Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 04:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d54dd942a001e7090b91c30d23ffc7faf36acec1cd82757a4255a93baad1c561.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
d54dd942a001e7090b91c30d23ffc7faf36acec1cd82757a4255a93baad1c561.exe
-
Size
454KB
-
MD5
657ba59f1a5dd319a82d6f9cf854c14d
-
SHA1
3291d7fbee11fac06d0880d861f58bf4c767613e
-
SHA256
d54dd942a001e7090b91c30d23ffc7faf36acec1cd82757a4255a93baad1c561
-
SHA512
cc9a62295e1f53cdb296dc9e4f472269c4d5edc418071b21187e68cc67f910025f19be326d6909c0924e24aad5c2c9141d4fefc881328044567e81c0dcbcacdc
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbecMb:q7Tc2NYHUrAwfMp3CDpb
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/3004-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2192-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1900-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-99-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2664-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2320-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1948-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1428-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1780-171-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1736-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1296-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2080-237-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1468-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/864-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-274-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1528-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1424-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-358-0x0000000001C60000-0x0000000001C8A000-memory.dmp family_blackmoon behavioral1/memory/2724-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-356-0x0000000001C60000-0x0000000001C8A000-memory.dmp family_blackmoon behavioral1/memory/2728-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-414-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/1108-422-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1656-428-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1656-430-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/568-450-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-463-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1728-585-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1636-592-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2816-625-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/732-710-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2888-729-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2888-748-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/828-781-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2180-875-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1200-1097-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1504-1279-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2192 jdvdp.exe 2380 nhbhbb.exe 1900 rrlfxrf.exe 1832 bbthth.exe 2800 lflfxff.exe 2696 tbbhth.exe 2316 xlrlfxf.exe 2864 5bntbh.exe 2704 fxllrrf.exe 2664 nhnthn.exe 2320 rxfrxlr.exe 2000 nnbnbn.exe 1864 pjjpv.exe 1948 thnbhn.exe 1780 1ppdp.exe 1428 rlxfrxr.exe 760 ddvvp.exe 2912 xxxxrfx.exe 2172 vpppj.exe 1736 1tnbth.exe 1164 rrfflrl.exe 2976 xrlrffl.exe 828 pjpjd.exe 1228 3lxflrf.exe 1296 3jvvj.exe 2080 xxrxlxl.exe 1468 lllxllx.exe 864 dvppp.exe 2448 djjpj.exe 2292 xffrlxr.exe 1528 3lllrxr.exe 1424 ttthhb.exe 2532 7lfffxr.exe 1976 thhntb.exe 1512 bhbnht.exe 3064 jdvdd.exe 1316 lllfrrl.exe 2940 3tnntt.exe 2732 tttbbt.exe 2820 jpvjd.exe 2744 frlxfrl.exe 2724 nnhhtn.exe 2696 vvdvv.exe 2728 5jjjp.exe 2592 rlflxxx.exe 2704 btnhth.exe 3036 dpdpj.exe 1668 lfrfrfx.exe 1036 rlfxlxr.exe 2004 tntnnn.exe 1108 3dddj.exe 1656 7lxflrx.exe 1552 tnntbh.exe 1780 hhtbhn.exe 568 jjdjj.exe 1828 fxflxfx.exe 2904 hbbbhh.exe 2260 pvjpv.exe 3012 ffrrxfx.exe 1736 rlflflx.exe 2572 hnnbnt.exe 1068 3pjvp.exe 628 xxxfrxr.exe 1784 fxrllrl.exe -
resource yara_rule behavioral1/memory/3004-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-27-0x00000000002C0000-0x00000000002EA000-memory.dmp upx behavioral1/memory/1900-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-99-0x00000000003D0000-0x00000000003FA000-memory.dmp upx behavioral1/memory/2664-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1948-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1428-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1296-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-237-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1468-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/864-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1424-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1424-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1316-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1108-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/568-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1784-501-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1228-508-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1248-521-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-528-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/392-535-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1288-560-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-585-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-592-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2300-673-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-755-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-762-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/828-781-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-800-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/940-843-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1560-850-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-875-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-972-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-1059-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/980-1084-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1200-1097-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-1122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-1217-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlrxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3004 wrote to memory of 2192 3004 d54dd942a001e7090b91c30d23ffc7faf36acec1cd82757a4255a93baad1c561.exe 30 PID 3004 wrote to memory of 2192 3004 d54dd942a001e7090b91c30d23ffc7faf36acec1cd82757a4255a93baad1c561.exe 30 PID 3004 wrote to memory of 2192 3004 d54dd942a001e7090b91c30d23ffc7faf36acec1cd82757a4255a93baad1c561.exe 30 PID 3004 wrote to memory of 2192 3004 d54dd942a001e7090b91c30d23ffc7faf36acec1cd82757a4255a93baad1c561.exe 30 PID 2192 wrote to memory of 2380 2192 jdvdp.exe 31 PID 2192 wrote to memory of 2380 2192 jdvdp.exe 31 PID 2192 wrote to memory of 2380 2192 jdvdp.exe 31 PID 2192 wrote to memory of 2380 2192 jdvdp.exe 31 PID 2380 wrote to memory of 1900 2380 nhbhbb.exe 32 PID 2380 wrote to memory of 1900 2380 nhbhbb.exe 32 PID 2380 wrote to memory of 1900 2380 nhbhbb.exe 32 PID 2380 wrote to memory of 1900 2380 nhbhbb.exe 32 PID 1900 wrote to memory of 1832 1900 rrlfxrf.exe 33 PID 1900 wrote to memory of 1832 1900 rrlfxrf.exe 33 PID 1900 wrote to memory of 1832 1900 rrlfxrf.exe 33 PID 1900 wrote to memory of 1832 1900 rrlfxrf.exe 33 PID 1832 wrote to memory of 2800 1832 bbthth.exe 34 PID 1832 wrote to memory of 2800 1832 bbthth.exe 34 PID 1832 wrote to memory of 2800 1832 bbthth.exe 34 PID 1832 wrote to memory of 2800 1832 bbthth.exe 34 PID 2800 wrote to memory of 2696 2800 lflfxff.exe 35 PID 2800 wrote to memory of 2696 2800 lflfxff.exe 35 PID 2800 wrote to memory of 2696 2800 lflfxff.exe 35 PID 2800 wrote to memory of 2696 2800 lflfxff.exe 35 PID 2696 wrote to memory of 2316 2696 tbbhth.exe 36 PID 2696 wrote to memory of 2316 2696 tbbhth.exe 36 PID 2696 wrote to memory of 2316 2696 tbbhth.exe 36 PID 2696 wrote to memory of 2316 2696 tbbhth.exe 36 PID 2316 wrote to memory of 2864 2316 xlrlfxf.exe 37 PID 2316 wrote to memory of 2864 2316 xlrlfxf.exe 37 PID 2316 wrote to memory of 2864 2316 xlrlfxf.exe 37 PID 2316 wrote to memory of 2864 2316 xlrlfxf.exe 37 PID 2864 wrote to memory of 2704 2864 5bntbh.exe 38 PID 2864 wrote to memory of 2704 2864 5bntbh.exe 38 PID 2864 wrote to memory of 2704 2864 5bntbh.exe 38 PID 2864 wrote to memory of 2704 2864 5bntbh.exe 38 PID 2704 wrote to memory of 2664 2704 fxllrrf.exe 39 PID 2704 wrote to memory of 2664 2704 fxllrrf.exe 39 PID 2704 wrote to memory of 2664 2704 fxllrrf.exe 39 PID 2704 wrote to memory of 2664 2704 fxllrrf.exe 39 PID 2664 wrote to memory of 2320 2664 nhnthn.exe 40 PID 2664 wrote to memory of 2320 2664 nhnthn.exe 40 PID 2664 wrote to memory of 2320 2664 nhnthn.exe 40 PID 2664 wrote to memory of 2320 2664 nhnthn.exe 40 PID 2320 wrote to memory of 2000 2320 rxfrxlr.exe 41 PID 2320 wrote to memory of 2000 2320 rxfrxlr.exe 41 PID 2320 wrote to memory of 2000 2320 rxfrxlr.exe 41 PID 2320 wrote to memory of 2000 2320 rxfrxlr.exe 41 PID 2000 wrote to memory of 1864 2000 nnbnbn.exe 42 PID 2000 wrote to memory of 1864 2000 nnbnbn.exe 42 PID 2000 wrote to memory of 1864 2000 nnbnbn.exe 42 PID 2000 wrote to memory of 1864 2000 nnbnbn.exe 42 PID 1864 wrote to memory of 1948 1864 pjjpv.exe 43 PID 1864 wrote to memory of 1948 1864 pjjpv.exe 43 PID 1864 wrote to memory of 1948 1864 pjjpv.exe 43 PID 1864 wrote to memory of 1948 1864 pjjpv.exe 43 PID 1948 wrote to memory of 1780 1948 thnbhn.exe 44 PID 1948 wrote to memory of 1780 1948 thnbhn.exe 44 PID 1948 wrote to memory of 1780 1948 thnbhn.exe 44 PID 1948 wrote to memory of 1780 1948 thnbhn.exe 44 PID 1780 wrote to memory of 1428 1780 1ppdp.exe 45 PID 1780 wrote to memory of 1428 1780 1ppdp.exe 45 PID 1780 wrote to memory of 1428 1780 1ppdp.exe 45 PID 1780 wrote to memory of 1428 1780 1ppdp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\d54dd942a001e7090b91c30d23ffc7faf36acec1cd82757a4255a93baad1c561.exe"C:\Users\Admin\AppData\Local\Temp\d54dd942a001e7090b91c30d23ffc7faf36acec1cd82757a4255a93baad1c561.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\jdvdp.exec:\jdvdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\nhbhbb.exec:\nhbhbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\rrlfxrf.exec:\rrlfxrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\bbthth.exec:\bbthth.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\lflfxff.exec:\lflfxff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\tbbhth.exec:\tbbhth.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\xlrlfxf.exec:\xlrlfxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\5bntbh.exec:\5bntbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\fxllrrf.exec:\fxllrrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\nhnthn.exec:\nhnthn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\rxfrxlr.exec:\rxfrxlr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\nnbnbn.exec:\nnbnbn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\pjjpv.exec:\pjjpv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\thnbhn.exec:\thnbhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\1ppdp.exec:\1ppdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\rlxfrxr.exec:\rlxfrxr.exe17⤵
- Executes dropped EXE
PID:1428 -
\??\c:\ddvvp.exec:\ddvvp.exe18⤵
- Executes dropped EXE
PID:760 -
\??\c:\xxxxrfx.exec:\xxxxrfx.exe19⤵
- Executes dropped EXE
PID:2912 -
\??\c:\vpppj.exec:\vpppj.exe20⤵
- Executes dropped EXE
PID:2172 -
\??\c:\1tnbth.exec:\1tnbth.exe21⤵
- Executes dropped EXE
PID:1736 -
\??\c:\rrfflrl.exec:\rrfflrl.exe22⤵
- Executes dropped EXE
PID:1164 -
\??\c:\xrlrffl.exec:\xrlrffl.exe23⤵
- Executes dropped EXE
PID:2976 -
\??\c:\pjpjd.exec:\pjpjd.exe24⤵
- Executes dropped EXE
PID:828 -
\??\c:\3lxflrf.exec:\3lxflrf.exe25⤵
- Executes dropped EXE
PID:1228 -
\??\c:\3jvvj.exec:\3jvvj.exe26⤵
- Executes dropped EXE
PID:1296 -
\??\c:\xxrxlxl.exec:\xxrxlxl.exe27⤵
- Executes dropped EXE
PID:2080 -
\??\c:\lllxllx.exec:\lllxllx.exe28⤵
- Executes dropped EXE
PID:1468 -
\??\c:\dvppp.exec:\dvppp.exe29⤵
- Executes dropped EXE
PID:864 -
\??\c:\djjpj.exec:\djjpj.exe30⤵
- Executes dropped EXE
PID:2448 -
\??\c:\xffrlxr.exec:\xffrlxr.exe31⤵
- Executes dropped EXE
PID:2292 -
\??\c:\3lllrxr.exec:\3lllrxr.exe32⤵
- Executes dropped EXE
PID:1528 -
\??\c:\ttthhb.exec:\ttthhb.exe33⤵
- Executes dropped EXE
PID:1424 -
\??\c:\7lfffxr.exec:\7lfffxr.exe34⤵
- Executes dropped EXE
PID:2532 -
\??\c:\thhntb.exec:\thhntb.exe35⤵
- Executes dropped EXE
PID:1976 -
\??\c:\bhbnht.exec:\bhbnht.exe36⤵
- Executes dropped EXE
PID:1512 -
\??\c:\jdvdd.exec:\jdvdd.exe37⤵
- Executes dropped EXE
PID:3064 -
\??\c:\lllfrrl.exec:\lllfrrl.exe38⤵
- Executes dropped EXE
PID:1316 -
\??\c:\3tnntt.exec:\3tnntt.exe39⤵
- Executes dropped EXE
PID:2940 -
\??\c:\tttbbt.exec:\tttbbt.exe40⤵
- Executes dropped EXE
PID:2732 -
\??\c:\jpvjd.exec:\jpvjd.exe41⤵
- Executes dropped EXE
PID:2820 -
\??\c:\frlxfrl.exec:\frlxfrl.exe42⤵
- Executes dropped EXE
PID:2744 -
\??\c:\nnhhtn.exec:\nnhhtn.exe43⤵
- Executes dropped EXE
PID:2724 -
\??\c:\vvdvv.exec:\vvdvv.exe44⤵
- Executes dropped EXE
PID:2696 -
\??\c:\5jjjp.exec:\5jjjp.exe45⤵
- Executes dropped EXE
PID:2728 -
\??\c:\rlflxxx.exec:\rlflxxx.exe46⤵
- Executes dropped EXE
PID:2592 -
\??\c:\btnhth.exec:\btnhth.exe47⤵
- Executes dropped EXE
PID:2704 -
\??\c:\dpdpj.exec:\dpdpj.exe48⤵
- Executes dropped EXE
PID:3036 -
\??\c:\lfrfrfx.exec:\lfrfrfx.exe49⤵
- Executes dropped EXE
PID:1668 -
\??\c:\rlfxlxr.exec:\rlfxlxr.exe50⤵
- Executes dropped EXE
PID:1036 -
\??\c:\tntnnn.exec:\tntnnn.exe51⤵
- Executes dropped EXE
PID:2004 -
\??\c:\3dddj.exec:\3dddj.exe52⤵
- Executes dropped EXE
PID:1108 -
\??\c:\7lxflrx.exec:\7lxflrx.exe53⤵
- Executes dropped EXE
PID:1656 -
\??\c:\tnntbh.exec:\tnntbh.exe54⤵
- Executes dropped EXE
PID:1552 -
\??\c:\hhtbhn.exec:\hhtbhn.exe55⤵
- Executes dropped EXE
PID:1780 -
\??\c:\jjdjj.exec:\jjdjj.exe56⤵
- Executes dropped EXE
PID:568 -
\??\c:\fxflxfx.exec:\fxflxfx.exe57⤵
- Executes dropped EXE
PID:1828 -
\??\c:\hbbbhh.exec:\hbbbhh.exe58⤵
- Executes dropped EXE
PID:2904 -
\??\c:\pvjpv.exec:\pvjpv.exe59⤵
- Executes dropped EXE
PID:2260 -
\??\c:\ffrrxfx.exec:\ffrrxfx.exe60⤵
- Executes dropped EXE
PID:3012 -
\??\c:\rlflflx.exec:\rlflflx.exe61⤵
- Executes dropped EXE
PID:1736 -
\??\c:\hnnbnt.exec:\hnnbnt.exe62⤵
- Executes dropped EXE
PID:2572 -
\??\c:\3pjvp.exec:\3pjvp.exe63⤵
- Executes dropped EXE
PID:1068 -
\??\c:\xxxfrxr.exec:\xxxfrxr.exe64⤵
- Executes dropped EXE
PID:628 -
\??\c:\fxrllrl.exec:\fxrllrl.exe65⤵
- Executes dropped EXE
PID:1784 -
\??\c:\bbttbh.exec:\bbttbh.exe66⤵PID:1228
-
\??\c:\jpvvd.exec:\jpvvd.exe67⤵PID:1616
-
\??\c:\xxxxllx.exec:\xxxxllx.exe68⤵PID:1248
-
\??\c:\lflrffr.exec:\lflrffr.exe69⤵PID:1776
-
\??\c:\ttnhth.exec:\ttnhth.exe70⤵PID:392
-
\??\c:\5pddj.exec:\5pddj.exe71⤵PID:2948
-
\??\c:\xffffxx.exec:\xffffxx.exe72⤵PID:1408
-
\??\c:\xfflrxl.exec:\xfflrxl.exe73⤵PID:2496
-
\??\c:\bbthtb.exec:\bbthtb.exe74⤵PID:1288
-
\??\c:\ddvvp.exec:\ddvvp.exe75⤵PID:2436
-
\??\c:\lrxlfxf.exec:\lrxlfxf.exe76⤵PID:1968
-
\??\c:\xxlfxlx.exec:\xxlfxlx.exe77⤵PID:1728
-
\??\c:\9tnhbh.exec:\9tnhbh.exe78⤵PID:1636
-
\??\c:\dppdd.exec:\dppdd.exe79⤵PID:2524
-
\??\c:\lrfxrxr.exec:\lrfxrxr.exe80⤵PID:2672
-
\??\c:\7hnhnn.exec:\7hnhnn.exe81⤵PID:2296
-
\??\c:\ddjvp.exec:\ddjvp.exe82⤵
- System Location Discovery: System Language Discovery
PID:2700 -
\??\c:\vddvp.exec:\vddvp.exe83⤵PID:2748
-
\??\c:\rllxlrl.exec:\rllxlrl.exe84⤵PID:2816
-
\??\c:\1tthnn.exec:\1tthnn.exe85⤵PID:2828
-
\??\c:\jjjvv.exec:\jjjvv.exe86⤵PID:2872
-
\??\c:\pjddj.exec:\pjddj.exe87⤵PID:2824
-
\??\c:\fllrlrr.exec:\fllrlrr.exe88⤵PID:2756
-
\??\c:\ntnbnb.exec:\ntnbnb.exe89⤵PID:2604
-
\??\c:\9thnbh.exec:\9thnbh.exe90⤵PID:2592
-
\??\c:\pjddj.exec:\pjddj.exe91⤵PID:2704
-
\??\c:\rrrflrf.exec:\rrrflrf.exe92⤵PID:2300
-
\??\c:\xxrrfxl.exec:\xxrrfxl.exe93⤵PID:1720
-
\??\c:\nhhbnt.exec:\nhhbnt.exe94⤵PID:576
-
\??\c:\pjvpv.exec:\pjvpv.exe95⤵PID:1044
-
\??\c:\7xffrxl.exec:\7xffrxl.exe96⤵PID:1620
-
\??\c:\fxrfrxr.exec:\fxrfrxr.exe97⤵PID:732
-
\??\c:\9hnttb.exec:\9hnttb.exe98⤵PID:1844
-
\??\c:\7jvdj.exec:\7jvdj.exe99⤵PID:2896
-
\??\c:\vdvjv.exec:\vdvjv.exe100⤵PID:2888
-
\??\c:\xrlllrx.exec:\xrlllrx.exe101⤵PID:300
-
\??\c:\9bthtt.exec:\9bthtt.exe102⤵PID:1828
-
\??\c:\1ddpj.exec:\1ddpj.exe103⤵PID:2688
-
\??\c:\llxxrfr.exec:\llxxrfr.exe104⤵PID:2352
-
\??\c:\hbhnth.exec:\hbhnth.exe105⤵PID:3012
-
\??\c:\vjddp.exec:\vjddp.exe106⤵PID:1736
-
\??\c:\vpppv.exec:\vpppv.exe107⤵PID:2476
-
\??\c:\fxrxflr.exec:\fxrxflr.exe108⤵PID:828
-
\??\c:\ntnhhh.exec:\ntnhhh.exe109⤵PID:1964
-
\??\c:\1jdjp.exec:\1jdjp.exe110⤵PID:1700
-
\??\c:\pppjv.exec:\pppjv.exe111⤵PID:1712
-
\??\c:\xfxlrxr.exec:\xfxlrxr.exe112⤵PID:1616
-
\??\c:\nnnbhn.exec:\nnnbhn.exe113⤵
- System Location Discovery: System Language Discovery
PID:2140 -
\??\c:\vdvjv.exec:\vdvjv.exe114⤵PID:844
-
\??\c:\pjvjp.exec:\pjvjp.exe115⤵PID:480
-
\??\c:\xrlflxr.exec:\xrlflxr.exe116⤵PID:676
-
\??\c:\1rllxfl.exec:\1rllxfl.exe117⤵PID:768
-
\??\c:\nbttbn.exec:\nbttbn.exe118⤵PID:2992
-
\??\c:\1pdjp.exec:\1pdjp.exe119⤵PID:940
-
\??\c:\3rlxxfr.exec:\3rlxxfr.exe120⤵PID:1560
-
\??\c:\nbhnhb.exec:\nbhnhb.exe121⤵PID:1968
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-