Analysis
-
max time kernel
31s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 05:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fa4957b79b45162945d4e9667618f9e25b57574aa3942309c2a88b04a1ddf1f8.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
fa4957b79b45162945d4e9667618f9e25b57574aa3942309c2a88b04a1ddf1f8.exe
-
Size
456KB
-
MD5
e00891adad5e24fa95e8363cbdaffc6c
-
SHA1
3e9d89d35a0884b9aee15c0cbc6a3680ca71d1e9
-
SHA256
fa4957b79b45162945d4e9667618f9e25b57574aa3942309c2a88b04a1ddf1f8
-
SHA512
44eca46fe30f6241c24b2928d5e8654e9906bbfcfa93a3abbd31a1509fd49e225dced17c1c1e9beccfce36fe956ec926e65f75fd9a21d77a369c2fcc8d29505b
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRi:q7Tc2NYHUrAwfMp3CDRi
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/2912-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2024-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2024-175-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1560-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/660-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1612-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2412-521-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1952-647-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1100-742-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3064-968-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2684-1136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2036-1199-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2400-1296-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1148-1055-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2796-690-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2460-484-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1832-426-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/880-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-248-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2188-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/940-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-228-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1972-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2020-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2020-164-0x0000000001C70000-0x0000000001C9A000-memory.dmp family_blackmoon behavioral1/memory/1864-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1664-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2044-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1868-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1984-111-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1984-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-65-0x0000000000260000-0x000000000028A000-memory.dmp family_blackmoon behavioral1/memory/1148-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-0-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2184 1fxxlxl.exe 2912 rlrfrxr.exe 1148 httbnt.exe 1028 lxrrrlx.exe 2840 7dvdv.exe 2844 lrrfflf.exe 2732 btbbhb.exe 2832 xlfffxx.exe 1748 bnbnnn.exe 2692 vpdjp.exe 1984 lrrrxrl.exe 1868 pjdpj.exe 2044 jvdpj.exe 1724 bhhbbt.exe 1664 1jjdj.exe 1864 3rrrfrx.exe 2020 7bnnhn.exe 2024 vvpdp.exe 2956 ppjdd.exe 2244 fxxrrll.exe 1972 9rrlxlx.exe 2264 tbtbnn.exe 1604 jjjdv.exe 3068 ffxrfll.exe 940 hnthbh.exe 2188 1vvdj.exe 328 xllfrfx.exe 2152 vvvvp.exe 880 jppvp.exe 2160 lrrffrl.exe 2192 hnhhht.exe 1560 vvvpj.exe 544 3dpdj.exe 1148 3lrfllx.exe 2856 jvjpv.exe 2392 1tbnth.exe 2748 thntnb.exe 2844 dvvjv.exe 2828 xfrxxrx.exe 2896 bhnnbh.exe 2972 pjdjv.exe 2336 dvdjp.exe 668 rxrxxfr.exe 660 vppjd.exe 1612 vppvp.exe 1996 fxrlxfx.exe 2640 nhbbnt.exe 1724 1vpdv.exe 2012 jpdpj.exe 1248 lrlxlrl.exe 1364 thhbnt.exe 1832 bbtnht.exe 2952 ppdjv.exe 2956 fllffll.exe 2108 fllrlrl.exe 2304 1nhbth.exe 2916 pppjd.exe 2508 xxxxlrl.exe 1936 lxrfrff.exe 1372 hhhbnt.exe 2460 hhbnbt.exe 636 pdvdj.exe 2364 5vdvd.exe 2932 fxrxllf.exe -
resource yara_rule behavioral1/memory/2912-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1028-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/544-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1560-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/660-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-521-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-787-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1052-801-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-840-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-877-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-956-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-1006-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-1068-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-1136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-1192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1300-1316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/468-1254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1924-827-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-814-0x00000000002A0000-0x00000000002CA000-memory.dmp upx behavioral1/memory/2796-690-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-484-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1372-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1832-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/880-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/940-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1972-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1864-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1868-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1148-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-0-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrfflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrfxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hthbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfflfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffflfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbthbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bnbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hhtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tbtnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrrffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hhtbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrfrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxxxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfflfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrxrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlrrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ddpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflfxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffllflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflrrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tnbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfllrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfllfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxrrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bttnh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2128 wrote to memory of 2184 2128 fa4957b79b45162945d4e9667618f9e25b57574aa3942309c2a88b04a1ddf1f8.exe 1027 PID 2128 wrote to memory of 2184 2128 fa4957b79b45162945d4e9667618f9e25b57574aa3942309c2a88b04a1ddf1f8.exe 1027 PID 2128 wrote to memory of 2184 2128 fa4957b79b45162945d4e9667618f9e25b57574aa3942309c2a88b04a1ddf1f8.exe 1027 PID 2128 wrote to memory of 2184 2128 fa4957b79b45162945d4e9667618f9e25b57574aa3942309c2a88b04a1ddf1f8.exe 1027 PID 2184 wrote to memory of 2912 2184 1fxxlxl.exe 31 PID 2184 wrote to memory of 2912 2184 1fxxlxl.exe 31 PID 2184 wrote to memory of 2912 2184 1fxxlxl.exe 31 PID 2184 wrote to memory of 2912 2184 1fxxlxl.exe 31 PID 2912 wrote to memory of 1148 2912 rlrfrxr.exe 32 PID 2912 wrote to memory of 1148 2912 rlrfrxr.exe 32 PID 2912 wrote to memory of 1148 2912 rlrfrxr.exe 32 PID 2912 wrote to memory of 1148 2912 rlrfrxr.exe 32 PID 1148 wrote to memory of 1028 1148 httbnt.exe 3445 PID 1148 wrote to memory of 1028 1148 httbnt.exe 3445 PID 1148 wrote to memory of 1028 1148 httbnt.exe 3445 PID 1148 wrote to memory of 1028 1148 httbnt.exe 3445 PID 1028 wrote to memory of 2840 1028 lxrrrlx.exe 144 PID 1028 wrote to memory of 2840 1028 lxrrrlx.exe 144 PID 1028 wrote to memory of 2840 1028 lxrrrlx.exe 144 PID 1028 wrote to memory of 2840 1028 lxrrrlx.exe 144 PID 2840 wrote to memory of 2844 2840 7dvdv.exe 35 PID 2840 wrote to memory of 2844 2840 7dvdv.exe 35 PID 2840 wrote to memory of 2844 2840 7dvdv.exe 35 PID 2840 wrote to memory of 2844 2840 7dvdv.exe 35 PID 2844 wrote to memory of 2732 2844 lrrfflf.exe 36 PID 2844 wrote to memory of 2732 2844 lrrfflf.exe 36 PID 2844 wrote to memory of 2732 2844 lrrfflf.exe 36 PID 2844 wrote to memory of 2732 2844 lrrfflf.exe 36 PID 2732 wrote to memory of 2832 2732 btbbhb.exe 37 PID 2732 wrote to memory of 2832 2732 btbbhb.exe 37 PID 2732 wrote to memory of 2832 2732 btbbhb.exe 37 PID 2732 wrote to memory of 2832 2732 btbbhb.exe 37 PID 2832 wrote to memory of 1748 2832 xlfffxx.exe 38 PID 2832 wrote to memory of 1748 2832 xlfffxx.exe 38 PID 2832 wrote to memory of 1748 2832 xlfffxx.exe 38 PID 2832 wrote to memory of 1748 2832 xlfffxx.exe 38 PID 1748 wrote to memory of 2692 1748 bnbnnn.exe 39 PID 1748 wrote to memory of 2692 1748 bnbnnn.exe 39 PID 1748 wrote to memory of 2692 1748 bnbnnn.exe 39 PID 1748 wrote to memory of 2692 1748 bnbnnn.exe 39 PID 2692 wrote to memory of 1984 2692 vpdjp.exe 40 PID 2692 wrote to memory of 1984 2692 vpdjp.exe 40 PID 2692 wrote to memory of 1984 2692 vpdjp.exe 40 PID 2692 wrote to memory of 1984 2692 vpdjp.exe 40 PID 1984 wrote to memory of 1868 1984 lrrrxrl.exe 41 PID 1984 wrote to memory of 1868 1984 lrrrxrl.exe 41 PID 1984 wrote to memory of 1868 1984 lrrrxrl.exe 41 PID 1984 wrote to memory of 1868 1984 lrrrxrl.exe 41 PID 1868 wrote to memory of 2044 1868 pjdpj.exe 42 PID 1868 wrote to memory of 2044 1868 pjdpj.exe 42 PID 1868 wrote to memory of 2044 1868 pjdpj.exe 42 PID 1868 wrote to memory of 2044 1868 pjdpj.exe 42 PID 2044 wrote to memory of 1724 2044 jvdpj.exe 43 PID 2044 wrote to memory of 1724 2044 jvdpj.exe 43 PID 2044 wrote to memory of 1724 2044 jvdpj.exe 43 PID 2044 wrote to memory of 1724 2044 jvdpj.exe 43 PID 1724 wrote to memory of 1664 1724 bhhbbt.exe 44 PID 1724 wrote to memory of 1664 1724 bhhbbt.exe 44 PID 1724 wrote to memory of 1664 1724 bhhbbt.exe 44 PID 1724 wrote to memory of 1664 1724 bhhbbt.exe 44 PID 1664 wrote to memory of 1864 1664 1jjdj.exe 45 PID 1664 wrote to memory of 1864 1664 1jjdj.exe 45 PID 1664 wrote to memory of 1864 1664 1jjdj.exe 45 PID 1664 wrote to memory of 1864 1664 1jjdj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\fa4957b79b45162945d4e9667618f9e25b57574aa3942309c2a88b04a1ddf1f8.exe"C:\Users\Admin\AppData\Local\Temp\fa4957b79b45162945d4e9667618f9e25b57574aa3942309c2a88b04a1ddf1f8.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\1fxxlxl.exec:\1fxxlxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\rlrfrxr.exec:\rlrfrxr.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\httbnt.exec:\httbnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
\??\c:\lxrrrlx.exec:\lxrrrlx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
\??\c:\7dvdv.exec:\7dvdv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\lrrfflf.exec:\lrrfflf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\btbbhb.exec:\btbbhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\xlfffxx.exec:\xlfffxx.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\bnbnnn.exec:\bnbnnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\vpdjp.exec:\vpdjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\lrrrxrl.exec:\lrrrxrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\pjdpj.exec:\pjdpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\jvdpj.exec:\jvdpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\bhhbbt.exec:\bhhbbt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\1jjdj.exec:\1jjdj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\3rrrfrx.exec:\3rrrfrx.exe17⤵
- Executes dropped EXE
PID:1864 -
\??\c:\7bnnhn.exec:\7bnnhn.exe18⤵
- Executes dropped EXE
PID:2020 -
\??\c:\vvpdp.exec:\vvpdp.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2024 -
\??\c:\ppjdd.exec:\ppjdd.exe20⤵
- Executes dropped EXE
PID:2956 -
\??\c:\fxxrrll.exec:\fxxrrll.exe21⤵
- Executes dropped EXE
PID:2244 -
\??\c:\9rrlxlx.exec:\9rrlxlx.exe22⤵
- Executes dropped EXE
PID:1972 -
\??\c:\tbtbnn.exec:\tbtbnn.exe23⤵
- Executes dropped EXE
PID:2264 -
\??\c:\jjjdv.exec:\jjjdv.exe24⤵
- Executes dropped EXE
PID:1604 -
\??\c:\ffxrfll.exec:\ffxrfll.exe25⤵
- Executes dropped EXE
PID:3068 -
\??\c:\hnthbh.exec:\hnthbh.exe26⤵
- Executes dropped EXE
PID:940 -
\??\c:\1vvdj.exec:\1vvdj.exe27⤵
- Executes dropped EXE
PID:2188 -
\??\c:\xllfrfx.exec:\xllfrfx.exe28⤵
- Executes dropped EXE
PID:328 -
\??\c:\vvvvp.exec:\vvvvp.exe29⤵
- Executes dropped EXE
PID:2152 -
\??\c:\jppvp.exec:\jppvp.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:880 -
\??\c:\lrrffrl.exec:\lrrffrl.exe31⤵
- Executes dropped EXE
PID:2160 -
\??\c:\hnhhht.exec:\hnhhht.exe32⤵
- Executes dropped EXE
PID:2192 -
\??\c:\vvvpj.exec:\vvvpj.exe33⤵
- Executes dropped EXE
PID:1560 -
\??\c:\3dpdj.exec:\3dpdj.exe34⤵
- Executes dropped EXE
PID:544 -
\??\c:\3lrfllx.exec:\3lrfllx.exe35⤵
- Executes dropped EXE
PID:1148 -
\??\c:\jvjpv.exec:\jvjpv.exe36⤵
- Executes dropped EXE
PID:2856 -
\??\c:\1tbnth.exec:\1tbnth.exe37⤵
- Executes dropped EXE
PID:2392 -
\??\c:\thntnb.exec:\thntnb.exe38⤵
- Executes dropped EXE
PID:2748 -
\??\c:\dvvjv.exec:\dvvjv.exe39⤵
- Executes dropped EXE
PID:2844 -
\??\c:\xfrxxrx.exec:\xfrxxrx.exe40⤵
- Executes dropped EXE
PID:2828 -
\??\c:\bhnnbh.exec:\bhnnbh.exe41⤵
- Executes dropped EXE
PID:2896 -
\??\c:\pjdjv.exec:\pjdjv.exe42⤵
- Executes dropped EXE
PID:2972 -
\??\c:\dvdjp.exec:\dvdjp.exe43⤵
- Executes dropped EXE
PID:2336 -
\??\c:\rxrxxfr.exec:\rxrxxfr.exe44⤵
- Executes dropped EXE
PID:668 -
\??\c:\vppjd.exec:\vppjd.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:660 -
\??\c:\vppvp.exec:\vppvp.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1612 -
\??\c:\fxrlxfx.exec:\fxrlxfx.exe47⤵
- Executes dropped EXE
PID:1996 -
\??\c:\nhbbnt.exec:\nhbbnt.exe48⤵
- Executes dropped EXE
PID:2640 -
\??\c:\1vpdv.exec:\1vpdv.exe49⤵
- Executes dropped EXE
PID:1724 -
\??\c:\jpdpj.exec:\jpdpj.exe50⤵
- Executes dropped EXE
PID:2012 -
\??\c:\lrlxlrl.exec:\lrlxlrl.exe51⤵
- Executes dropped EXE
PID:1248 -
\??\c:\thhbnt.exec:\thhbnt.exe52⤵
- Executes dropped EXE
PID:1364 -
\??\c:\bbtnht.exec:\bbtnht.exe53⤵
- Executes dropped EXE
PID:1832 -
\??\c:\ppdjv.exec:\ppdjv.exe54⤵
- Executes dropped EXE
PID:2952 -
\??\c:\fllffll.exec:\fllffll.exe55⤵
- Executes dropped EXE
PID:2956 -
\??\c:\fllrlrl.exec:\fllrlrl.exe56⤵
- Executes dropped EXE
PID:2108 -
\??\c:\1nhbth.exec:\1nhbth.exe57⤵
- Executes dropped EXE
PID:2304 -
\??\c:\pppjd.exec:\pppjd.exe58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2916 -
\??\c:\xxxxlrl.exec:\xxxxlrl.exe59⤵
- Executes dropped EXE
PID:2508 -
\??\c:\lxrfrff.exec:\lxrfrff.exe60⤵
- Executes dropped EXE
PID:1936 -
\??\c:\hhhbnt.exec:\hhhbnt.exe61⤵
- Executes dropped EXE
PID:1372 -
\??\c:\hhbnbt.exec:\hhbnbt.exe62⤵
- Executes dropped EXE
PID:2460 -
\??\c:\pdvdj.exec:\pdvdj.exe63⤵
- Executes dropped EXE
PID:636 -
\??\c:\5vdvd.exec:\5vdvd.exe64⤵
- Executes dropped EXE
PID:2364 -
\??\c:\fxrxllf.exec:\fxrxllf.exe65⤵
- Executes dropped EXE
PID:2932 -
\??\c:\ntthtb.exec:\ntthtb.exe66⤵PID:2412
-
\??\c:\nbnbnn.exec:\nbnbnn.exe67⤵PID:2328
-
\??\c:\dvpvj.exec:\dvpvj.exe68⤵PID:2124
-
\??\c:\xxrxflf.exec:\xxrxflf.exe69⤵PID:2080
-
\??\c:\xlrxrlr.exec:\xlrxrlr.exe70⤵
- System Location Discovery: System Language Discovery
PID:1588 -
\??\c:\nnhttn.exec:\nnhttn.exe71⤵PID:1164
-
\??\c:\ppvpv.exec:\ppvpv.exe72⤵PID:2428
-
\??\c:\ddpvd.exec:\ddpvd.exe73⤵PID:2348
-
\??\c:\lxrfrxr.exec:\lxrfrxr.exe74⤵PID:1028
-
\??\c:\lllfrxl.exec:\lllfrxl.exe75⤵PID:2892
-
\??\c:\hnnbth.exec:\hnnbth.exe76⤵PID:2744
-
\??\c:\ppdpj.exec:\ppdpj.exe77⤵PID:2904
-
\??\c:\jppdd.exec:\jppdd.exe78⤵PID:2748
-
\??\c:\3lxxlrf.exec:\3lxxlrf.exe79⤵PID:2820
-
\??\c:\rfxrrfr.exec:\rfxrrfr.exe80⤵PID:1792
-
\??\c:\nhnntt.exec:\nhnntt.exe81⤵PID:2632
-
\??\c:\pvjdd.exec:\pvjdd.exe82⤵PID:2360
-
\??\c:\fxfrrll.exec:\fxfrrll.exe83⤵PID:2496
-
\??\c:\lxfxxrl.exec:\lxfxxrl.exe84⤵PID:2824
-
\??\c:\nbtttn.exec:\nbtttn.exe85⤵PID:1716
-
\??\c:\5vpdp.exec:\5vpdp.exe86⤵PID:2144
-
\??\c:\7pjpv.exec:\7pjpv.exe87⤵PID:2636
-
\??\c:\rrxrfll.exec:\rrxrfll.exe88⤵PID:756
-
\??\c:\tbnbbt.exec:\tbnbbt.exe89⤵PID:1952
-
\??\c:\hbbtnh.exec:\hbbtnh.exe90⤵PID:2440
-
\??\c:\pjvpp.exec:\pjvpp.exe91⤵PID:2948
-
\??\c:\9lffrrr.exec:\9lffrrr.exe92⤵PID:400
-
\??\c:\5lfllfx.exec:\5lfllfx.exe93⤵PID:2020
-
\??\c:\hnhbhb.exec:\hnhbhb.exe94⤵PID:2808
-
\??\c:\pjvpp.exec:\pjvpp.exe95⤵PID:1456
-
\??\c:\pdvpp.exec:\pdvpp.exe96⤵PID:2796
-
\??\c:\xlflxxr.exec:\xlflxxr.exe97⤵PID:336
-
\??\c:\tbhbbn.exec:\tbhbbn.exe98⤵PID:1796
-
\??\c:\bntnnh.exec:\bntnnh.exe99⤵PID:1656
-
\??\c:\dpjdp.exec:\dpjdp.exe100⤵PID:760
-
\??\c:\frfrxrl.exec:\frfrxrl.exe101⤵PID:1920
-
\??\c:\bhnhht.exec:\bhnhht.exe102⤵PID:2180
-
\??\c:\nnnbth.exec:\nnnbth.exe103⤵PID:1876
-
\??\c:\vdddd.exec:\vdddd.exe104⤵PID:1100
-
\??\c:\ffrfxlr.exec:\ffrfxlr.exe105⤵
- System Location Discovery: System Language Discovery
PID:2404 -
\??\c:\rlxxfxx.exec:\rlxxfxx.exe106⤵PID:1960
-
\??\c:\1nttnt.exec:\1nttnt.exe107⤵PID:1712
-
\??\c:\vdjdv.exec:\vdjdv.exe108⤵PID:2248
-
\??\c:\jjjjj.exec:\jjjjj.exe109⤵
- System Location Discovery: System Language Discovery
PID:1732 -
\??\c:\lxxxxrr.exec:\lxxxxrr.exe110⤵
- System Location Discovery: System Language Discovery
PID:3040 -
\??\c:\bthhtb.exec:\bthhtb.exe111⤵PID:2160
-
\??\c:\hbntbh.exec:\hbntbh.exe112⤵PID:3016
-
\??\c:\djddv.exec:\djddv.exe113⤵PID:1164
-
\??\c:\lrxfrrl.exec:\lrxfrrl.exe114⤵PID:1052
-
\??\c:\xfllfxr.exec:\xfllfxr.exe115⤵PID:2884
-
\??\c:\bbhtnn.exec:\bbhtnn.exe116⤵PID:2840
-
\??\c:\vdjvp.exec:\vdjvp.exe117⤵PID:2324
-
\??\c:\vddjv.exec:\vddjv.exe118⤵PID:1924
-
\??\c:\lxxrrxr.exec:\lxxrrxr.exe119⤵PID:2516
-
\??\c:\5ffrlrr.exec:\5ffrlrr.exe120⤵PID:2488
-
\??\c:\1nnnhb.exec:\1nnnhb.exe121⤵PID:2588
-
\??\c:\3vpjj.exec:\3vpjj.exe122⤵PID:2156
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-