Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 04:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d6c182e7bb0c8e193a6df458cb7e8ac8d0629f61f05dd4d878fe124f043d9819.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
d6c182e7bb0c8e193a6df458cb7e8ac8d0629f61f05dd4d878fe124f043d9819.exe
-
Size
454KB
-
MD5
00ebe5aa3e0cfa89b5d66da611833774
-
SHA1
03c2951df57b5427f310d4c230d0b969ed66ef1d
-
SHA256
d6c182e7bb0c8e193a6df458cb7e8ac8d0629f61f05dd4d878fe124f043d9819
-
SHA512
534c7935ec0847bad84d9dcbd5b8a19322ae0cd4a850cda4a7b9b07d3a5e45c5a83812b38f9a4afba2c840dca5281fd506db737ec7748587dfdbc0e55caa0ac9
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAben:q7Tc2NYHUrAwfMp3CDn
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 50 IoCs
resource yara_rule behavioral1/memory/2496-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2328-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/532-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2480-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1648-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-161-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2908-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2356-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/976-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1424-248-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2156-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2156-256-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2344-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/940-288-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2332-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2092-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-359-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2728-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1440-425-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1876-431-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1084-439-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/1084-459-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2912-466-0x0000000000350000-0x000000000037A000-memory.dmp family_blackmoon behavioral1/memory/2268-480-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1660-494-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/1804-515-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/736-517-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-556-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1868-563-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/940-573-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2896-591-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1864-611-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1864-618-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1688-625-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2720-632-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2632-666-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-729-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-754-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2148-791-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2232-866-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2328 djjvp.exe 532 llxfrxf.exe 2480 tnthtb.exe 2188 rrxlxlx.exe 2776 jdvjv.exe 2728 nnnbhn.exe 2736 xxlfrxl.exe 2852 3tnbhn.exe 2788 3xrxlxl.exe 2696 1bhbbn.exe 2204 5fxfrxf.exe 1648 tnhtnn.exe 1924 fxrrllr.exe 2024 nntntt.exe 236 xxlrxfx.exe 2116 hbtbhn.exe 2032 xxrxrxf.exe 2908 nthnbt.exe 2964 7rlrllx.exe 2356 nnhnbh.exe 2956 lfxflrr.exe 1040 5thtbn.exe 976 xrflxll.exe 1704 tbnhbn.exe 896 3dvdv.exe 1424 tthtbh.exe 2156 rrrfffr.exe 3020 nthntb.exe 2344 xxrxxxf.exe 940 tttnbh.exe 876 rlfxflr.exe 264 bhbntn.exe 2348 5rffflr.exe 2332 bhnnnn.exe 1572 pvjjd.exe 744 1flrrfl.exe 2380 bthtbt.exe 2092 7tnhnt.exe 2808 dpjjj.exe 2780 rrxfllx.exe 2584 1rlrrxr.exe 2728 nhbtbh.exe 2936 jjjpp.exe 2880 fxxlflf.exe 2608 btnbnn.exe 3052 bttbnb.exe 2884 vdvdp.exe 2388 rrrrflx.exe 1964 7lxlrxl.exe 2764 nhtbth.exe 1440 jjjpv.exe 1876 1fxlrrf.exe 1084 ntntbt.exe 1940 dvdpp.exe 856 xrlxflx.exe 2832 nhbhnt.exe 2912 bbthbb.exe 2824 ddpdj.exe 2268 lfrlrrr.exe 3040 hhbnbh.exe 1660 9vpjj.exe 2956 9frxlrr.exe 1300 7nhthh.exe 1804 hnbtht.exe -
resource yara_rule behavioral1/memory/2496-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/532-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/976-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1572-324-0x00000000002B0000-0x00000000002DA000-memory.dmp upx behavioral1/memory/2092-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-359-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2728-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1440-425-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1876-431-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/856-446-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-473-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-480-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-515-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/736-517-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-556-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/940-573-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1864-611-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1864-618-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-639-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-666-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1892-716-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-729-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-754-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-791-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-861-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1860-880-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/532-913-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-931-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlflrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfrrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnthtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlrfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djddd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2496 wrote to memory of 2328 2496 d6c182e7bb0c8e193a6df458cb7e8ac8d0629f61f05dd4d878fe124f043d9819.exe 31 PID 2496 wrote to memory of 2328 2496 d6c182e7bb0c8e193a6df458cb7e8ac8d0629f61f05dd4d878fe124f043d9819.exe 31 PID 2496 wrote to memory of 2328 2496 d6c182e7bb0c8e193a6df458cb7e8ac8d0629f61f05dd4d878fe124f043d9819.exe 31 PID 2496 wrote to memory of 2328 2496 d6c182e7bb0c8e193a6df458cb7e8ac8d0629f61f05dd4d878fe124f043d9819.exe 31 PID 2328 wrote to memory of 532 2328 djjvp.exe 32 PID 2328 wrote to memory of 532 2328 djjvp.exe 32 PID 2328 wrote to memory of 532 2328 djjvp.exe 32 PID 2328 wrote to memory of 532 2328 djjvp.exe 32 PID 532 wrote to memory of 2480 532 llxfrxf.exe 33 PID 532 wrote to memory of 2480 532 llxfrxf.exe 33 PID 532 wrote to memory of 2480 532 llxfrxf.exe 33 PID 532 wrote to memory of 2480 532 llxfrxf.exe 33 PID 2480 wrote to memory of 2188 2480 tnthtb.exe 34 PID 2480 wrote to memory of 2188 2480 tnthtb.exe 34 PID 2480 wrote to memory of 2188 2480 tnthtb.exe 34 PID 2480 wrote to memory of 2188 2480 tnthtb.exe 34 PID 2188 wrote to memory of 2776 2188 rrxlxlx.exe 35 PID 2188 wrote to memory of 2776 2188 rrxlxlx.exe 35 PID 2188 wrote to memory of 2776 2188 rrxlxlx.exe 35 PID 2188 wrote to memory of 2776 2188 rrxlxlx.exe 35 PID 2776 wrote to memory of 2728 2776 jdvjv.exe 36 PID 2776 wrote to memory of 2728 2776 jdvjv.exe 36 PID 2776 wrote to memory of 2728 2776 jdvjv.exe 36 PID 2776 wrote to memory of 2728 2776 jdvjv.exe 36 PID 2728 wrote to memory of 2736 2728 nnnbhn.exe 37 PID 2728 wrote to memory of 2736 2728 nnnbhn.exe 37 PID 2728 wrote to memory of 2736 2728 nnnbhn.exe 37 PID 2728 wrote to memory of 2736 2728 nnnbhn.exe 37 PID 2736 wrote to memory of 2852 2736 xxlfrxl.exe 38 PID 2736 wrote to memory of 2852 2736 xxlfrxl.exe 38 PID 2736 wrote to memory of 2852 2736 xxlfrxl.exe 38 PID 2736 wrote to memory of 2852 2736 xxlfrxl.exe 38 PID 2852 wrote to memory of 2788 2852 3tnbhn.exe 39 PID 2852 wrote to memory of 2788 2852 3tnbhn.exe 39 PID 2852 wrote to memory of 2788 2852 3tnbhn.exe 39 PID 2852 wrote to memory of 2788 2852 3tnbhn.exe 39 PID 2788 wrote to memory of 2696 2788 3xrxlxl.exe 40 PID 2788 wrote to memory of 2696 2788 3xrxlxl.exe 40 PID 2788 wrote to memory of 2696 2788 3xrxlxl.exe 40 PID 2788 wrote to memory of 2696 2788 3xrxlxl.exe 40 PID 2696 wrote to memory of 2204 2696 1bhbbn.exe 41 PID 2696 wrote to memory of 2204 2696 1bhbbn.exe 41 PID 2696 wrote to memory of 2204 2696 1bhbbn.exe 41 PID 2696 wrote to memory of 2204 2696 1bhbbn.exe 41 PID 2204 wrote to memory of 1648 2204 5fxfrxf.exe 42 PID 2204 wrote to memory of 1648 2204 5fxfrxf.exe 42 PID 2204 wrote to memory of 1648 2204 5fxfrxf.exe 42 PID 2204 wrote to memory of 1648 2204 5fxfrxf.exe 42 PID 1648 wrote to memory of 1924 1648 tnhtnn.exe 43 PID 1648 wrote to memory of 1924 1648 tnhtnn.exe 43 PID 1648 wrote to memory of 1924 1648 tnhtnn.exe 43 PID 1648 wrote to memory of 1924 1648 tnhtnn.exe 43 PID 1924 wrote to memory of 2024 1924 fxrrllr.exe 44 PID 1924 wrote to memory of 2024 1924 fxrrllr.exe 44 PID 1924 wrote to memory of 2024 1924 fxrrllr.exe 44 PID 1924 wrote to memory of 2024 1924 fxrrllr.exe 44 PID 2024 wrote to memory of 236 2024 nntntt.exe 45 PID 2024 wrote to memory of 236 2024 nntntt.exe 45 PID 2024 wrote to memory of 236 2024 nntntt.exe 45 PID 2024 wrote to memory of 236 2024 nntntt.exe 45 PID 236 wrote to memory of 2116 236 xxlrxfx.exe 46 PID 236 wrote to memory of 2116 236 xxlrxfx.exe 46 PID 236 wrote to memory of 2116 236 xxlrxfx.exe 46 PID 236 wrote to memory of 2116 236 xxlrxfx.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\d6c182e7bb0c8e193a6df458cb7e8ac8d0629f61f05dd4d878fe124f043d9819.exe"C:\Users\Admin\AppData\Local\Temp\d6c182e7bb0c8e193a6df458cb7e8ac8d0629f61f05dd4d878fe124f043d9819.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\djjvp.exec:\djjvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\llxfrxf.exec:\llxfrxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
\??\c:\tnthtb.exec:\tnthtb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\rrxlxlx.exec:\rrxlxlx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\jdvjv.exec:\jdvjv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\nnnbhn.exec:\nnnbhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\xxlfrxl.exec:\xxlfrxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\3tnbhn.exec:\3tnbhn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\3xrxlxl.exec:\3xrxlxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\1bhbbn.exec:\1bhbbn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\5fxfrxf.exec:\5fxfrxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\tnhtnn.exec:\tnhtnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\fxrrllr.exec:\fxrrllr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\nntntt.exec:\nntntt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\xxlrxfx.exec:\xxlrxfx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:236 -
\??\c:\hbtbhn.exec:\hbtbhn.exe17⤵
- Executes dropped EXE
PID:2116 -
\??\c:\xxrxrxf.exec:\xxrxrxf.exe18⤵
- Executes dropped EXE
PID:2032 -
\??\c:\nthnbt.exec:\nthnbt.exe19⤵
- Executes dropped EXE
PID:2908 -
\??\c:\7rlrllx.exec:\7rlrllx.exe20⤵
- Executes dropped EXE
PID:2964 -
\??\c:\nnhnbh.exec:\nnhnbh.exe21⤵
- Executes dropped EXE
PID:2356 -
\??\c:\lfxflrr.exec:\lfxflrr.exe22⤵
- Executes dropped EXE
PID:2956 -
\??\c:\5thtbn.exec:\5thtbn.exe23⤵
- Executes dropped EXE
PID:1040 -
\??\c:\xrflxll.exec:\xrflxll.exe24⤵
- Executes dropped EXE
PID:976 -
\??\c:\tbnhbn.exec:\tbnhbn.exe25⤵
- Executes dropped EXE
PID:1704 -
\??\c:\3dvdv.exec:\3dvdv.exe26⤵
- Executes dropped EXE
PID:896 -
\??\c:\tthtbh.exec:\tthtbh.exe27⤵
- Executes dropped EXE
PID:1424 -
\??\c:\rrrfffr.exec:\rrrfffr.exe28⤵
- Executes dropped EXE
PID:2156 -
\??\c:\nthntb.exec:\nthntb.exe29⤵
- Executes dropped EXE
PID:3020 -
\??\c:\xxrxxxf.exec:\xxrxxxf.exe30⤵
- Executes dropped EXE
PID:2344 -
\??\c:\tttnbh.exec:\tttnbh.exe31⤵
- Executes dropped EXE
PID:940 -
\??\c:\rlfxflr.exec:\rlfxflr.exe32⤵
- Executes dropped EXE
PID:876 -
\??\c:\bhbntn.exec:\bhbntn.exe33⤵
- Executes dropped EXE
PID:264 -
\??\c:\5rffflr.exec:\5rffflr.exe34⤵
- Executes dropped EXE
PID:2348 -
\??\c:\bhnnnn.exec:\bhnnnn.exe35⤵
- Executes dropped EXE
PID:2332 -
\??\c:\pvjjd.exec:\pvjjd.exe36⤵
- Executes dropped EXE
PID:1572 -
\??\c:\1flrrfl.exec:\1flrrfl.exe37⤵
- Executes dropped EXE
PID:744 -
\??\c:\bthtbt.exec:\bthtbt.exe38⤵
- Executes dropped EXE
PID:2380 -
\??\c:\7tnhnt.exec:\7tnhnt.exe39⤵
- Executes dropped EXE
PID:2092 -
\??\c:\dpjjj.exec:\dpjjj.exe40⤵
- Executes dropped EXE
PID:2808 -
\??\c:\rrxfllx.exec:\rrxfllx.exe41⤵
- Executes dropped EXE
PID:2780 -
\??\c:\1rlrrxr.exec:\1rlrrxr.exe42⤵
- Executes dropped EXE
PID:2584 -
\??\c:\nhbtbh.exec:\nhbtbh.exe43⤵
- Executes dropped EXE
PID:2728 -
\??\c:\jjjpp.exec:\jjjpp.exe44⤵
- Executes dropped EXE
PID:2936 -
\??\c:\fxxlflf.exec:\fxxlflf.exe45⤵
- Executes dropped EXE
PID:2880 -
\??\c:\btnbnn.exec:\btnbnn.exe46⤵
- Executes dropped EXE
PID:2608 -
\??\c:\bttbnb.exec:\bttbnb.exe47⤵
- Executes dropped EXE
PID:3052 -
\??\c:\vdvdp.exec:\vdvdp.exe48⤵
- Executes dropped EXE
PID:2884 -
\??\c:\rrrrflx.exec:\rrrrflx.exe49⤵
- Executes dropped EXE
PID:2388 -
\??\c:\7lxlrxl.exec:\7lxlrxl.exe50⤵
- Executes dropped EXE
PID:1964 -
\??\c:\nhtbth.exec:\nhtbth.exe51⤵
- Executes dropped EXE
PID:2764 -
\??\c:\jjjpv.exec:\jjjpv.exe52⤵
- Executes dropped EXE
PID:1440 -
\??\c:\1fxlrrf.exec:\1fxlrrf.exe53⤵
- Executes dropped EXE
PID:1876 -
\??\c:\ntntbt.exec:\ntntbt.exe54⤵
- Executes dropped EXE
PID:1084 -
\??\c:\dvdpp.exec:\dvdpp.exe55⤵
- Executes dropped EXE
PID:1940 -
\??\c:\xrlxflx.exec:\xrlxflx.exe56⤵
- Executes dropped EXE
PID:856 -
\??\c:\nhbhnt.exec:\nhbhnt.exe57⤵
- Executes dropped EXE
PID:2832 -
\??\c:\bbthbb.exec:\bbthbb.exe58⤵
- Executes dropped EXE
PID:2912 -
\??\c:\ddpdj.exec:\ddpdj.exe59⤵
- Executes dropped EXE
PID:2824 -
\??\c:\lfrlrrr.exec:\lfrlrrr.exe60⤵
- Executes dropped EXE
PID:2268 -
\??\c:\hhbnbh.exec:\hhbnbh.exe61⤵
- Executes dropped EXE
PID:3040 -
\??\c:\9vpjj.exec:\9vpjj.exe62⤵
- Executes dropped EXE
PID:1660 -
\??\c:\9frxlrr.exec:\9frxlrr.exe63⤵
- Executes dropped EXE
PID:2956 -
\??\c:\7nhthh.exec:\7nhthh.exe64⤵
- Executes dropped EXE
PID:1300 -
\??\c:\hnbtht.exec:\hnbtht.exe65⤵
- Executes dropped EXE
PID:1804 -
\??\c:\dddpp.exec:\dddpp.exe66⤵PID:736
-
\??\c:\5xlrxfr.exec:\5xlrxfr.exe67⤵PID:1616
-
\??\c:\hhbhnt.exec:\hhbhnt.exe68⤵PID:1792
-
\??\c:\vdvdp.exec:\vdvdp.exe69⤵PID:1868
-
\??\c:\frrlxrx.exec:\frrlxrx.exe70⤵PID:3048
-
\??\c:\rfxxlff.exec:\rfxxlff.exe71⤵PID:2108
-
\??\c:\hhbnbh.exec:\hhbnbh.exe72⤵PID:676
-
\??\c:\1jddv.exec:\1jddv.exe73⤵PID:2436
-
\??\c:\rrrrxxx.exec:\rrrrxxx.exe74⤵PID:940
-
\??\c:\btbhtb.exec:\btbhtb.exe75⤵PID:1928
-
\??\c:\pvjpp.exec:\pvjpp.exe76⤵PID:2896
-
\??\c:\xrllxfl.exec:\xrllxfl.exe77⤵PID:2328
-
\??\c:\ttntbb.exec:\ttntbb.exe78⤵PID:1688
-
\??\c:\9djpp.exec:\9djpp.exe79⤵PID:3056
-
\??\c:\jjvdp.exec:\jjvdp.exe80⤵PID:1864
-
\??\c:\lfxflrl.exec:\lfxflrl.exe81⤵PID:2680
-
\??\c:\9htbnt.exec:\9htbnt.exe82⤵PID:2720
-
\??\c:\ppjpj.exec:\ppjpj.exe83⤵PID:2716
-
\??\c:\rlrxffr.exec:\rlrxffr.exe84⤵PID:2980
-
\??\c:\7xrxxfx.exec:\7xrxxfx.exe85⤵PID:2772
-
\??\c:\nhbbnn.exec:\nhbbnn.exe86⤵PID:2792
-
\??\c:\3dppv.exec:\3dppv.exe87⤵PID:2600
-
\??\c:\5fxflrx.exec:\5fxflrx.exe88⤵PID:2632
-
\??\c:\tnhbhb.exec:\tnhbhb.exe89⤵PID:2588
-
\??\c:\vdvvp.exec:\vdvvp.exe90⤵PID:2620
-
\??\c:\xrfxlrf.exec:\xrfxlrf.exe91⤵PID:2884
-
\??\c:\llfrrxl.exec:\llfrrxl.exe92⤵PID:1684
-
\??\c:\5bthtt.exec:\5bthtt.exe93⤵PID:2844
-
\??\c:\vpppp.exec:\vpppp.exe94⤵PID:1668
-
\??\c:\ppjpj.exec:\ppjpj.exe95⤵PID:1968
-
\??\c:\7lfrxfl.exec:\7lfrxfl.exe96⤵PID:1892
-
\??\c:\7hhntt.exec:\7hhntt.exe97⤵PID:2636
-
\??\c:\bnhbbt.exec:\bnhbbt.exe98⤵PID:1980
-
\??\c:\dvjpv.exec:\dvjpv.exe99⤵PID:1976
-
\??\c:\rrffrxl.exec:\rrffrxl.exe100⤵PID:2032
-
\??\c:\xrflrrx.exec:\xrflrrx.exe101⤵PID:2676
-
\??\c:\tthtbh.exec:\tthtbh.exe102⤵PID:2144
-
\??\c:\nbhnhn.exec:\nbhnhn.exe103⤵PID:2244
-
\??\c:\3jdjj.exec:\3jdjj.exe104⤵PID:2356
-
\??\c:\xrfxxfl.exec:\xrfxxfl.exe105⤵PID:444
-
\??\c:\nhtbth.exec:\nhtbth.exe106⤵PID:1272
-
\??\c:\vdvdp.exec:\vdvdp.exe107⤵PID:2148
-
\??\c:\5rlrflx.exec:\5rlrflx.exe108⤵PID:1708
-
\??\c:\nnhnnn.exec:\nnhnnn.exe109⤵PID:1804
-
\??\c:\3hbnhn.exec:\3hbnhn.exe110⤵PID:736
-
\??\c:\jddpj.exec:\jddpj.exe111⤵PID:1796
-
\??\c:\ffxfrxl.exec:\ffxfrxl.exe112⤵PID:1524
-
\??\c:\xxrrxfr.exec:\xxrrxfr.exe113⤵PID:3024
-
\??\c:\nthhbh.exec:\nthhbh.exe114⤵PID:1072
-
\??\c:\3vdjp.exec:\3vdjp.exe115⤵PID:2372
-
\??\c:\jdvdd.exec:\jdvdd.exe116⤵PID:2424
-
\??\c:\5lllrxf.exec:\5lllrxf.exe117⤵PID:308
-
\??\c:\hhnnbh.exec:\hhnnbh.exe118⤵PID:1764
-
\??\c:\bbbnnn.exec:\bbbnnn.exe119⤵PID:2232
-
\??\c:\dvppj.exec:\dvppj.exe120⤵PID:1928
-
\??\c:\rxlllrx.exec:\rxlllrx.exe121⤵PID:2340
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-