵PID:1708
-
\??\c:\9hbhnt.exec:\9hbhnt.exe109⤵PID:1616
-
\??\c:\dpjjp.exec:\dpjjp.exe110⤵PID:108
-
\??\c:\vpdvp.exec:\vpdvp.exe111⤵PID:776
-
\??\c:\7xlfllr.exec:\7xlfllr.exe112⤵PID:1644
-
\??\c:\7nbhtb.exec:\7nbhtb.exe113⤵PID:1920
-
\??\c:\hhhnnb.exec:\hhhnnb.exe114⤵PID:1916
-
\??\c:\jjjpj.exec:\jjjpj.exe115⤵PID:1912
-
\??\c:\ppjvp.exec:\ppjvp.exe116⤵PID:3048
-
\??\c:\9llrxlx.exec:\9llrxlx.exe117⤵PID:1532
-
\??\c:\bhtnhn.exec:\bhtnhn.exe118⤵PID:1776
-
\??\c:\vvpvj.exec:\vvpvj.exe119⤵PID:2356
-
\??\c:\3pjvp.exec:\3pjvp.exe120⤵PID:2684
-
\??\c:\3flrxxf.exec:\3flrxxf.exe121⤵PID:1528
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-