Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 06:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f54581ee73ea741317790e096db955966367d01f5daebf2a7416e3c2e87ea16f.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
f54581ee73ea741317790e096db955966367d01f5daebf2a7416e3c2e87ea16f.exe
-
Size
454KB
-
MD5
8b02e803f02a33adf6c60c2f9a4fca1b
-
SHA1
e0cda18013e10cd76b171ee2f721cbe254531e63
-
SHA256
f54581ee73ea741317790e096db955966367d01f5daebf2a7416e3c2e87ea16f
-
SHA512
0f5245941cafd841e83bc2f2edb29f4e51c7ab214dc2c83108db46487ce8836c2121188ef06975d3ef036bb2969bfebc57362d00118f1d2ff97e447400da6009
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeg:q7Tc2NYHUrAwfMp3CDg
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/2696-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1568-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1376-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-75-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2188-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-96-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2864-95-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/684-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1804-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1976-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1060-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1436-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-201-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/896-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2080-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/372-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1056-439-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1056-438-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/276-478-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1436-492-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/648-495-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1808-506-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2144-526-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/1956-545-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-572-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1128-592-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2252-593-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2776-623-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2640-644-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-651-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-658-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3064-679-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2144-803-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/372-840-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2640-923-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1700-948-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2020-1117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2916 pjjdj.exe 1568 3rrxlxl.exe 1376 rxflrlr.exe 2348 vjdpj.exe 2864 xffrflf.exe 2768 pppvp.exe 2912 fffxxff.exe 2188 7bnhhn.exe 2616 rrrfxll.exe 2688 jjjdp.exe 684 5xxlflf.exe 1804 bhnhnh.exe 1648 5ppvv.exe 1124 9xxffxr.exe 1976 3hbbbb.exe 1772 ddvdj.exe 1060 xrllxff.exe 596 dvjdd.exe 1168 tnhhbb.exe 2808 9rlffrf.exe 3008 bhnnbt.exe 1436 xfxrxxx.exe 1456 3tnnbb.exe 1000 1ffllrl.exe 860 thhbtt.exe 896 5fffxfr.exe 2796 vpjvj.exe 2080 xrlrrff.exe 372 hbnbnb.exe 1844 5btnhn.exe 3016 vvpvj.exe 2696 hhhnbn.exe 3044 djjvj.exe 2368 rlxrxxf.exe 2108 hbbnnb.exe 2480 ppjpj.exe 1504 ffxfxfx.exe 1936 9bbtht.exe 2844 nhhnbh.exe 2864 dvdjj.exe 2924 lxrfxfr.exe 2936 ntnbtt.exe 2792 pvvjj.exe 2612 xrxxlrf.exe 2740 bhbbth.exe 2688 7hbnth.exe 3064 pppdd.exe 2072 lrrllff.exe 1216 hhtnbn.exe 1708 thtnnh.exe 1648 ddvpd.exe 2156 rllrrfr.exe 1056 hhthtn.exe 1512 vjpjd.exe 1040 rlffrrx.exe 1060 ttbtth.exe 596 pvjvp.exe 844 xxfrrff.exe 276 hhhnnb.exe 2992 9btnbt.exe 1436 3jddv.exe 648 rlfrxfl.exe 1808 nnntnb.exe 1284 pvdpp.exe -
resource yara_rule behavioral1/memory/2696-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1376-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1568-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1376-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/684-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1124-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1976-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1060-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1436-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-201-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/896-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/372-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1056-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1056-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1060-458-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/276-478-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1436-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/648-495-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/1808-506-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-545-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/372-552-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-572-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1244-579-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-625-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-644-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-651-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-658-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2932-733-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-803-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/912-827-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-853-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-902-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-909-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2664-924-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-931-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-948-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/916-1068-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-1117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-1149-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxflxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlrlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ttnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tntht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrflrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrfxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnntnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlrxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2696 wrote to memory of 2916 2696 f54581ee73ea741317790e096db955966367d01f5daebf2a7416e3c2e87ea16f.exe 30 PID 2696 wrote to memory of 2916 2696 f54581ee73ea741317790e096db955966367d01f5daebf2a7416e3c2e87ea16f.exe 30 PID 2696 wrote to memory of 2916 2696 f54581ee73ea741317790e096db955966367d01f5daebf2a7416e3c2e87ea16f.exe 30 PID 2696 wrote to memory of 2916 2696 f54581ee73ea741317790e096db955966367d01f5daebf2a7416e3c2e87ea16f.exe 30 PID 2916 wrote to memory of 1568 2916 pjjdj.exe 31 PID 2916 wrote to memory of 1568 2916 pjjdj.exe 31 PID 2916 wrote to memory of 1568 2916 pjjdj.exe 31 PID 2916 wrote to memory of 1568 2916 pjjdj.exe 31 PID 1568 wrote to memory of 1376 1568 3rrxlxl.exe 32 PID 1568 wrote to memory of 1376 1568 3rrxlxl.exe 32 PID 1568 wrote to memory of 1376 1568 3rrxlxl.exe 32 PID 1568 wrote to memory of 1376 1568 3rrxlxl.exe 32 PID 1376 wrote to memory of 2348 1376 rxflrlr.exe 33 PID 1376 wrote to memory of 2348 1376 rxflrlr.exe 33 PID 1376 wrote to memory of 2348 1376 rxflrlr.exe 33 PID 1376 wrote to memory of 2348 1376 rxflrlr.exe 33 PID 2348 wrote to memory of 2864 2348 vjdpj.exe 34 PID 2348 wrote to memory of 2864 2348 vjdpj.exe 34 PID 2348 wrote to memory of 2864 2348 vjdpj.exe 34 PID 2348 wrote to memory of 2864 2348 vjdpj.exe 34 PID 2864 wrote to memory of 2768 2864 xffrflf.exe 35 PID 2864 wrote to memory of 2768 2864 xffrflf.exe 35 PID 2864 wrote to memory of 2768 2864 xffrflf.exe 35 PID 2864 wrote to memory of 2768 2864 xffrflf.exe 35 PID 2768 wrote to memory of 2912 2768 pppvp.exe 36 PID 2768 wrote to memory of 2912 2768 pppvp.exe 36 PID 2768 wrote to memory of 2912 2768 pppvp.exe 36 PID 2768 wrote to memory of 2912 2768 pppvp.exe 36 PID 2912 wrote to memory of 2188 2912 fffxxff.exe 37 PID 2912 wrote to memory of 2188 2912 fffxxff.exe 37 PID 2912 wrote to memory of 2188 2912 fffxxff.exe 37 PID 2912 wrote to memory of 2188 2912 fffxxff.exe 37 PID 2188 wrote to memory of 2616 2188 7bnhhn.exe 38 PID 2188 wrote to memory of 2616 2188 7bnhhn.exe 38 PID 2188 wrote to memory of 2616 2188 7bnhhn.exe 38 PID 2188 wrote to memory of 2616 2188 7bnhhn.exe 38 PID 2616 wrote to memory of 2688 2616 rrrfxll.exe 39 PID 2616 wrote to memory of 2688 2616 rrrfxll.exe 39 PID 2616 wrote to memory of 2688 2616 rrrfxll.exe 39 PID 2616 wrote to memory of 2688 2616 rrrfxll.exe 39 PID 2688 wrote to memory of 684 2688 jjjdp.exe 40 PID 2688 wrote to memory of 684 2688 jjjdp.exe 40 PID 2688 wrote to memory of 684 2688 jjjdp.exe 40 PID 2688 wrote to memory of 684 2688 jjjdp.exe 40 PID 684 wrote to memory of 1804 684 5xxlflf.exe 41 PID 684 wrote to memory of 1804 684 5xxlflf.exe 41 PID 684 wrote to memory of 1804 684 5xxlflf.exe 41 PID 684 wrote to memory of 1804 684 5xxlflf.exe 41 PID 1804 wrote to memory of 1648 1804 bhnhnh.exe 42 PID 1804 wrote to memory of 1648 1804 bhnhnh.exe 42 PID 1804 wrote to memory of 1648 1804 bhnhnh.exe 42 PID 1804 wrote to memory of 1648 1804 bhnhnh.exe 42 PID 1648 wrote to memory of 1124 1648 5ppvv.exe 43 PID 1648 wrote to memory of 1124 1648 5ppvv.exe 43 PID 1648 wrote to memory of 1124 1648 5ppvv.exe 43 PID 1648 wrote to memory of 1124 1648 5ppvv.exe 43 PID 1124 wrote to memory of 1976 1124 9xxffxr.exe 44 PID 1124 wrote to memory of 1976 1124 9xxffxr.exe 44 PID 1124 wrote to memory of 1976 1124 9xxffxr.exe 44 PID 1124 wrote to memory of 1976 1124 9xxffxr.exe 44 PID 1976 wrote to memory of 1772 1976 3hbbbb.exe 45 PID 1976 wrote to memory of 1772 1976 3hbbbb.exe 45 PID 1976 wrote to memory of 1772 1976 3hbbbb.exe 45 PID 1976 wrote to memory of 1772 1976 3hbbbb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\f54581ee73ea741317790e096db955966367d01f5daebf2a7416e3c2e87ea16f.exe"C:\Users\Admin\AppData\Local\Temp\f54581ee73ea741317790e096db955966367d01f5daebf2a7416e3c2e87ea16f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\pjjdj.exec:\pjjdj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\3rrxlxl.exec:\3rrxlxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
\??\c:\rxflrlr.exec:\rxflrlr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
\??\c:\vjdpj.exec:\vjdpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\xffrflf.exec:\xffrflf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\pppvp.exec:\pppvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\fffxxff.exec:\fffxxff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\7bnhhn.exec:\7bnhhn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\rrrfxll.exec:\rrrfxll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\jjjdp.exec:\jjjdp.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\5xxlflf.exec:\5xxlflf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
\??\c:\bhnhnh.exec:\bhnhnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\5ppvv.exec:\5ppvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\9xxffxr.exec:\9xxffxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
\??\c:\3hbbbb.exec:\3hbbbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\ddvdj.exec:\ddvdj.exe17⤵
- Executes dropped EXE
PID:1772 -
\??\c:\xrllxff.exec:\xrllxff.exe18⤵
- Executes dropped EXE
PID:1060 -
\??\c:\dvjdd.exec:\dvjdd.exe19⤵
- Executes dropped EXE
PID:596 -
\??\c:\tnhhbb.exec:\tnhhbb.exe20⤵
- Executes dropped EXE
PID:1168 -
\??\c:\9rlffrf.exec:\9rlffrf.exe21⤵
- Executes dropped EXE
PID:2808 -
\??\c:\bhnnbt.exec:\bhnnbt.exe22⤵
- Executes dropped EXE
PID:3008 -
\??\c:\xfxrxxx.exec:\xfxrxxx.exe23⤵
- Executes dropped EXE
PID:1436 -
\??\c:\3tnnbb.exec:\3tnnbb.exe24⤵
- Executes dropped EXE
PID:1456 -
\??\c:\1ffllrl.exec:\1ffllrl.exe25⤵
- Executes dropped EXE
PID:1000 -
\??\c:\thhbtt.exec:\thhbtt.exe26⤵
- Executes dropped EXE
PID:860 -
\??\c:\5fffxfr.exec:\5fffxfr.exe27⤵
- Executes dropped EXE
PID:896 -
\??\c:\vpjvj.exec:\vpjvj.exe28⤵
- Executes dropped EXE
PID:2796 -
\??\c:\xrlrrff.exec:\xrlrrff.exe29⤵
- Executes dropped EXE
PID:2080 -
\??\c:\hbnbnb.exec:\hbnbnb.exe30⤵
- Executes dropped EXE
PID:372 -
\??\c:\5btnhn.exec:\5btnhn.exe31⤵
- Executes dropped EXE
PID:1844 -
\??\c:\vvpvj.exec:\vvpvj.exe32⤵
- Executes dropped EXE
PID:3016 -
\??\c:\hhhnbn.exec:\hhhnbn.exe33⤵
- Executes dropped EXE
PID:2696 -
\??\c:\djjvj.exec:\djjvj.exe34⤵
- Executes dropped EXE
PID:3044 -
\??\c:\rlxrxxf.exec:\rlxrxxf.exe35⤵
- Executes dropped EXE
PID:2368 -
\??\c:\hbbnnb.exec:\hbbnnb.exe36⤵
- Executes dropped EXE
PID:2108 -
\??\c:\ppjpj.exec:\ppjpj.exe37⤵
- Executes dropped EXE
PID:2480 -
\??\c:\ffxfxfx.exec:\ffxfxfx.exe38⤵
- Executes dropped EXE
PID:1504 -
\??\c:\9bbtht.exec:\9bbtht.exe39⤵
- Executes dropped EXE
PID:1936 -
\??\c:\nhhnbh.exec:\nhhnbh.exe40⤵
- Executes dropped EXE
PID:2844 -
\??\c:\dvdjj.exec:\dvdjj.exe41⤵
- Executes dropped EXE
PID:2864 -
\??\c:\lxrfxfr.exec:\lxrfxfr.exe42⤵
- Executes dropped EXE
PID:2924 -
\??\c:\ntnbtt.exec:\ntnbtt.exe43⤵
- Executes dropped EXE
PID:2936 -
\??\c:\pvvjj.exec:\pvvjj.exe44⤵
- Executes dropped EXE
PID:2792 -
\??\c:\xrxxlrf.exec:\xrxxlrf.exe45⤵
- Executes dropped EXE
PID:2612 -
\??\c:\bhbbth.exec:\bhbbth.exe46⤵
- Executes dropped EXE
PID:2740 -
\??\c:\7hbnth.exec:\7hbnth.exe47⤵
- Executes dropped EXE
PID:2688 -
\??\c:\pppdd.exec:\pppdd.exe48⤵
- Executes dropped EXE
PID:3064 -
\??\c:\lrrllff.exec:\lrrllff.exe49⤵
- Executes dropped EXE
PID:2072 -
\??\c:\hhtnbn.exec:\hhtnbn.exe50⤵
- Executes dropped EXE
PID:1216 -
\??\c:\thtnnh.exec:\thtnnh.exe51⤵
- Executes dropped EXE
PID:1708 -
\??\c:\ddvpd.exec:\ddvpd.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1648 -
\??\c:\rllrrfr.exec:\rllrrfr.exe53⤵
- Executes dropped EXE
PID:2156 -
\??\c:\hhthtn.exec:\hhthtn.exe54⤵
- Executes dropped EXE
PID:1056 -
\??\c:\vjpjd.exec:\vjpjd.exe55⤵
- Executes dropped EXE
PID:1512 -
\??\c:\rlffrrx.exec:\rlffrrx.exe56⤵
- Executes dropped EXE
PID:1040 -
\??\c:\ttbtth.exec:\ttbtth.exe57⤵
- Executes dropped EXE
PID:1060 -
\??\c:\pvjvp.exec:\pvjvp.exe58⤵
- Executes dropped EXE
PID:596 -
\??\c:\xxfrrff.exec:\xxfrrff.exe59⤵
- Executes dropped EXE
PID:844 -
\??\c:\hhhnnb.exec:\hhhnnb.exe60⤵
- Executes dropped EXE
PID:276 -
\??\c:\9btnbt.exec:\9btnbt.exe61⤵
- Executes dropped EXE
PID:2992 -
\??\c:\3jddv.exec:\3jddv.exe62⤵
- Executes dropped EXE
PID:1436 -
\??\c:\rlfrxfl.exec:\rlfrxfl.exe63⤵
- Executes dropped EXE
PID:648 -
\??\c:\nnntnb.exec:\nnntnb.exe64⤵
- Executes dropped EXE
PID:1808 -
\??\c:\pvdpp.exec:\pvdpp.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1284 -
\??\c:\xxrrflx.exec:\xxrrflx.exe66⤵PID:1760
-
\??\c:\llfxrrl.exec:\llfxrrl.exe67⤵PID:2144
-
\??\c:\hhbnbh.exec:\hhbnbh.exe68⤵PID:896
-
\??\c:\jjdjv.exec:\jjdjv.exe69⤵PID:2532
-
\??\c:\frxlrll.exec:\frxlrll.exe70⤵PID:1956
-
\??\c:\3tthnb.exec:\3tthnb.exe71⤵PID:912
-
\??\c:\pvvdp.exec:\pvvdp.exe72⤵PID:372
-
\??\c:\1fxffxr.exec:\1fxffxr.exe73⤵PID:900
-
\??\c:\lffrlff.exec:\lffrlff.exe74⤵PID:2252
-
\??\c:\9tbhtn.exec:\9tbhtn.exe75⤵PID:2196
-
\??\c:\vdjjj.exec:\vdjjj.exe76⤵PID:1244
-
\??\c:\fffxrrl.exec:\fffxrrl.exe77⤵PID:1128
-
\??\c:\xlllrfl.exec:\xlllrfl.exe78⤵PID:2804
-
\??\c:\ttbbnh.exec:\ttbbnh.exe79⤵PID:2112
-
\??\c:\vdpdv.exec:\vdpdv.exe80⤵PID:2764
-
\??\c:\xxfxxfl.exec:\xxfxxfl.exe81⤵PID:2896
-
\??\c:\htnbhh.exec:\htnbhh.exe82⤵PID:2776
-
\??\c:\1vvdd.exec:\1vvdd.exe83⤵PID:2844
-
\??\c:\jvpvp.exec:\jvpvp.exe84⤵PID:2504
-
\??\c:\9lfrlfx.exec:\9lfrlfx.exe85⤵PID:2640
-
\??\c:\9tbbbh.exec:\9tbbbh.exe86⤵PID:2812
-
\??\c:\ppjdv.exec:\ppjdv.exe87⤵PID:2792
-
\??\c:\rxrrxxl.exec:\rxrrxxl.exe88⤵PID:2680
-
\??\c:\1xxrxfl.exec:\1xxrxfl.exe89⤵PID:2516
-
\??\c:\hnthnn.exec:\hnthnn.exe90⤵PID:2472
-
\??\c:\vvpvj.exec:\vvpvj.exe91⤵PID:3064
-
\??\c:\xlrlrrr.exec:\xlrlrrr.exe92⤵PID:2072
-
\??\c:\fffxflf.exec:\fffxflf.exe93⤵PID:1372
-
\??\c:\ttntnt.exec:\ttntnt.exe94⤵PID:1708
-
\??\c:\vvdjp.exec:\vvdjp.exe95⤵PID:2356
-
\??\c:\lrxfxfx.exec:\lrxfxfx.exe96⤵PID:2156
-
\??\c:\nnhbnt.exec:\nnhbnt.exe97⤵PID:1772
-
\??\c:\5ddjd.exec:\5ddjd.exe98⤵PID:1608
-
\??\c:\djjjv.exec:\djjjv.exe99⤵PID:2524
-
\??\c:\7lrrlrr.exec:\7lrrlrr.exe100⤵PID:2932
-
\??\c:\5hbhtt.exec:\5hbhtt.exe101⤵PID:2952
-
\??\c:\pppdp.exec:\pppdp.exe102⤵PID:868
-
\??\c:\vjdvp.exec:\vjdvp.exe103⤵PID:3004
-
\??\c:\9tnnnt.exec:\9tnnnt.exe104⤵PID:2996
-
\??\c:\pjjvp.exec:\pjjvp.exe105⤵PID:1720
-
\??\c:\1xfllxr.exec:\1xfllxr.exe106⤵PID:1992
-
\??\c:\xffxflf.exec:\xffxflf.exe107⤵PID:1232
-
\??\c:\bbhtnb.exec:\bbhtnb.exe108⤵PID:1248
-
\??\c:\pppvv.exec:\pppvv.exe109⤵PID:2464
-
\??\c:\xxxrllr.exec:\xxxrllr.exe110⤵PID:568
-
\??\c:\hnntnb.exec:\hnntnb.exe111⤵
- System Location Discovery: System Language Discovery
PID:2144 -
\??\c:\vjvjj.exec:\vjvjj.exe112⤵PID:2332
-
\??\c:\rfxxxrr.exec:\rfxxxrr.exe113⤵PID:2080
-
\??\c:\nbnnbt.exec:\nbnnbt.exe114⤵PID:2836
-
\??\c:\hntntn.exec:\hntntn.exe115⤵PID:912
-
\??\c:\ppjdv.exec:\ppjdv.exe116⤵PID:372
-
\??\c:\llxrrxf.exec:\llxrrxf.exe117⤵PID:900
-
\??\c:\bbhbht.exec:\bbhbht.exe118⤵PID:2172
-
\??\c:\7pvdd.exec:\7pvdd.exe119⤵PID:2396
-
\??\c:\7vdpv.exec:\7vdpv.exe120⤵PID:3040
-
\??\c:\lllfxrf.exec:\lllfxrf.exe121⤵PID:2580
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-