Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 02:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
be0410a0f07686fd96d0f7f080f3df092da689a10046d079e6f6676e6ca7375a.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
be0410a0f07686fd96d0f7f080f3df092da689a10046d079e6f6676e6ca7375a.exe
-
Size
454KB
-
MD5
cce554fed4c9f0af46846315bf5ca25e
-
SHA1
68413056d683711c1101a252bb35f583f5ff6608
-
SHA256
be0410a0f07686fd96d0f7f080f3df092da689a10046d079e6f6676e6ca7375a
-
SHA512
fc75cc3fb22720434a8f7200e5e70ab5ce87ae6a48dafecdec0b07060cc21519de810131228b0f6cabe75131692970af929129ce9f80d359e84d6fa3ee315f50
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeQ:q7Tc2NYHUrAwfMp3CDQ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 51 IoCs
resource yara_rule behavioral1/memory/2508-0-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1320-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2008-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-98-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1628-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/840-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1304-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/840-151-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2944-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1836-165-0x0000000001C70000-0x0000000001C9A000-memory.dmp family_blackmoon behavioral1/memory/980-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/980-195-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/980-194-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1284-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1952-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2152-255-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon behavioral1/memory/2476-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-290-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1816-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1264-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-378-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2660-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/840-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-411-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-423-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/844-436-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1780-509-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1680-521-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2972-634-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-677-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2000-722-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1948-806-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2180-808-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1308-966-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2668-979-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/956-1024-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2076-1073-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3048-1098-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1528-1320-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2412-1328-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1320 7dpjj.exe 2540 5dpvj.exe 2124 9nnhtt.exe 2008 3frxffr.exe 2880 bnbnnh.exe 2724 pppjd.exe 2924 nnnhbn.exe 2624 llflxfr.exe 2908 lfrrflr.exe 2660 bbtnbt.exe 1408 3xllrxf.exe 840 ppjjp.exe 1628 xxllrrf.exe 2824 tttttb.exe 2944 flflxrx.exe 1304 dpppv.exe 1836 7dvdd.exe 1176 dvpdv.exe 2064 5jjjp.exe 980 xfxfxxl.exe 1404 vppjp.exe 1284 rxxfxxl.exe 1952 frxfxfx.exe 324 vvpvj.exe 2224 xrffxfl.exe 2196 nnhtht.exe 2152 1dvdp.exe 3056 ffxxflx.exe 2476 9ntttt.exe 1652 fffrxfr.exe 3024 tnhhtt.exe 1816 jjddj.exe 2504 rrllxfr.exe 1264 jdpjj.exe 2784 1vvjv.exe 2168 lffflrf.exe 2008 hhthht.exe 2748 btntht.exe 2732 pjvjv.exe 3012 rlxflrx.exe 2972 ttbnbb.exe 2736 hhbhnb.exe 2592 9pppp.exe 2672 llxxffx.exe 2660 nnbbnn.exe 2056 jjdpv.exe 2432 ddvjp.exe 840 1lflllr.exe 2300 nnntbh.exe 2688 bbtbht.exe 2940 jppvj.exe 2656 xlllrff.exe 844 xxxlrfl.exe 2364 5nhthn.exe 2120 ddvdv.exe 1996 djjdd.exe 1800 3rlrxfr.exe 2072 1bthnn.exe 1828 nthhtb.exe 1632 jdjjp.exe 1404 lfxfrrf.exe 1284 fffxlrf.exe 1328 tnnttb.exe 1784 ppvpv.exe -
resource yara_rule behavioral1/memory/2508-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1320-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-69-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2924-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-89-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1408-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/840-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1304-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1176-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/980-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1284-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2476-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-290-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1816-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1264-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-378-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2660-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/840-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/844-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1780-509-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/300-547-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-566-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2284-591-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-634-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-722-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-809-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-979-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2012-992-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1432-1241-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrxlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlflrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hthth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lfxfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pdvd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2508 wrote to memory of 1320 2508 be0410a0f07686fd96d0f7f080f3df092da689a10046d079e6f6676e6ca7375a.exe 30 PID 2508 wrote to memory of 1320 2508 be0410a0f07686fd96d0f7f080f3df092da689a10046d079e6f6676e6ca7375a.exe 30 PID 2508 wrote to memory of 1320 2508 be0410a0f07686fd96d0f7f080f3df092da689a10046d079e6f6676e6ca7375a.exe 30 PID 2508 wrote to memory of 1320 2508 be0410a0f07686fd96d0f7f080f3df092da689a10046d079e6f6676e6ca7375a.exe 30 PID 1320 wrote to memory of 2540 1320 7dpjj.exe 31 PID 1320 wrote to memory of 2540 1320 7dpjj.exe 31 PID 1320 wrote to memory of 2540 1320 7dpjj.exe 31 PID 1320 wrote to memory of 2540 1320 7dpjj.exe 31 PID 2540 wrote to memory of 2124 2540 5dpvj.exe 32 PID 2540 wrote to memory of 2124 2540 5dpvj.exe 32 PID 2540 wrote to memory of 2124 2540 5dpvj.exe 32 PID 2540 wrote to memory of 2124 2540 5dpvj.exe 32 PID 2124 wrote to memory of 2008 2124 9nnhtt.exe 33 PID 2124 wrote to memory of 2008 2124 9nnhtt.exe 33 PID 2124 wrote to memory of 2008 2124 9nnhtt.exe 33 PID 2124 wrote to memory of 2008 2124 9nnhtt.exe 33 PID 2008 wrote to memory of 2880 2008 3frxffr.exe 34 PID 2008 wrote to memory of 2880 2008 3frxffr.exe 34 PID 2008 wrote to memory of 2880 2008 3frxffr.exe 34 PID 2008 wrote to memory of 2880 2008 3frxffr.exe 34 PID 2880 wrote to memory of 2724 2880 bnbnnh.exe 35 PID 2880 wrote to memory of 2724 2880 bnbnnh.exe 35 PID 2880 wrote to memory of 2724 2880 bnbnnh.exe 35 PID 2880 wrote to memory of 2724 2880 bnbnnh.exe 35 PID 2724 wrote to memory of 2924 2724 pppjd.exe 36 PID 2724 wrote to memory of 2924 2724 pppjd.exe 36 PID 2724 wrote to memory of 2924 2724 pppjd.exe 36 PID 2724 wrote to memory of 2924 2724 pppjd.exe 36 PID 2924 wrote to memory of 2624 2924 nnnhbn.exe 37 PID 2924 wrote to memory of 2624 2924 nnnhbn.exe 37 PID 2924 wrote to memory of 2624 2924 nnnhbn.exe 37 PID 2924 wrote to memory of 2624 2924 nnnhbn.exe 37 PID 2624 wrote to memory of 2908 2624 llflxfr.exe 38 PID 2624 wrote to memory of 2908 2624 llflxfr.exe 38 PID 2624 wrote to memory of 2908 2624 llflxfr.exe 38 PID 2624 wrote to memory of 2908 2624 llflxfr.exe 38 PID 2908 wrote to memory of 2660 2908 lfrrflr.exe 39 PID 2908 wrote to memory of 2660 2908 lfrrflr.exe 39 PID 2908 wrote to memory of 2660 2908 lfrrflr.exe 39 PID 2908 wrote to memory of 2660 2908 lfrrflr.exe 39 PID 2660 wrote to memory of 1408 2660 bbtnbt.exe 40 PID 2660 wrote to memory of 1408 2660 bbtnbt.exe 40 PID 2660 wrote to memory of 1408 2660 bbtnbt.exe 40 PID 2660 wrote to memory of 1408 2660 bbtnbt.exe 40 PID 1408 wrote to memory of 840 1408 3xllrxf.exe 41 PID 1408 wrote to memory of 840 1408 3xllrxf.exe 41 PID 1408 wrote to memory of 840 1408 3xllrxf.exe 41 PID 1408 wrote to memory of 840 1408 3xllrxf.exe 41 PID 840 wrote to memory of 1628 840 ppjjp.exe 42 PID 840 wrote to memory of 1628 840 ppjjp.exe 42 PID 840 wrote to memory of 1628 840 ppjjp.exe 42 PID 840 wrote to memory of 1628 840 ppjjp.exe 42 PID 1628 wrote to memory of 2824 1628 xxllrrf.exe 43 PID 1628 wrote to memory of 2824 1628 xxllrrf.exe 43 PID 1628 wrote to memory of 2824 1628 xxllrrf.exe 43 PID 1628 wrote to memory of 2824 1628 xxllrrf.exe 43 PID 2824 wrote to memory of 2944 2824 tttttb.exe 44 PID 2824 wrote to memory of 2944 2824 tttttb.exe 44 PID 2824 wrote to memory of 2944 2824 tttttb.exe 44 PID 2824 wrote to memory of 2944 2824 tttttb.exe 44 PID 2944 wrote to memory of 1304 2944 flflxrx.exe 45 PID 2944 wrote to memory of 1304 2944 flflxrx.exe 45 PID 2944 wrote to memory of 1304 2944 flflxrx.exe 45 PID 2944 wrote to memory of 1304 2944 flflxrx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\be0410a0f07686fd96d0f7f080f3df092da689a10046d079e6f6676e6ca7375a.exe"C:\Users\Admin\AppData\Local\Temp\be0410a0f07686fd96d0f7f080f3df092da689a10046d079e6f6676e6ca7375a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\7dpjj.exec:\7dpjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
\??\c:\5dpvj.exec:\5dpvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\9nnhtt.exec:\9nnhtt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\3frxffr.exec:\3frxffr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\bnbnnh.exec:\bnbnnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\pppjd.exec:\pppjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\nnnhbn.exec:\nnnhbn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\llflxfr.exec:\llflxfr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\lfrrflr.exec:\lfrrflr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\bbtnbt.exec:\bbtnbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\3xllrxf.exec:\3xllrxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
\??\c:\ppjjp.exec:\ppjjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
\??\c:\xxllrrf.exec:\xxllrrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\tttttb.exec:\tttttb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\flflxrx.exec:\flflxrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\dpppv.exec:\dpppv.exe17⤵
- Executes dropped EXE
PID:1304 -
\??\c:\7dvdd.exec:\7dvdd.exe18⤵
- Executes dropped EXE
PID:1836 -
\??\c:\dvpdv.exec:\dvpdv.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1176 -
\??\c:\5jjjp.exec:\5jjjp.exe20⤵
- Executes dropped EXE
PID:2064 -
\??\c:\xfxfxxl.exec:\xfxfxxl.exe21⤵
- Executes dropped EXE
PID:980 -
\??\c:\vppjp.exec:\vppjp.exe22⤵
- Executes dropped EXE
PID:1404 -
\??\c:\rxxfxxl.exec:\rxxfxxl.exe23⤵
- Executes dropped EXE
PID:1284 -
\??\c:\frxfxfx.exec:\frxfxfx.exe24⤵
- Executes dropped EXE
PID:1952 -
\??\c:\vvpvj.exec:\vvpvj.exe25⤵
- Executes dropped EXE
PID:324 -
\??\c:\xrffxfl.exec:\xrffxfl.exe26⤵
- Executes dropped EXE
PID:2224 -
\??\c:\nnhtht.exec:\nnhtht.exe27⤵
- Executes dropped EXE
PID:2196 -
\??\c:\1dvdp.exec:\1dvdp.exe28⤵
- Executes dropped EXE
PID:2152 -
\??\c:\ffxxflx.exec:\ffxxflx.exe29⤵
- Executes dropped EXE
PID:3056 -
\??\c:\9ntttt.exec:\9ntttt.exe30⤵
- Executes dropped EXE
PID:2476 -
\??\c:\fffrxfr.exec:\fffrxfr.exe31⤵
- Executes dropped EXE
PID:1652 -
\??\c:\tnhhtt.exec:\tnhhtt.exe32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3024 -
\??\c:\jjddj.exec:\jjddj.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1816 -
\??\c:\rrllxfr.exec:\rrllxfr.exe34⤵
- Executes dropped EXE
PID:2504 -
\??\c:\jdpjj.exec:\jdpjj.exe35⤵
- Executes dropped EXE
PID:1264 -
\??\c:\1vvjv.exec:\1vvjv.exe36⤵
- Executes dropped EXE
PID:2784 -
\??\c:\lffflrf.exec:\lffflrf.exe37⤵
- Executes dropped EXE
PID:2168 -
\??\c:\hhthht.exec:\hhthht.exe38⤵
- Executes dropped EXE
PID:2008 -
\??\c:\btntht.exec:\btntht.exe39⤵
- Executes dropped EXE
PID:2748 -
\??\c:\pjvjv.exec:\pjvjv.exe40⤵
- Executes dropped EXE
PID:2732 -
\??\c:\rlxflrx.exec:\rlxflrx.exe41⤵
- Executes dropped EXE
PID:3012 -
\??\c:\ttbnbb.exec:\ttbnbb.exe42⤵
- Executes dropped EXE
PID:2972 -
\??\c:\hhbhnb.exec:\hhbhnb.exe43⤵
- Executes dropped EXE
PID:2736 -
\??\c:\9pppp.exec:\9pppp.exe44⤵
- Executes dropped EXE
PID:2592 -
\??\c:\llxxffx.exec:\llxxffx.exe45⤵
- Executes dropped EXE
PID:2672 -
\??\c:\nnbbnn.exec:\nnbbnn.exe46⤵
- Executes dropped EXE
PID:2660 -
\??\c:\jjdpv.exec:\jjdpv.exe47⤵
- Executes dropped EXE
PID:2056 -
\??\c:\ddvjp.exec:\ddvjp.exe48⤵
- Executes dropped EXE
PID:2432 -
\??\c:\1lflllr.exec:\1lflllr.exe49⤵
- Executes dropped EXE
PID:840 -
\??\c:\nnntbh.exec:\nnntbh.exe50⤵
- Executes dropped EXE
PID:2300 -
\??\c:\bbtbht.exec:\bbtbht.exe51⤵
- Executes dropped EXE
PID:2688 -
\??\c:\jppvj.exec:\jppvj.exe52⤵
- Executes dropped EXE
PID:2940 -
\??\c:\xlllrff.exec:\xlllrff.exe53⤵
- Executes dropped EXE
PID:2656 -
\??\c:\xxxlrfl.exec:\xxxlrfl.exe54⤵
- Executes dropped EXE
PID:844 -
\??\c:\5nhthn.exec:\5nhthn.exe55⤵
- Executes dropped EXE
PID:2364 -
\??\c:\ddvdv.exec:\ddvdv.exe56⤵
- Executes dropped EXE
PID:2120 -
\??\c:\djjdd.exec:\djjdd.exe57⤵
- Executes dropped EXE
PID:1996 -
\??\c:\3rlrxfr.exec:\3rlrxfr.exe58⤵
- Executes dropped EXE
PID:1800 -
\??\c:\1bthnn.exec:\1bthnn.exe59⤵
- Executes dropped EXE
PID:2072 -
\??\c:\nthhtb.exec:\nthhtb.exe60⤵
- Executes dropped EXE
PID:1828 -
\??\c:\jdjjp.exec:\jdjjp.exe61⤵
- Executes dropped EXE
PID:1632 -
\??\c:\lfxfrrf.exec:\lfxfrrf.exe62⤵
- Executes dropped EXE
PID:1404 -
\??\c:\fffxlrf.exec:\fffxlrf.exe63⤵
- Executes dropped EXE
PID:1284 -
\??\c:\tnnttb.exec:\tnnttb.exe64⤵
- Executes dropped EXE
PID:1328 -
\??\c:\ppvpv.exec:\ppvpv.exe65⤵
- Executes dropped EXE
PID:1784 -
\??\c:\vpjvj.exec:\vpjvj.exe66⤵PID:1780
-
\??\c:\rlfrxfr.exec:\rlfrxfr.exe67⤵PID:768
-
\??\c:\btthht.exec:\btthht.exe68⤵PID:1680
-
\??\c:\bbtbhn.exec:\bbtbhn.exe69⤵PID:3064
-
\??\c:\pvvjd.exec:\pvvjd.exe70⤵PID:344
-
\??\c:\1jpvj.exec:\1jpvj.exe71⤵PID:2636
-
\??\c:\xrfflrx.exec:\xrfflrx.exe72⤵PID:2144
-
\??\c:\5hhtbn.exec:\5hhtbn.exe73⤵PID:300
-
\??\c:\hhbnth.exec:\hhbnth.exe74⤵PID:1904
-
\??\c:\vvvjp.exec:\vvvjp.exe75⤵PID:2096
-
\??\c:\xrrxfll.exec:\xrrxfll.exe76⤵PID:1816
-
\??\c:\tnhhnt.exec:\tnhhnt.exe77⤵PID:1588
-
\??\c:\bhhhth.exec:\bhhhth.exe78⤵PID:2540
-
\??\c:\9vvvj.exec:\9vvvj.exe79⤵PID:1144
-
\??\c:\5xlrfxl.exec:\5xlrfxl.exe80⤵PID:2284
-
\??\c:\fxlrxfl.exec:\fxlrxfl.exe81⤵PID:2912
-
\??\c:\3nbtth.exec:\3nbtth.exe82⤵PID:2904
-
\??\c:\3jdjp.exec:\3jdjp.exe83⤵PID:2888
-
\??\c:\7jjjp.exec:\7jjjp.exe84⤵PID:2632
-
\??\c:\llflxfr.exec:\llflxfr.exe85⤵PID:2924
-
\??\c:\btnnbh.exec:\btnnbh.exe86⤵PID:2972
-
\??\c:\5nhhnt.exec:\5nhhnt.exe87⤵PID:2736
-
\??\c:\7pddj.exec:\7pddj.exe88⤵PID:2592
-
\??\c:\rrlrxfx.exec:\rrlrxfx.exe89⤵PID:2440
-
\??\c:\rrrfrxl.exec:\rrrfrxl.exe90⤵PID:2204
-
\??\c:\hhhntb.exec:\hhhntb.exe91⤵PID:2648
-
\??\c:\vvpvd.exec:\vvpvd.exe92⤵PID:2952
-
\??\c:\vddjd.exec:\vddjd.exe93⤵PID:2976
-
\??\c:\xxrlfrx.exec:\xxrlfrx.exe94⤵PID:2816
-
\??\c:\1nbhhn.exec:\1nbhhn.exe95⤵PID:2948
-
\??\c:\bbbhtb.exec:\bbbhtb.exe96⤵PID:1844
-
\??\c:\3vjpv.exec:\3vjpv.exe97⤵PID:2584
-
\??\c:\lfxxxfr.exec:\lfxxxfr.exe98⤵PID:1416
-
\??\c:\7fxlxxl.exec:\7fxlxxl.exe99⤵PID:1500
-
\??\c:\btbhbb.exec:\btbhbb.exe100⤵PID:2000
-
\??\c:\vvvdj.exec:\vvvdj.exe101⤵PID:1176
-
\??\c:\vdvjv.exec:\vdvjv.exe102⤵PID:700
-
\??\c:\fxrfxfr.exec:\fxrfxfr.exe103⤵PID:2072
-
\??\c:\1hbhtb.exec:\1hbhtb.exe104⤵PID:2528
-
\??\c:\9nnhhn.exec:\9nnhhn.exe105⤵PID:576
-
\??\c:\ppjpv.exec:\ppjpv.exe106⤵PID:3036
-
\??\c:\rxlxrrf.exec:\rxlxrrf.exe107⤵PID:672
-
\??\c:\nthhtb.exec:\nthhtb.exe108⤵PID:1372
-
\??\c:\3tnhnt.exec:\3tnhnt.exe109⤵PID:1528
-
\??\c:\jdvdv.exec:\jdvdv.exe110⤵PID:1780
-
\??\c:\3dvdd.exec:\3dvdd.exe111⤵PID:1948
-
\??\c:\7xrrrrx.exec:\7xrrrrx.exe112⤵PID:1636
-
\??\c:\5nhtbh.exec:\5nhtbh.exe113⤵PID:2436
-
\??\c:\htnntt.exec:\htnntt.exe114⤵PID:2180
-
\??\c:\1vvvd.exec:\1vvvd.exe115⤵PID:2316
-
\??\c:\lfxlllx.exec:\lfxlllx.exe116⤵PID:2144
-
\??\c:\ttnthn.exec:\ttnthn.exe117⤵PID:300
-
\??\c:\ttthbb.exec:\ttthbb.exe118⤵PID:2536
-
\??\c:\pvvdp.exec:\pvvdp.exe119⤵PID:2420
-
\??\c:\jvpvj.exec:\jvpvj.exe120⤵PID:1812
-
\??\c:\llflxfx.exec:\llflxfx.exe121⤵PID:2328
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-