Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 05:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e6942677472ab45c309246300aab160729f8a767961c65553c9baedcafedccec.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
e6942677472ab45c309246300aab160729f8a767961c65553c9baedcafedccec.exe
-
Size
453KB
-
MD5
c8121d1beda68ab3b5178387102c7e14
-
SHA1
aacbe37f4debd150bd9a1090f5bfb26249b8cf8c
-
SHA256
e6942677472ab45c309246300aab160729f8a767961c65553c9baedcafedccec
-
SHA512
cf7a38fac52e840492e65b716d2bdc7066d050e9d03bcbad26fcfe63bd2bce8dd460ed2cac14bf905253245d014958fec989d427771e6dc8e50dc877509f960b
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeU:q7Tc2NYHUrAwfMp3CDU
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 54 IoCs
resource yara_rule behavioral1/memory/300-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1160-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1804-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-50-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2800-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-82-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2204-81-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1696-102-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1696-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2176-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-127-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2644-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1624-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1624-184-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1724-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/304-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1088-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1732-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1692-253-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/300-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2008-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2180-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-382-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1488-417-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1796-431-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-510-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1792-547-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2052-566-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2052-585-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2256-599-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-624-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2708-649-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-686-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2032-713-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/992-840-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/872-846-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2288-866-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/804-966-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2248-991-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1740-1068-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/372-1097-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2984-1114-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/372-1127-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2984-1134-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1160 pddpv.exe 2488 lrlxlxx.exe 1804 bbbtht.exe 2652 bbthnb.exe 2800 9vvvp.exe 2668 nnbnnb.exe 2856 xxrlxrx.exe 2204 nhbbnt.exe 2828 xflrlll.exe 1696 lxxlxfl.exe 2176 btnhnb.exe 1488 9lllffl.exe 2872 bhtntt.exe 1936 vjpjj.exe 2644 1ppdd.exe 2776 llxxxrx.exe 2880 lrxxfxf.exe 2960 thhtnn.exe 1624 rxrllrf.exe 2212 9vvpp.exe 1724 hbhnht.exe 304 ppjvp.exe 1088 dddpj.exe 1732 nhhhtt.exe 2720 rxxlrlf.exe 2304 hnhnhh.exe 1692 ffxxlrf.exe 3028 5btbhn.exe 1704 9nnbth.exe 2996 nnnbnt.exe 1900 nhhhhb.exe 2628 dvdvv.exe 300 xlrllff.exe 2300 jjjvd.exe 1604 frffxrx.exe 1200 rlrrxfl.exe 2008 bbbhht.exe 2688 ddvpd.exe 2812 rrfrflf.exe 2180 bbnbhn.exe 2700 9jdvv.exe 2836 flfxxrl.exe 2848 flxxxlr.exe 2204 7thbtn.exe 2564 vddjd.exe 2268 lfxrlxf.exe 1588 bhtnhh.exe 1140 pvvjj.exe 2884 9ffrlfr.exe 1488 bbtnnt.exe 876 bhtbtn.exe 2340 vvvdv.exe 1796 rxrfrfr.exe 2900 nthbbh.exe 1940 vppvp.exe 2928 rffxxff.exe 2924 tttttb.exe 2960 1pppd.exe 2096 jvddv.exe 1244 tbbhtb.exe 2968 ntthbn.exe 560 vpjvj.exe 1952 lflrxrx.exe 2632 ttnthh.exe -
resource yara_rule behavioral1/memory/300-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1160-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-100-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2176-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/304-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1088-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-247-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/300-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/300-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-382-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/1588-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1796-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1940-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/560-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-503-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-510-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-547-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-566-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-599-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-649-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-658-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/832-700-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-713-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-726-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1380-764-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-797-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-866-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-921-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-991-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/344-1004-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-1061-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-1082-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-1135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/644-1155-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfxfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hhnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlflxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hhbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllllff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ppvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hntth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxfrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxrrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 300 wrote to memory of 1160 300 e6942677472ab45c309246300aab160729f8a767961c65553c9baedcafedccec.exe 31 PID 300 wrote to memory of 1160 300 e6942677472ab45c309246300aab160729f8a767961c65553c9baedcafedccec.exe 31 PID 300 wrote to memory of 1160 300 e6942677472ab45c309246300aab160729f8a767961c65553c9baedcafedccec.exe 31 PID 300 wrote to memory of 1160 300 e6942677472ab45c309246300aab160729f8a767961c65553c9baedcafedccec.exe 31 PID 1160 wrote to memory of 2488 1160 pddpv.exe 32 PID 1160 wrote to memory of 2488 1160 pddpv.exe 32 PID 1160 wrote to memory of 2488 1160 pddpv.exe 32 PID 1160 wrote to memory of 2488 1160 pddpv.exe 32 PID 2488 wrote to memory of 1804 2488 lrlxlxx.exe 33 PID 2488 wrote to memory of 1804 2488 lrlxlxx.exe 33 PID 2488 wrote to memory of 1804 2488 lrlxlxx.exe 33 PID 2488 wrote to memory of 1804 2488 lrlxlxx.exe 33 PID 1804 wrote to memory of 2652 1804 bbbtht.exe 34 PID 1804 wrote to memory of 2652 1804 bbbtht.exe 34 PID 1804 wrote to memory of 2652 1804 bbbtht.exe 34 PID 1804 wrote to memory of 2652 1804 bbbtht.exe 34 PID 2652 wrote to memory of 2800 2652 bbthnb.exe 35 PID 2652 wrote to memory of 2800 2652 bbthnb.exe 35 PID 2652 wrote to memory of 2800 2652 bbthnb.exe 35 PID 2652 wrote to memory of 2800 2652 bbthnb.exe 35 PID 2800 wrote to memory of 2668 2800 9vvvp.exe 36 PID 2800 wrote to memory of 2668 2800 9vvvp.exe 36 PID 2800 wrote to memory of 2668 2800 9vvvp.exe 36 PID 2800 wrote to memory of 2668 2800 9vvvp.exe 36 PID 2668 wrote to memory of 2856 2668 nnbnnb.exe 37 PID 2668 wrote to memory of 2856 2668 nnbnnb.exe 37 PID 2668 wrote to memory of 2856 2668 nnbnnb.exe 37 PID 2668 wrote to memory of 2856 2668 nnbnnb.exe 37 PID 2856 wrote to memory of 2204 2856 xxrlxrx.exe 38 PID 2856 wrote to memory of 2204 2856 xxrlxrx.exe 38 PID 2856 wrote to memory of 2204 2856 xxrlxrx.exe 38 PID 2856 wrote to memory of 2204 2856 xxrlxrx.exe 38 PID 2204 wrote to memory of 2828 2204 nhbbnt.exe 39 PID 2204 wrote to memory of 2828 2204 nhbbnt.exe 39 PID 2204 wrote to memory of 2828 2204 nhbbnt.exe 39 PID 2204 wrote to memory of 2828 2204 nhbbnt.exe 39 PID 2828 wrote to memory of 1696 2828 xflrlll.exe 40 PID 2828 wrote to memory of 1696 2828 xflrlll.exe 40 PID 2828 wrote to memory of 1696 2828 xflrlll.exe 40 PID 2828 wrote to memory of 1696 2828 xflrlll.exe 40 PID 1696 wrote to memory of 2176 1696 lxxlxfl.exe 41 PID 1696 wrote to memory of 2176 1696 lxxlxfl.exe 41 PID 1696 wrote to memory of 2176 1696 lxxlxfl.exe 41 PID 1696 wrote to memory of 2176 1696 lxxlxfl.exe 41 PID 2176 wrote to memory of 1488 2176 btnhnb.exe 42 PID 2176 wrote to memory of 1488 2176 btnhnb.exe 42 PID 2176 wrote to memory of 1488 2176 btnhnb.exe 42 PID 2176 wrote to memory of 1488 2176 btnhnb.exe 42 PID 1488 wrote to memory of 2872 1488 9lllffl.exe 43 PID 1488 wrote to memory of 2872 1488 9lllffl.exe 43 PID 1488 wrote to memory of 2872 1488 9lllffl.exe 43 PID 1488 wrote to memory of 2872 1488 9lllffl.exe 43 PID 2872 wrote to memory of 1936 2872 bhtntt.exe 44 PID 2872 wrote to memory of 1936 2872 bhtntt.exe 44 PID 2872 wrote to memory of 1936 2872 bhtntt.exe 44 PID 2872 wrote to memory of 1936 2872 bhtntt.exe 44 PID 1936 wrote to memory of 2644 1936 vjpjj.exe 45 PID 1936 wrote to memory of 2644 1936 vjpjj.exe 45 PID 1936 wrote to memory of 2644 1936 vjpjj.exe 45 PID 1936 wrote to memory of 2644 1936 vjpjj.exe 45 PID 2644 wrote to memory of 2776 2644 1ppdd.exe 46 PID 2644 wrote to memory of 2776 2644 1ppdd.exe 46 PID 2644 wrote to memory of 2776 2644 1ppdd.exe 46 PID 2644 wrote to memory of 2776 2644 1ppdd.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\e6942677472ab45c309246300aab160729f8a767961c65553c9baedcafedccec.exe"C:\Users\Admin\AppData\Local\Temp\e6942677472ab45c309246300aab160729f8a767961c65553c9baedcafedccec.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:300 -
\??\c:\pddpv.exec:\pddpv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
\??\c:\lrlxlxx.exec:\lrlxlxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\bbbtht.exec:\bbbtht.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\bbthnb.exec:\bbthnb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\9vvvp.exec:\9vvvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\nnbnnb.exec:\nnbnnb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\xxrlxrx.exec:\xxrlxrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\nhbbnt.exec:\nhbbnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\xflrlll.exec:\xflrlll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\lxxlxfl.exec:\lxxlxfl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\btnhnb.exec:\btnhnb.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\9lllffl.exec:\9lllffl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\bhtntt.exec:\bhtntt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\vjpjj.exec:\vjpjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\1ppdd.exec:\1ppdd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\llxxxrx.exec:\llxxxrx.exe17⤵
- Executes dropped EXE
PID:2776 -
\??\c:\lrxxfxf.exec:\lrxxfxf.exe18⤵
- Executes dropped EXE
PID:2880 -
\??\c:\thhtnn.exec:\thhtnn.exe19⤵
- Executes dropped EXE
PID:2960 -
\??\c:\rxrllrf.exec:\rxrllrf.exe20⤵
- Executes dropped EXE
PID:1624 -
\??\c:\9vvpp.exec:\9vvpp.exe21⤵
- Executes dropped EXE
PID:2212 -
\??\c:\hbhnht.exec:\hbhnht.exe22⤵
- Executes dropped EXE
PID:1724 -
\??\c:\ppjvp.exec:\ppjvp.exe23⤵
- Executes dropped EXE
PID:304 -
\??\c:\dddpj.exec:\dddpj.exe24⤵
- Executes dropped EXE
PID:1088 -
\??\c:\nhhhtt.exec:\nhhhtt.exe25⤵
- Executes dropped EXE
PID:1732 -
\??\c:\rxxlrlf.exec:\rxxlrlf.exe26⤵
- Executes dropped EXE
PID:2720 -
\??\c:\hnhnhh.exec:\hnhnhh.exe27⤵
- Executes dropped EXE
PID:2304 -
\??\c:\ffxxlrf.exec:\ffxxlrf.exe28⤵
- Executes dropped EXE
PID:1692 -
\??\c:\5btbhn.exec:\5btbhn.exe29⤵
- Executes dropped EXE
PID:3028 -
\??\c:\9nnbth.exec:\9nnbth.exe30⤵
- Executes dropped EXE
PID:1704 -
\??\c:\nnnbnt.exec:\nnnbnt.exe31⤵
- Executes dropped EXE
PID:2996 -
\??\c:\nhhhhb.exec:\nhhhhb.exe32⤵
- Executes dropped EXE
PID:1900 -
\??\c:\dvdvv.exec:\dvdvv.exe33⤵
- Executes dropped EXE
PID:2628 -
\??\c:\xlrllff.exec:\xlrllff.exe34⤵
- Executes dropped EXE
PID:300 -
\??\c:\jjjvd.exec:\jjjvd.exe35⤵
- Executes dropped EXE
PID:2300 -
\??\c:\frffxrx.exec:\frffxrx.exe36⤵
- Executes dropped EXE
PID:1604 -
\??\c:\rlrrxfl.exec:\rlrrxfl.exe37⤵
- Executes dropped EXE
PID:1200 -
\??\c:\bbbhht.exec:\bbbhht.exe38⤵
- Executes dropped EXE
PID:2008 -
\??\c:\ddvpd.exec:\ddvpd.exe39⤵
- Executes dropped EXE
PID:2688 -
\??\c:\rrfrflf.exec:\rrfrflf.exe40⤵
- Executes dropped EXE
PID:2812 -
\??\c:\bbnbhn.exec:\bbnbhn.exe41⤵
- Executes dropped EXE
PID:2180 -
\??\c:\9jdvv.exec:\9jdvv.exe42⤵
- Executes dropped EXE
PID:2700 -
\??\c:\flfxxrl.exec:\flfxxrl.exe43⤵
- Executes dropped EXE
PID:2836 -
\??\c:\flxxxlr.exec:\flxxxlr.exe44⤵
- Executes dropped EXE
PID:2848 -
\??\c:\7thbtn.exec:\7thbtn.exe45⤵
- Executes dropped EXE
PID:2204 -
\??\c:\vddjd.exec:\vddjd.exe46⤵
- Executes dropped EXE
PID:2564 -
\??\c:\lfxrlxf.exec:\lfxrlxf.exe47⤵
- Executes dropped EXE
PID:2268 -
\??\c:\bhtnhh.exec:\bhtnhh.exe48⤵
- Executes dropped EXE
PID:1588 -
\??\c:\pvvjj.exec:\pvvjj.exe49⤵
- Executes dropped EXE
PID:1140 -
\??\c:\9ffrlfr.exec:\9ffrlfr.exe50⤵
- Executes dropped EXE
PID:2884 -
\??\c:\bbtnnt.exec:\bbtnnt.exe51⤵
- Executes dropped EXE
PID:1488 -
\??\c:\bhtbtn.exec:\bhtbtn.exe52⤵
- Executes dropped EXE
PID:876 -
\??\c:\vvvdv.exec:\vvvdv.exe53⤵
- Executes dropped EXE
PID:2340 -
\??\c:\rxrfrfr.exec:\rxrfrfr.exe54⤵
- Executes dropped EXE
PID:1796 -
\??\c:\nthbbh.exec:\nthbbh.exe55⤵
- Executes dropped EXE
PID:2900 -
\??\c:\vppvp.exec:\vppvp.exe56⤵
- Executes dropped EXE
PID:1940 -
\??\c:\rffxxff.exec:\rffxxff.exe57⤵
- Executes dropped EXE
PID:2928 -
\??\c:\tttttb.exec:\tttttb.exe58⤵
- Executes dropped EXE
PID:2924 -
\??\c:\1pppd.exec:\1pppd.exe59⤵
- Executes dropped EXE
PID:2960 -
\??\c:\jvddv.exec:\jvddv.exe60⤵
- Executes dropped EXE
PID:2096 -
\??\c:\tbbhtb.exec:\tbbhtb.exe61⤵
- Executes dropped EXE
PID:1244 -
\??\c:\ntthbn.exec:\ntthbn.exe62⤵
- Executes dropped EXE
PID:2968 -
\??\c:\vpjvj.exec:\vpjvj.exe63⤵
- Executes dropped EXE
PID:560 -
\??\c:\lflrxrx.exec:\lflrxrx.exe64⤵
- Executes dropped EXE
PID:1952 -
\??\c:\ttnthh.exec:\ttnthh.exe65⤵
- Executes dropped EXE
PID:2632 -
\??\c:\1vvvj.exec:\1vvvj.exe66⤵PID:1728
-
\??\c:\7fxxxrx.exec:\7fxxxrx.exe67⤵PID:940
-
\??\c:\hhhtnb.exec:\hhhtnb.exe68⤵PID:2720
-
\??\c:\bbhhbb.exec:\bbhhbb.exe69⤵PID:568
-
\??\c:\dpjpv.exec:\dpjpv.exe70⤵PID:372
-
\??\c:\rrrxxrx.exec:\rrrxxrx.exe71⤵PID:1792
-
\??\c:\nbnbtb.exec:\nbnbtb.exe72⤵PID:2984
-
\??\c:\jvjjv.exec:\jvjjv.exe73⤵PID:980
-
\??\c:\1xrxlrl.exec:\1xrxlrl.exe74⤵PID:2052
-
\??\c:\5rxrrlr.exec:\5rxrrlr.exe75⤵PID:1844
-
\??\c:\3hhhth.exec:\3hhhth.exe76⤵PID:2888
-
\??\c:\jvvpv.exec:\jvvpv.exe77⤵PID:536
-
\??\c:\ffrllxr.exec:\ffrllxr.exe78⤵PID:2328
-
\??\c:\tnbbhh.exec:\tnbbhh.exe79⤵PID:2256
-
\??\c:\pddvv.exec:\pddvv.exe80⤵PID:2224
-
\??\c:\rfrflfl.exec:\rfrflfl.exe81⤵PID:1200
-
\??\c:\ttnbnn.exec:\ttnbnn.exe82⤵PID:2168
-
\??\c:\pjpjp.exec:\pjpjp.exe83⤵PID:2648
-
\??\c:\3frxllx.exec:\3frxllx.exe84⤵PID:2672
-
\??\c:\xxlrxxr.exec:\xxlrxxr.exe85⤵PID:2704
-
\??\c:\9nhthn.exec:\9nhthn.exe86⤵PID:2860
-
\??\c:\dvjdp.exec:\dvjdp.exe87⤵PID:2708
-
\??\c:\fffxxlr.exec:\fffxxlr.exe88⤵PID:1360
-
\??\c:\9tbnhn.exec:\9tbnhn.exe89⤵PID:2576
-
\??\c:\vvdvp.exec:\vvdvp.exe90⤵PID:2664
-
\??\c:\rfllrxf.exec:\rfllrxf.exe91⤵PID:2712
-
\??\c:\hnnhth.exec:\hnnhth.exe92⤵PID:316
-
\??\c:\htnbtt.exec:\htnbtt.exe93⤵PID:2756
-
\??\c:\rrlrffr.exec:\rrlrffr.exe94⤵PID:2736
-
\??\c:\jvdpp.exec:\jvdpp.exe95⤵PID:2604
-
\??\c:\lffrflx.exec:\lffrflx.exe96⤵PID:832
-
\??\c:\llrflrl.exec:\llrflrl.exe97⤵PID:2032
-
\??\c:\hthbbt.exec:\hthbbt.exe98⤵PID:1260
-
\??\c:\jpdvp.exec:\jpdvp.exe99⤵PID:1904
-
\??\c:\ffrxxfx.exec:\ffrxxfx.exe100⤵PID:2000
-
\??\c:\hbnhnh.exec:\hbnhnh.exe101⤵PID:2880
-
\??\c:\vjvpp.exec:\vjvpp.exe102⤵PID:2740
-
\??\c:\rxlfrxf.exec:\rxlfrxf.exe103⤵PID:2208
-
\??\c:\xffrlxx.exec:\xffrlxx.exe104⤵PID:3012
-
\??\c:\tbnttn.exec:\tbnttn.exe105⤵PID:2244
-
\??\c:\vvjdv.exec:\vvjdv.exe106⤵PID:1380
-
\??\c:\llfrlrl.exec:\llfrlrl.exe107⤵PID:1616
-
\??\c:\nhhbht.exec:\nhhbht.exe108⤵PID:2432
-
\??\c:\jpdvp.exec:\jpdvp.exe109⤵PID:1720
-
\??\c:\ffxlrxl.exec:\ffxlrxl.exe110⤵PID:884
-
\??\c:\thttht.exec:\thttht.exe111⤵PID:2220
-
\??\c:\vvddv.exec:\vvddv.exe112⤵PID:2044
-
\??\c:\rrxxlrl.exec:\rrxxlrl.exe113⤵PID:2152
-
\??\c:\xfflrlx.exec:\xfflrlx.exe114⤵PID:2624
-
\??\c:\hbtntn.exec:\hbtntn.exe115⤵PID:2380
-
\??\c:\pvvdd.exec:\pvvdd.exe116⤵PID:1772
-
\??\c:\llrxrrl.exec:\llrxrrl.exe117⤵PID:992
-
\??\c:\5nthbn.exec:\5nthbn.exe118⤵PID:872
-
\??\c:\vpjvd.exec:\vpjvd.exe119⤵PID:1824
-
\??\c:\lxlxlrr.exec:\lxlxlrr.exe120⤵PID:2628
-
\??\c:\bnhbhh.exec:\bnhbhh.exe121⤵PID:300
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-