Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 06:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bc2a556e765c9b97c3024df604b8c306901e0a3c6958961170c7726298366833N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
bc2a556e765c9b97c3024df604b8c306901e0a3c6958961170c7726298366833N.exe
-
Size
347KB
-
MD5
3c6ac31bc159d0863334f967fdb8fb30
-
SHA1
942e8a7e4cddfd925d1d24f89aee5b4411ceacc4
-
SHA256
bc2a556e765c9b97c3024df604b8c306901e0a3c6958961170c7726298366833
-
SHA512
1a042eac48054f1580f66c6f8a0217870e262d9cd76a32d9c7a99c250bda5a321223739ceb2e3eeda663353d30c24ede385cc34fe0a48b5af8e513ddf85d0ed4
-
SSDEEP
6144:Xcm7ImGddXgYW5fNZWB5hFfci3Add4kGYAK:l7TcbWXZshJX2VGdK
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 54 IoCs
resource yara_rule behavioral1/memory/2052-28-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2712-48-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2996-77-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2668-109-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2668-107-0x00000000003A0000-0x00000000003C8000-memory.dmp family_blackmoon behavioral1/memory/2440-125-0x00000000001B0000-0x00000000001D8000-memory.dmp family_blackmoon behavioral1/memory/2440-126-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2596-231-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2520-308-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/776-409-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1912-473-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1944-559-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2616-604-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2668-617-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1044-650-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2676-711-0x00000000002A0000-0x00000000002C8000-memory.dmp family_blackmoon behavioral1/memory/1780-731-0x00000000001B0000-0x00000000001D8000-memory.dmp family_blackmoon behavioral1/memory/1788-867-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1352-971-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2552-1101-0x00000000001B0000-0x00000000001D8000-memory.dmp family_blackmoon behavioral1/memory/1560-1114-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2632-1208-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1044-1438-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2384-1445-0x00000000001B0000-0x00000000001D8000-memory.dmp family_blackmoon behavioral1/memory/2596-1355-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2724-1341-0x00000000002C0000-0x00000000002E8000-memory.dmp family_blackmoon behavioral1/memory/1640-1291-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1536-1264-0x00000000002C0000-0x00000000002E8000-memory.dmp family_blackmoon behavioral1/memory/2088-1252-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2000-1215-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2888-643-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2728-630-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2676-447-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2900-396-0x0000000000430000-0x0000000000458000-memory.dmp family_blackmoon behavioral1/memory/1960-383-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2536-370-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2248-293-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/880-284-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/544-268-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/580-258-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2008-242-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/708-240-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2596-229-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1780-220-0x00000000003C0000-0x00000000003E8000-memory.dmp family_blackmoon behavioral1/memory/1484-211-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2820-178-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2672-99-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2672-97-0x00000000002E0000-0x0000000000308000-memory.dmp family_blackmoon behavioral1/memory/2972-88-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2772-67-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2244-58-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2540-37-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/788-18-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2120-0-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 788 tnbhnt.exe 2052 ttntbn.exe 2540 vjvdj.exe 2712 7lxflxf.exe 2244 frfrlff.exe 2772 bbbnnb.exe 2996 pjdpd.exe 2972 rlrrrrx.exe 2672 flrlllr.exe 2668 bttbht.exe 2276 vpdpj.exe 2440 3rlxfrf.exe 1816 fflfxxr.exe 1616 vjdpd.exe 1996 1vpvj.exe 1748 ffrxfrf.exe 1696 htnthn.exe 2820 9vpjd.exe 2680 9ddjv.exe 2800 fffrllx.exe 2956 ttnbbh.exe 1484 9nbbhn.exe 1780 pvdvv.exe 2596 fxrxllf.exe 708 ntnbnt.exe 2008 1bbhnt.exe 580 7vvjp.exe 544 3xlrfxl.exe 288 bthntb.exe 880 djpdd.exe 2248 vpdjv.exe 1600 rlflrxf.exe 2520 btnbhh.exe 2316 tnbhnn.exe 3004 dppjj.exe 2872 dvvdj.exe 2776 ffxlxfr.exe 2652 7bnbtt.exe 2720 hhthtt.exe 2976 jdvjv.exe 2664 7jjpv.exe 2324 fxrfrff.exe 2536 lxffxlr.exe 1528 3bbbnb.exe 1960 jjvdp.exe 2576 pdvjp.exe 2900 xxxflxl.exe 1728 rllflrl.exe 776 bbttbb.exe 2756 hbbbtt.exe 2808 5dddd.exe 2856 7fxlfff.exe 2860 rlfrfxl.exe 2936 1bntbh.exe 2676 vvpvd.exe 1648 3dvjv.exe 2648 lfrxflf.exe 2356 rrllxff.exe 1912 ntnbhn.exe 1584 jjvpd.exe 1988 pjvdp.exe 996 1lxffxl.exe 2412 xrxfrrx.exe 580 bbhbhn.exe -
resource yara_rule behavioral1/memory/788-10-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2052-28-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2712-48-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2972-78-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2996-77-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2668-109-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2440-126-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2596-231-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2520-308-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/776-409-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1912-473-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1944-559-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2616-604-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2668-617-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1044-650-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1788-867-0x0000000000220000-0x0000000000248000-memory.dmp upx behavioral1/memory/648-911-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2000-924-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1272-1170-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2988-1292-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2548-1412-0x0000000000220000-0x0000000000248000-memory.dmp upx behavioral1/memory/1044-1431-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1044-1438-0x0000000000220000-0x0000000000248000-memory.dmp upx behavioral1/memory/1312-1405-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2644-1356-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2624-1342-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1640-1291-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1164-1266-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2088-1252-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1816-1157-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2888-643-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2728-630-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1988-480-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1960-383-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2536-370-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2248-293-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/544-268-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/580-258-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/580-250-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2008-242-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/708-240-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2820-178-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1696-162-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2672-99-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2672-89-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2972-88-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2772-67-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2244-58-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2540-37-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/788-18-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2120-0-0x0000000000400000-0x0000000000428000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllrlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rflxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrxfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2120 wrote to memory of 788 2120 bc2a556e765c9b97c3024df604b8c306901e0a3c6958961170c7726298366833N.exe 30 PID 2120 wrote to memory of 788 2120 bc2a556e765c9b97c3024df604b8c306901e0a3c6958961170c7726298366833N.exe 30 PID 2120 wrote to memory of 788 2120 bc2a556e765c9b97c3024df604b8c306901e0a3c6958961170c7726298366833N.exe 30 PID 2120 wrote to memory of 788 2120 bc2a556e765c9b97c3024df604b8c306901e0a3c6958961170c7726298366833N.exe 30 PID 788 wrote to memory of 2052 788 tnbhnt.exe 31 PID 788 wrote to memory of 2052 788 tnbhnt.exe 31 PID 788 wrote to memory of 2052 788 tnbhnt.exe 31 PID 788 wrote to memory of 2052 788 tnbhnt.exe 31 PID 2052 wrote to memory of 2540 2052 ttntbn.exe 32 PID 2052 wrote to memory of 2540 2052 ttntbn.exe 32 PID 2052 wrote to memory of 2540 2052 ttntbn.exe 32 PID 2052 wrote to memory of 2540 2052 ttntbn.exe 32 PID 2540 wrote to memory of 2712 2540 vjvdj.exe 33 PID 2540 wrote to memory of 2712 2540 vjvdj.exe 33 PID 2540 wrote to memory of 2712 2540 vjvdj.exe 33 PID 2540 wrote to memory of 2712 2540 vjvdj.exe 33 PID 2712 wrote to memory of 2244 2712 7lxflxf.exe 34 PID 2712 wrote to memory of 2244 2712 7lxflxf.exe 34 PID 2712 wrote to memory of 2244 2712 7lxflxf.exe 34 PID 2712 wrote to memory of 2244 2712 7lxflxf.exe 34 PID 2244 wrote to memory of 2772 2244 frfrlff.exe 35 PID 2244 wrote to memory of 2772 2244 frfrlff.exe 35 PID 2244 wrote to memory of 2772 2244 frfrlff.exe 35 PID 2244 wrote to memory of 2772 2244 frfrlff.exe 35 PID 2772 wrote to memory of 2996 2772 bbbnnb.exe 36 PID 2772 wrote to memory of 2996 2772 bbbnnb.exe 36 PID 2772 wrote to memory of 2996 2772 bbbnnb.exe 36 PID 2772 wrote to memory of 2996 2772 bbbnnb.exe 36 PID 2996 wrote to memory of 2972 2996 pjdpd.exe 37 PID 2996 wrote to memory of 2972 2996 pjdpd.exe 37 PID 2996 wrote to memory of 2972 2996 pjdpd.exe 37 PID 2996 wrote to memory of 2972 2996 pjdpd.exe 37 PID 2972 wrote to memory of 2672 2972 rlrrrrx.exe 38 PID 2972 wrote to memory of 2672 2972 rlrrrrx.exe 38 PID 2972 wrote to memory of 2672 2972 rlrrrrx.exe 38 PID 2972 wrote to memory of 2672 2972 rlrrrrx.exe 38 PID 2672 wrote to memory of 2668 2672 flrlllr.exe 39 PID 2672 wrote to memory of 2668 2672 flrlllr.exe 39 PID 2672 wrote to memory of 2668 2672 flrlllr.exe 39 PID 2672 wrote to memory of 2668 2672 flrlllr.exe 39 PID 2668 wrote to memory of 2276 2668 bttbht.exe 40 PID 2668 wrote to memory of 2276 2668 bttbht.exe 40 PID 2668 wrote to memory of 2276 2668 bttbht.exe 40 PID 2668 wrote to memory of 2276 2668 bttbht.exe 40 PID 2276 wrote to memory of 2440 2276 vpdpj.exe 41 PID 2276 wrote to memory of 2440 2276 vpdpj.exe 41 PID 2276 wrote to memory of 2440 2276 vpdpj.exe 41 PID 2276 wrote to memory of 2440 2276 vpdpj.exe 41 PID 2440 wrote to memory of 1816 2440 3rlxfrf.exe 42 PID 2440 wrote to memory of 1816 2440 3rlxfrf.exe 42 PID 2440 wrote to memory of 1816 2440 3rlxfrf.exe 42 PID 2440 wrote to memory of 1816 2440 3rlxfrf.exe 42 PID 1816 wrote to memory of 1616 1816 fflfxxr.exe 43 PID 1816 wrote to memory of 1616 1816 fflfxxr.exe 43 PID 1816 wrote to memory of 1616 1816 fflfxxr.exe 43 PID 1816 wrote to memory of 1616 1816 fflfxxr.exe 43 PID 1616 wrote to memory of 1996 1616 vjdpd.exe 44 PID 1616 wrote to memory of 1996 1616 vjdpd.exe 44 PID 1616 wrote to memory of 1996 1616 vjdpd.exe 44 PID 1616 wrote to memory of 1996 1616 vjdpd.exe 44 PID 1996 wrote to memory of 1748 1996 1vpvj.exe 45 PID 1996 wrote to memory of 1748 1996 1vpvj.exe 45 PID 1996 wrote to memory of 1748 1996 1vpvj.exe 45 PID 1996 wrote to memory of 1748 1996 1vpvj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\bc2a556e765c9b97c3024df604b8c306901e0a3c6958961170c7726298366833N.exe"C:\Users\Admin\AppData\Local\Temp\bc2a556e765c9b97c3024df604b8c306901e0a3c6958961170c7726298366833N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\tnbhnt.exec:\tnbhnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:788 -
\??\c:\ttntbn.exec:\ttntbn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\vjvdj.exec:\vjvdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\7lxflxf.exec:\7lxflxf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\frfrlff.exec:\frfrlff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\bbbnnb.exec:\bbbnnb.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\pjdpd.exec:\pjdpd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\rlrrrrx.exec:\rlrrrrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\flrlllr.exec:\flrlllr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\bttbht.exec:\bttbht.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\vpdpj.exec:\vpdpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\3rlxfrf.exec:\3rlxfrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\fflfxxr.exec:\fflfxxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
\??\c:\vjdpd.exec:\vjdpd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\1vpvj.exec:\1vpvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\ffrxfrf.exec:\ffrxfrf.exe17⤵
- Executes dropped EXE
PID:1748 -
\??\c:\htnthn.exec:\htnthn.exe18⤵
- Executes dropped EXE
PID:1696 -
\??\c:\9vpjd.exec:\9vpjd.exe19⤵
- Executes dropped EXE
PID:2820 -
\??\c:\9ddjv.exec:\9ddjv.exe20⤵
- Executes dropped EXE
PID:2680 -
\??\c:\fffrllx.exec:\fffrllx.exe21⤵
- Executes dropped EXE
PID:2800 -
\??\c:\ttnbbh.exec:\ttnbbh.exe22⤵
- Executes dropped EXE
PID:2956 -
\??\c:\9nbbhn.exec:\9nbbhn.exe23⤵
- Executes dropped EXE
PID:1484 -
\??\c:\pvdvv.exec:\pvdvv.exe24⤵
- Executes dropped EXE
PID:1780 -
\??\c:\fxrxllf.exec:\fxrxllf.exe25⤵
- Executes dropped EXE
PID:2596 -
\??\c:\ntnbnt.exec:\ntnbnt.exe26⤵
- Executes dropped EXE
PID:708 -
\??\c:\1bbhnt.exec:\1bbhnt.exe27⤵
- Executes dropped EXE
PID:2008 -
\??\c:\7vvjp.exec:\7vvjp.exe28⤵
- Executes dropped EXE
PID:580 -
\??\c:\3xlrfxl.exec:\3xlrfxl.exe29⤵
- Executes dropped EXE
PID:544 -
\??\c:\bthntb.exec:\bthntb.exe30⤵
- Executes dropped EXE
PID:288 -
\??\c:\djpdd.exec:\djpdd.exe31⤵
- Executes dropped EXE
PID:880 -
\??\c:\vpdjv.exec:\vpdjv.exe32⤵
- Executes dropped EXE
PID:2248 -
\??\c:\rlflrxf.exec:\rlflrxf.exe33⤵
- Executes dropped EXE
PID:1600 -
\??\c:\btnbhh.exec:\btnbhh.exe34⤵
- Executes dropped EXE
PID:2520 -
\??\c:\tnbhnn.exec:\tnbhnn.exe35⤵
- Executes dropped EXE
PID:2316 -
\??\c:\dppjj.exec:\dppjj.exe36⤵
- Executes dropped EXE
PID:3004 -
\??\c:\dvvdj.exec:\dvvdj.exe37⤵
- Executes dropped EXE
PID:2872 -
\??\c:\ffxlxfr.exec:\ffxlxfr.exe38⤵
- Executes dropped EXE
PID:2776 -
\??\c:\7bnbtt.exec:\7bnbtt.exe39⤵
- Executes dropped EXE
PID:2652 -
\??\c:\hhthtt.exec:\hhthtt.exe40⤵
- Executes dropped EXE
PID:2720 -
\??\c:\jdvjv.exec:\jdvjv.exe41⤵
- Executes dropped EXE
PID:2976 -
\??\c:\7jjpv.exec:\7jjpv.exe42⤵
- Executes dropped EXE
PID:2664 -
\??\c:\fxrfrff.exec:\fxrfrff.exe43⤵
- Executes dropped EXE
PID:2324 -
\??\c:\lxffxlr.exec:\lxffxlr.exe44⤵
- Executes dropped EXE
PID:2536 -
\??\c:\3bbbnb.exec:\3bbbnb.exe45⤵
- Executes dropped EXE
PID:1528 -
\??\c:\jjvdp.exec:\jjvdp.exe46⤵
- Executes dropped EXE
PID:1960 -
\??\c:\pdvjp.exec:\pdvjp.exe47⤵
- Executes dropped EXE
PID:2576 -
\??\c:\xxxflxl.exec:\xxxflxl.exe48⤵
- Executes dropped EXE
PID:2900 -
\??\c:\rllflrl.exec:\rllflrl.exe49⤵
- Executes dropped EXE
PID:1728 -
\??\c:\bbttbb.exec:\bbttbb.exe50⤵
- Executes dropped EXE
PID:776 -
\??\c:\hbbbtt.exec:\hbbbtt.exe51⤵
- Executes dropped EXE
PID:2756 -
\??\c:\5dddd.exec:\5dddd.exe52⤵
- Executes dropped EXE
PID:2808 -
\??\c:\7fxlfff.exec:\7fxlfff.exe53⤵
- Executes dropped EXE
PID:2856 -
\??\c:\rlfrfxl.exec:\rlfrfxl.exe54⤵
- Executes dropped EXE
PID:2860 -
\??\c:\1bntbh.exec:\1bntbh.exe55⤵
- Executes dropped EXE
PID:2936 -
\??\c:\vvpvd.exec:\vvpvd.exe56⤵
- Executes dropped EXE
PID:2676 -
\??\c:\3dvjv.exec:\3dvjv.exe57⤵
- Executes dropped EXE
PID:1648 -
\??\c:\lfrxflf.exec:\lfrxflf.exe58⤵
- Executes dropped EXE
PID:2648 -
\??\c:\rrllxff.exec:\rrllxff.exe59⤵
- Executes dropped EXE
PID:2356 -
\??\c:\ntnbhn.exec:\ntnbhn.exe60⤵
- Executes dropped EXE
PID:1912 -
\??\c:\jjvpd.exec:\jjvpd.exe61⤵
- Executes dropped EXE
PID:1584 -
\??\c:\pjvdp.exec:\pjvdp.exe62⤵
- Executes dropped EXE
PID:1988 -
\??\c:\1lxffxl.exec:\1lxffxl.exe63⤵
- Executes dropped EXE
PID:996 -
\??\c:\xrxfrrx.exec:\xrxfrrx.exe64⤵
- Executes dropped EXE
PID:2412 -
\??\c:\bbhbhn.exec:\bbhbhn.exe65⤵
- Executes dropped EXE
PID:580 -
\??\c:\bnbttn.exec:\bnbttn.exe66⤵PID:2260
-
\??\c:\3vjvd.exec:\3vjvd.exe67⤵PID:884
-
\??\c:\djjvv.exec:\djjvv.exe68⤵PID:2236
-
\??\c:\1fllxlr.exec:\1fllxlr.exe69⤵PID:2144
-
\??\c:\7nnhbn.exec:\7nnhbn.exe70⤵PID:2600
-
\??\c:\nhbbbb.exec:\nhbbbb.exe71⤵PID:2080
-
\??\c:\jppjd.exec:\jppjd.exe72⤵PID:1600
-
\??\c:\7vvjj.exec:\7vvjj.exe73⤵PID:2400
-
\??\c:\9frflxx.exec:\9frflxx.exe74⤵PID:1944
-
\??\c:\flrflrf.exec:\flrflrf.exe75⤵PID:2152
-
\??\c:\bthnth.exec:\bthnth.exe76⤵PID:2296
-
\??\c:\hhhtht.exec:\hhhtht.exe77⤵PID:2872
-
\??\c:\pvppd.exec:\pvppd.exe78⤵
- System Location Discovery: System Language Discovery
PID:1560 -
\??\c:\dpvpd.exec:\dpvpd.exe79⤵PID:2504
-
\??\c:\lffrflx.exec:\lffrflx.exe80⤵PID:1608
-
\??\c:\rllrxlf.exec:\rllrxlf.exe81⤵PID:2616
-
\??\c:\ntnhbt.exec:\ntnhbt.exe82⤵PID:2976
-
\??\c:\pdppv.exec:\pdppv.exe83⤵PID:2668
-
\??\c:\vpddp.exec:\vpddp.exe84⤵PID:2436
-
\??\c:\ffrflxl.exec:\ffrflxl.exe85⤵PID:2728
-
\??\c:\rrrfflf.exec:\rrrfflf.exe86⤵PID:2308
-
\??\c:\1thtbn.exec:\1thtbn.exe87⤵PID:2888
-
\??\c:\nhbtbn.exec:\nhbtbn.exe88⤵PID:1044
-
\??\c:\pdpdp.exec:\pdpdp.exe89⤵PID:1488
-
\??\c:\ppjjv.exec:\ppjjv.exe90⤵PID:1996
-
\??\c:\3fffxlx.exec:\3fffxlx.exe91⤵PID:2384
-
\??\c:\hnbtth.exec:\hnbtth.exe92⤵PID:1444
-
\??\c:\hbtbnh.exec:\hbtbnh.exe93⤵PID:2840
-
\??\c:\ppjdp.exec:\ppjdp.exe94⤵PID:2832
-
\??\c:\jjdpv.exec:\jjdpv.exe95⤵PID:2980
-
\??\c:\5lrxlxx.exec:\5lrxlxx.exe96⤵PID:2860
-
\??\c:\5xrxxrf.exec:\5xrxxrf.exe97⤵PID:2936
-
\??\c:\5nnbtb.exec:\5nnbtb.exe98⤵PID:2676
-
\??\c:\bbbnhn.exec:\bbbnhn.exe99⤵PID:1428
-
\??\c:\dpdvd.exec:\dpdvd.exe100⤵PID:1356
-
\??\c:\dvdvd.exec:\dvdvd.exe101⤵PID:1780
-
\??\c:\lfxlrrf.exec:\lfxlrrf.exe102⤵PID:1912
-
\??\c:\rlrlxrf.exec:\rlrlxrf.exe103⤵PID:1680
-
\??\c:\nhbhnb.exec:\nhbhnb.exe104⤵PID:1756
-
\??\c:\7nbhhn.exec:\7nbhhn.exe105⤵PID:996
-
\??\c:\3jjjd.exec:\3jjjd.exe106⤵PID:1028
-
\??\c:\5dvpv.exec:\5dvpv.exe107⤵PID:580
-
\??\c:\xrlrflx.exec:\xrlrflx.exe108⤵PID:2260
-
\??\c:\xrxxffr.exec:\xrxxffr.exe109⤵PID:2272
-
\??\c:\hhnnbh.exec:\hhnnbh.exe110⤵PID:2064
-
\??\c:\btbbht.exec:\btbbht.exe111⤵PID:1724
-
\??\c:\pjpdd.exec:\pjpdd.exe112⤵PID:1016
-
\??\c:\vjdvj.exec:\vjdvj.exe113⤵PID:1500
-
\??\c:\lffflrl.exec:\lffflrl.exe114⤵PID:1600
-
\??\c:\rxlxrrf.exec:\rxlxrrf.exe115⤵PID:2400
-
\??\c:\btbhhn.exec:\btbhhn.exe116⤵PID:1944
-
\??\c:\ttttnh.exec:\ttttnh.exe117⤵PID:2152
-
\??\c:\vvjvj.exec:\vvjvj.exe118⤵PID:2472
-
\??\c:\vpddj.exec:\vpddj.exe119⤵PID:2776
-
\??\c:\3ppdv.exec:\3ppdv.exe120⤵PID:2804
-
\??\c:\9frffxl.exec:\9frffxl.exe121⤵PID:2892
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-