Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 05:39
Behavioral task
behavioral1
Sample
7459b02fa9e3f3dcbfe02e7632b1679e816abb8e24d9d402cba88837c4879c6b.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
7459b02fa9e3f3dcbfe02e7632b1679e816abb8e24d9d402cba88837c4879c6b.exe
-
Size
345KB
-
MD5
f71b220df3dcfffd0380112f44a33edc
-
SHA1
5b094cc982f2f0bbef20e532b5a68180172f22be
-
SHA256
7459b02fa9e3f3dcbfe02e7632b1679e816abb8e24d9d402cba88837c4879c6b
-
SHA512
9822a720d58ff28f5ea41e83d950ed9d5e720a9332657af388e86f0600b3293c0586ac018d3e00f73d7256ea5b448e44551abde35a24bcb230d07129a04da104
-
SSDEEP
6144:Lcm4FmowdHoSEYW5fNZWB5hFfci3Add4kGYAm:R4wFHoS3WXZshJX2VGdm
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/236-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1640-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2784-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2956-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2232-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2404-189-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2752-299-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1636-269-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/324-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1464-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/772-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/760-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/756-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2628-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2800-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2284-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2728-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2764-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2804-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2284-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2396-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2088-311-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2892-327-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2636-334-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2864-340-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2624-358-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3008-364-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/568-373-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1420-372-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2864-371-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2948-384-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2112-432-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/884-499-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1532-530-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2668-577-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2844-594-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2104-668-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/320-779-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2664-841-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2316-907-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/3044-961-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2544-1004-0x00000000777B0000-0x00000000778AA000-memory.dmp family_blackmoon behavioral1/memory/2544-1003-0x00000000778B0000-0x00000000779CF000-memory.dmp family_blackmoon behavioral1/memory/1500-1048-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2544-1496-0x00000000778B0000-0x00000000779CF000-memory.dmp family_blackmoon behavioral1/memory/2544-7751-0x00000000778B0000-0x00000000779CF000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1640 vjpdd.exe 2396 xlfxlfr.exe 2284 tthbtn.exe 2804 ppdpd.exe 2764 xrflflf.exe 2728 rlxfffl.exe 2800 tntnnn.exe 2784 7tbhbt.exe 2628 jvddd.exe 2040 dpddd.exe 756 lfrrrxf.exe 2932 xlllxxf.exe 760 bthhtt.exe 2956 thnthh.exe 1004 9jjjv.exe 2680 rflxfxx.exe 2940 rflflfl.exe 336 bthbbn.exe 772 1tbhnh.exe 1344 pjvjp.exe 2232 9jvvv.exe 2092 rfflrlr.exe 2124 lfrlrrr.exe 2404 7hbntt.exe 2120 dvjdp.exe 1464 dvjjd.exe 324 ffrfrrx.exe 924 tnnthh.exe 380 jvjjj.exe 1624 7vjdd.exe 2000 frllrlr.exe 344 nthntt.exe 2160 3jpjj.exe 872 vjvvv.exe 1660 rfllllr.exe 1636 bthnbb.exe 1864 jpddj.exe 2532 jdvdj.exe 1532 xrflxlx.exe 2460 hbnntb.exe 2136 thhnth.exe 2752 dvpvj.exe 2088 pjvpv.exe 2192 5fxfllr.exe 2832 nbhtth.exe 2892 djdpv.exe 2636 fxllllx.exe 2864 1thbhh.exe 2216 pjdjj.exe 1776 nhttbh.exe 2624 1vjpp.exe 3008 rrfflfl.exe 1420 1bnhtn.exe 568 ththnn.exe 2948 1jdjj.exe 2920 5flrlrf.exe 2448 nbthhn.exe 1904 dpdvv.exe 1036 lxfffff.exe 2092 5nbttn.exe 2456 nhnhhn.exe 2024 pjvdp.exe 2404 7xlxxrr.exe 2112 nbhnhn.exe -
resource yara_rule behavioral1/memory/236-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/236-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1640-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000012117-7.dat upx behavioral1/memory/2396-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1640-17-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0008000000016c3a-16.dat upx behavioral1/memory/1640-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016c4a-27.dat upx behavioral1/memory/2804-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016c51-35.dat upx behavioral1/files/0x0007000000016cc8-43.dat upx behavioral1/memory/2784-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d18-76.dat upx behavioral1/files/0x00070000000173a9-85.dat upx behavioral1/memory/2956-116-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018683-123.dat upx behavioral1/files/0x00050000000186e4-130.dat upx behavioral1/files/0x0005000000018728-159.dat upx behavioral1/memory/2232-167-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018784-174.dat upx behavioral1/memory/2404-189-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001925e-203.dat upx behavioral1/files/0x0005000000019282-219.dat upx behavioral1/files/0x00050000000193c2-247.dat upx behavioral1/memory/2752-299-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2088-305-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1636-269-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193b4-240.dat upx behavioral1/files/0x0005000000019350-233.dat upx behavioral1/files/0x0005000000019334-226.dat upx behavioral1/memory/324-212-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019261-211.dat upx behavioral1/memory/1464-204-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000019023-196.dat upx behavioral1/files/0x00050000000187a5-188.dat upx behavioral1/files/0x000500000001878f-181.dat upx behavioral1/files/0x000500000001873d-166.dat upx behavioral1/memory/772-152-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000186fd-151.dat upx behavioral1/files/0x00050000000186ee-144.dat upx behavioral1/files/0x00050000000186ea-137.dat upx behavioral1/files/0x000d000000018676-115.dat upx behavioral1/memory/760-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000174cc-107.dat upx behavioral1/files/0x0006000000017492-100.dat upx behavioral1/memory/756-93-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017488-92.dat upx behavioral1/memory/2628-79-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2800-62-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016d06-60.dat upx behavioral1/files/0x0008000000016d0e-68.dat upx behavioral1/memory/2728-54-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016cec-52.dat upx behavioral1/memory/2764-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2804-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2284-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2396-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2088-311-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2892-327-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2636-328-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2636-334-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2864-340-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2624-352-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxflrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1thhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfrfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nbthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrllxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhthnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nttbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfflrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nbnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfllllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxlrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 236 wrote to memory of 1640 236 7459b02fa9e3f3dcbfe02e7632b1679e816abb8e24d9d402cba88837c4879c6b.exe 30 PID 236 wrote to memory of 1640 236 7459b02fa9e3f3dcbfe02e7632b1679e816abb8e24d9d402cba88837c4879c6b.exe 30 PID 236 wrote to memory of 1640 236 7459b02fa9e3f3dcbfe02e7632b1679e816abb8e24d9d402cba88837c4879c6b.exe 30 PID 236 wrote to memory of 1640 236 7459b02fa9e3f3dcbfe02e7632b1679e816abb8e24d9d402cba88837c4879c6b.exe 30 PID 1640 wrote to memory of 2396 1640 vjpdd.exe 31 PID 1640 wrote to memory of 2396 1640 vjpdd.exe 31 PID 1640 wrote to memory of 2396 1640 vjpdd.exe 31 PID 1640 wrote to memory of 2396 1640 vjpdd.exe 31 PID 2396 wrote to memory of 2284 2396 xlfxlfr.exe 32 PID 2396 wrote to memory of 2284 2396 xlfxlfr.exe 32 PID 2396 wrote to memory of 2284 2396 xlfxlfr.exe 32 PID 2396 wrote to memory of 2284 2396 xlfxlfr.exe 32 PID 2284 wrote to memory of 2804 2284 tthbtn.exe 33 PID 2284 wrote to memory of 2804 2284 tthbtn.exe 33 PID 2284 wrote to memory of 2804 2284 tthbtn.exe 33 PID 2284 wrote to memory of 2804 2284 tthbtn.exe 33 PID 2804 wrote to memory of 2764 2804 ppdpd.exe 34 PID 2804 wrote to memory of 2764 2804 ppdpd.exe 34 PID 2804 wrote to memory of 2764 2804 ppdpd.exe 34 PID 2804 wrote to memory of 2764 2804 ppdpd.exe 34 PID 2764 wrote to memory of 2728 2764 xrflflf.exe 35 PID 2764 wrote to memory of 2728 2764 xrflflf.exe 35 PID 2764 wrote to memory of 2728 2764 xrflflf.exe 35 PID 2764 wrote to memory of 2728 2764 xrflflf.exe 35 PID 2728 wrote to memory of 2800 2728 rlxfffl.exe 36 PID 2728 wrote to memory of 2800 2728 rlxfffl.exe 36 PID 2728 wrote to memory of 2800 2728 rlxfffl.exe 36 PID 2728 wrote to memory of 2800 2728 rlxfffl.exe 36 PID 2800 wrote to memory of 2784 2800 tntnnn.exe 37 PID 2800 wrote to memory of 2784 2800 tntnnn.exe 37 PID 2800 wrote to memory of 2784 2800 tntnnn.exe 37 PID 2800 wrote to memory of 2784 2800 tntnnn.exe 37 PID 2784 wrote to memory of 2628 2784 7tbhbt.exe 38 PID 2784 wrote to memory of 2628 2784 7tbhbt.exe 38 PID 2784 wrote to memory of 2628 2784 7tbhbt.exe 38 PID 2784 wrote to memory of 2628 2784 7tbhbt.exe 38 PID 2628 wrote to memory of 2040 2628 jvddd.exe 39 PID 2628 wrote to memory of 2040 2628 jvddd.exe 39 PID 2628 wrote to memory of 2040 2628 jvddd.exe 39 PID 2628 wrote to memory of 2040 2628 jvddd.exe 39 PID 2040 wrote to memory of 756 2040 dpddd.exe 40 PID 2040 wrote to memory of 756 2040 dpddd.exe 40 PID 2040 wrote to memory of 756 2040 dpddd.exe 40 PID 2040 wrote to memory of 756 2040 dpddd.exe 40 PID 756 wrote to memory of 2932 756 lfrrrxf.exe 41 PID 756 wrote to memory of 2932 756 lfrrrxf.exe 41 PID 756 wrote to memory of 2932 756 lfrrrxf.exe 41 PID 756 wrote to memory of 2932 756 lfrrrxf.exe 41 PID 2932 wrote to memory of 760 2932 xlllxxf.exe 42 PID 2932 wrote to memory of 760 2932 xlllxxf.exe 42 PID 2932 wrote to memory of 760 2932 xlllxxf.exe 42 PID 2932 wrote to memory of 760 2932 xlllxxf.exe 42 PID 760 wrote to memory of 2956 760 bthhtt.exe 43 PID 760 wrote to memory of 2956 760 bthhtt.exe 43 PID 760 wrote to memory of 2956 760 bthhtt.exe 43 PID 760 wrote to memory of 2956 760 bthhtt.exe 43 PID 2956 wrote to memory of 1004 2956 thnthh.exe 44 PID 2956 wrote to memory of 1004 2956 thnthh.exe 44 PID 2956 wrote to memory of 1004 2956 thnthh.exe 44 PID 2956 wrote to memory of 1004 2956 thnthh.exe 44 PID 1004 wrote to memory of 2680 1004 9jjjv.exe 45 PID 1004 wrote to memory of 2680 1004 9jjjv.exe 45 PID 1004 wrote to memory of 2680 1004 9jjjv.exe 45 PID 1004 wrote to memory of 2680 1004 9jjjv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\7459b02fa9e3f3dcbfe02e7632b1679e816abb8e24d9d402cba88837c4879c6b.exe"C:\Users\Admin\AppData\Local\Temp\7459b02fa9e3f3dcbfe02e7632b1679e816abb8e24d9d402cba88837c4879c6b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:236 -
\??\c:\vjpdd.exec:\vjpdd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\xlfxlfr.exec:\xlfxlfr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\tthbtn.exec:\tthbtn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\ppdpd.exec:\ppdpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\xrflflf.exec:\xrflflf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\rlxfffl.exec:\rlxfffl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\tntnnn.exec:\tntnnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\7tbhbt.exec:\7tbhbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\jvddd.exec:\jvddd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\dpddd.exec:\dpddd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\lfrrrxf.exec:\lfrrrxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\xlllxxf.exec:\xlllxxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\bthhtt.exec:\bthhtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
\??\c:\thnthh.exec:\thnthh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\9jjjv.exec:\9jjjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
\??\c:\rflxfxx.exec:\rflxfxx.exe17⤵
- Executes dropped EXE
PID:2680 -
\??\c:\rflflfl.exec:\rflflfl.exe18⤵
- Executes dropped EXE
PID:2940 -
\??\c:\bthbbn.exec:\bthbbn.exe19⤵
- Executes dropped EXE
PID:336 -
\??\c:\1tbhnh.exec:\1tbhnh.exe20⤵
- Executes dropped EXE
PID:772 -
\??\c:\pjvjp.exec:\pjvjp.exe21⤵
- Executes dropped EXE
PID:1344 -
\??\c:\9jvvv.exec:\9jvvv.exe22⤵
- Executes dropped EXE
PID:2232 -
\??\c:\rfflrlr.exec:\rfflrlr.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2092 -
\??\c:\lfrlrrr.exec:\lfrlrrr.exe24⤵
- Executes dropped EXE
PID:2124 -
\??\c:\7hbntt.exec:\7hbntt.exe25⤵
- Executes dropped EXE
PID:2404 -
\??\c:\dvjdp.exec:\dvjdp.exe26⤵
- Executes dropped EXE
PID:2120 -
\??\c:\dvjjd.exec:\dvjjd.exe27⤵
- Executes dropped EXE
PID:1464 -
\??\c:\ffrfrrx.exec:\ffrfrrx.exe28⤵
- Executes dropped EXE
PID:324 -
\??\c:\tnnthh.exec:\tnnthh.exe29⤵
- Executes dropped EXE
PID:924 -
\??\c:\jvjjj.exec:\jvjjj.exe30⤵
- Executes dropped EXE
PID:380 -
\??\c:\7vjdd.exec:\7vjdd.exe31⤵
- Executes dropped EXE
PID:1624 -
\??\c:\frllrlr.exec:\frllrlr.exe32⤵
- Executes dropped EXE
PID:2000 -
\??\c:\nthntt.exec:\nthntt.exe33⤵
- Executes dropped EXE
PID:344 -
\??\c:\3jpjj.exec:\3jpjj.exe34⤵
- Executes dropped EXE
PID:2160 -
\??\c:\vjvvv.exec:\vjvvv.exe35⤵
- Executes dropped EXE
PID:872 -
\??\c:\rfllllr.exec:\rfllllr.exe36⤵
- Executes dropped EXE
PID:1660 -
\??\c:\bthnbb.exec:\bthnbb.exe37⤵
- Executes dropped EXE
PID:1636 -
\??\c:\jpddj.exec:\jpddj.exe38⤵
- Executes dropped EXE
PID:1864 -
\??\c:\jdvdj.exec:\jdvdj.exe39⤵
- Executes dropped EXE
PID:2532 -
\??\c:\xrflxlx.exec:\xrflxlx.exe40⤵
- Executes dropped EXE
PID:1532 -
\??\c:\hbnntb.exec:\hbnntb.exe41⤵
- Executes dropped EXE
PID:2460 -
\??\c:\thhnth.exec:\thhnth.exe42⤵
- Executes dropped EXE
PID:2136 -
\??\c:\dvpvj.exec:\dvpvj.exe43⤵
- Executes dropped EXE
PID:2752 -
\??\c:\pjvpv.exec:\pjvpv.exe44⤵
- Executes dropped EXE
PID:2088 -
\??\c:\5fxfllr.exec:\5fxfllr.exe45⤵
- Executes dropped EXE
PID:2192 -
\??\c:\nbhtth.exec:\nbhtth.exe46⤵
- Executes dropped EXE
PID:2832 -
\??\c:\djdpv.exec:\djdpv.exe47⤵
- Executes dropped EXE
PID:2892 -
\??\c:\fxllllx.exec:\fxllllx.exe48⤵
- Executes dropped EXE
PID:2636 -
\??\c:\1thbhh.exec:\1thbhh.exe49⤵
- Executes dropped EXE
PID:2864 -
\??\c:\pjdjj.exec:\pjdjj.exe50⤵
- Executes dropped EXE
PID:2216 -
\??\c:\nhttbh.exec:\nhttbh.exe51⤵
- Executes dropped EXE
PID:1776 -
\??\c:\1vjpp.exec:\1vjpp.exe52⤵
- Executes dropped EXE
PID:2624 -
\??\c:\rrfflfl.exec:\rrfflfl.exe53⤵
- Executes dropped EXE
PID:3008 -
\??\c:\1bnhtn.exec:\1bnhtn.exe54⤵
- Executes dropped EXE
PID:1420 -
\??\c:\ththnn.exec:\ththnn.exe55⤵
- Executes dropped EXE
PID:568 -
\??\c:\1jdjj.exec:\1jdjj.exe56⤵
- Executes dropped EXE
PID:2948 -
\??\c:\5flrlrf.exec:\5flrlrf.exe57⤵
- Executes dropped EXE
PID:2920 -
\??\c:\nbthhn.exec:\nbthhn.exe58⤵
- Executes dropped EXE
PID:2448 -
\??\c:\dpdvv.exec:\dpdvv.exe59⤵
- Executes dropped EXE
PID:1904 -
\??\c:\lxfffff.exec:\lxfffff.exe60⤵
- Executes dropped EXE
PID:1036 -
\??\c:\5nbttn.exec:\5nbttn.exe61⤵
- Executes dropped EXE
PID:2092 -
\??\c:\nhnhhn.exec:\nhnhhn.exe62⤵
- Executes dropped EXE
PID:2456 -
\??\c:\pjvdp.exec:\pjvdp.exe63⤵
- Executes dropped EXE
PID:2024 -
\??\c:\7xlxxrr.exec:\7xlxxrr.exe64⤵
- Executes dropped EXE
PID:2404 -
\??\c:\nbhnhn.exec:\nbhnhn.exe65⤵
- Executes dropped EXE
PID:2112 -
\??\c:\tbhbbb.exec:\tbhbbb.exe66⤵PID:2980
-
\??\c:\vjdjp.exec:\vjdjp.exe67⤵PID:1440
-
\??\c:\7vjjv.exec:\7vjjv.exe68⤵PID:1584
-
\??\c:\9frrlff.exec:\9frrlff.exe69⤵PID:2968
-
\??\c:\lrxfxfl.exec:\lrxfxfl.exe70⤵PID:380
-
\??\c:\7nbbbb.exec:\7nbbbb.exe71⤵PID:3044
-
\??\c:\thtntt.exec:\thtntt.exe72⤵PID:1668
-
\??\c:\pdpjj.exec:\pdpjj.exe73⤵PID:2172
-
\??\c:\1xfxrrr.exec:\1xfxrrr.exe74⤵PID:2148
-
\??\c:\frflllr.exec:\frflllr.exe75⤵PID:2368
-
\??\c:\bnnnnh.exec:\bnnnnh.exe76⤵PID:1936
-
\??\c:\bthbbb.exec:\bthbbb.exe77⤵PID:2372
-
\??\c:\9vjdj.exec:\9vjdj.exe78⤵PID:1908
-
\??\c:\3pppj.exec:\3pppj.exe79⤵PID:884
-
\??\c:\fxllrfl.exec:\fxllrfl.exe80⤵PID:2308
-
\??\c:\bthntb.exec:\bthntb.exe81⤵PID:1864
-
\??\c:\9httnn.exec:\9httnn.exe82⤵PID:792
-
\??\c:\jdpjj.exec:\jdpjj.exe83⤵PID:1792
-
\??\c:\ppdjd.exec:\ppdjd.exe84⤵PID:1532
-
\??\c:\fxffffr.exec:\fxffffr.exe85⤵PID:1628
-
\??\c:\1tnnbb.exec:\1tnnbb.exe86⤵PID:2824
-
\??\c:\thntnn.exec:\thntnn.exe87⤵PID:892
-
\??\c:\tbnhht.exec:\tbnhht.exe88⤵PID:2812
-
\??\c:\vjpjp.exec:\vjpjp.exe89⤵PID:1572
-
\??\c:\9xlfrff.exec:\9xlfrff.exe90⤵PID:2900
-
\??\c:\fxlfllf.exec:\fxlfllf.exe91⤵PID:2728
-
\??\c:\7nbthb.exec:\7nbthb.exe92⤵
- System Location Discovery: System Language Discovery
PID:2192 -
\??\c:\vvppp.exec:\vvppp.exe93⤵PID:2668
-
\??\c:\jjvvv.exec:\jjvvv.exe94⤵PID:2892
-
\??\c:\rfrxxxf.exec:\rfrxxxf.exe95⤵PID:2664
-
\??\c:\5frffxx.exec:\5frffxx.exe96⤵PID:2844
-
\??\c:\nbbbbt.exec:\nbbbbt.exe97⤵PID:1148
-
\??\c:\nbbbnt.exec:\nbbbnt.exe98⤵PID:1960
-
\??\c:\ppdpv.exec:\ppdpv.exe99⤵PID:1956
-
\??\c:\rlrrlrl.exec:\rlrrlrl.exe100⤵PID:3008
-
\??\c:\5rfllff.exec:\5rfllff.exe101⤵PID:2828
-
\??\c:\htbttn.exec:\htbttn.exe102⤵PID:2712
-
\??\c:\9pppv.exec:\9pppv.exe103⤵PID:1788
-
\??\c:\dvvdd.exec:\dvvdd.exe104⤵PID:2972
-
\??\c:\lxxfxxl.exec:\lxxfxxl.exe105⤵PID:2920
-
\??\c:\xrfxllx.exec:\xrfxllx.exe106⤵PID:2732
-
\??\c:\btnbbn.exec:\btnbbn.exe107⤵PID:2868
-
\??\c:\pvdvv.exec:\pvdvv.exe108⤵PID:2232
-
\??\c:\xlxfrrx.exec:\xlxfrrx.exe109⤵PID:1724
-
\??\c:\xlxllxx.exec:\xlxllxx.exe110⤵PID:2564
-
\??\c:\thnttt.exec:\thnttt.exe111⤵PID:2104
-
\??\c:\ttbbht.exec:\ttbbht.exe112⤵PID:2412
-
\??\c:\1jdpp.exec:\1jdpp.exe113⤵PID:3040
-
\??\c:\7lxrrrx.exec:\7lxrrrx.exe114⤵PID:2208
-
\??\c:\frfrrll.exec:\frfrrll.exe115⤵PID:788
-
\??\c:\frxflrr.exec:\frxflrr.exe116⤵
- System Location Discovery: System Language Discovery
PID:324 -
\??\c:\tnbbbt.exec:\tnbbbt.exe117⤵PID:3032
-
\??\c:\jdpjv.exec:\jdpjv.exe118⤵PID:1476
-
\??\c:\pdjdj.exec:\pdjdj.exe119⤵PID:764
-
\??\c:\lrlrxfl.exec:\lrlrxfl.exe120⤵PID:2128
-
\??\c:\lfrlffx.exec:\lfrlffx.exe121⤵PID:1688
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-