Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 07:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
feb510fdcd70fca7f5ff632514d108a252fad0c392281e46d6580a9665094e4b.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
feb510fdcd70fca7f5ff632514d108a252fad0c392281e46d6580a9665094e4b.exe
-
Size
453KB
-
MD5
142798714da101a030f0e3d0d44bc62d
-
SHA1
3a84dd84be087ae132e3cad9fc337ae7f17db3e9
-
SHA256
feb510fdcd70fca7f5ff632514d108a252fad0c392281e46d6580a9665094e4b
-
SHA512
16fbfbfb73266e4c2b569c9190870405c2fde5ad41eeed68f11472f39755e6e54157e3d8bcd84c2bc8123fa4c6a71253f5d7a9927bd6a8aa14eb5e7404a988a8
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbet:q7Tc2NYHUrAwfMp3CDt
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/1388-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2560-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-57-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2824-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1724-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1264-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/644-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2272-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2020-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/848-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2100-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-350-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1740-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-378-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2892-377-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2148-428-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1212-471-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/784-492-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/376-499-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/828-506-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2268-550-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-557-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1988-621-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2044-722-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3052-771-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1192-896-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/592-1025-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2668-1095-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-1120-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/856-1193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-1245-0x0000000000340000-0x000000000036A000-memory.dmp family_blackmoon behavioral1/memory/2516-1253-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/540-1273-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2680 fflxfrl.exe 2812 ntthhn.exe 2560 vdppv.exe 2780 5lxlxll.exe 2724 bnttnt.exe 2572 djjdp.exe 2824 1jvpv.exe 1724 ddjpj.exe 2884 ffrfxfx.exe 2592 ddpvd.exe 1264 ffxlflx.exe 2272 ppjvp.exe 644 frxflfr.exe 1324 hbntnn.exe 2736 fffrrxr.exe 2940 hbbntb.exe 704 xxxflrl.exe 2020 vvpvd.exe 2404 rrfrffr.exe 848 3jdjv.exe 1800 xlrlllf.exe 540 jjjjj.exe 2212 1lrxrfx.exe 1588 vdjvv.exe 1884 lrffrfl.exe 2100 7vjjv.exe 2064 nbbttb.exe 3044 ppjpd.exe 1944 xlrlrlr.exe 2740 jpjdp.exe 2472 bbhnbn.exe 2704 5jpdd.exe 2248 lrlxrxx.exe 2760 vvjvd.exe 2336 3xrrllr.exe 2872 ntttth.exe 2772 jjddp.exe 2564 jjdvp.exe 2628 hhtbhn.exe 3068 7nnnht.exe 2672 pvppp.exe 1740 9xrfxxx.exe 2988 nnbhbh.exe 2892 ddvjd.exe 2128 7llxxfx.exe 1616 hhbbth.exe 1728 jppvp.exe 2036 xrlxllf.exe 1256 hbhnnt.exe 276 pvpdp.exe 2880 dvpdv.exe 2148 llflxfr.exe 2228 bbttnn.exe 2256 jjdpd.exe 2096 fxrxllf.exe 1100 bbnbtn.exe 2384 9tntnh.exe 976 ppvdv.exe 1212 xxxfxll.exe 960 tnbnbb.exe 568 dppdv.exe 784 fxxlrxl.exe 376 fffllxf.exe 828 bbnbbn.exe -
resource yara_rule behavioral1/memory/1388-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1264-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/644-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/848-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/848-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/540-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1588-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1212-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/784-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/784-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/376-499-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/828-506-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-525-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-550-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-557-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-722-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/3052-771-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-772-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1916-780-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-793-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-897-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1192-896-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/112-904-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-1095-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-1133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-1178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/856-1193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-1220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/540-1273-0x00000000002A0000-0x00000000002CA000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ttbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xlfxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xxlxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxrfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlfrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9llrfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxxfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbttth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrlxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1388 wrote to memory of 2680 1388 feb510fdcd70fca7f5ff632514d108a252fad0c392281e46d6580a9665094e4b.exe 31 PID 1388 wrote to memory of 2680 1388 feb510fdcd70fca7f5ff632514d108a252fad0c392281e46d6580a9665094e4b.exe 31 PID 1388 wrote to memory of 2680 1388 feb510fdcd70fca7f5ff632514d108a252fad0c392281e46d6580a9665094e4b.exe 31 PID 1388 wrote to memory of 2680 1388 feb510fdcd70fca7f5ff632514d108a252fad0c392281e46d6580a9665094e4b.exe 31 PID 2680 wrote to memory of 2812 2680 fflxfrl.exe 32 PID 2680 wrote to memory of 2812 2680 fflxfrl.exe 32 PID 2680 wrote to memory of 2812 2680 fflxfrl.exe 32 PID 2680 wrote to memory of 2812 2680 fflxfrl.exe 32 PID 2812 wrote to memory of 2560 2812 ntthhn.exe 33 PID 2812 wrote to memory of 2560 2812 ntthhn.exe 33 PID 2812 wrote to memory of 2560 2812 ntthhn.exe 33 PID 2812 wrote to memory of 2560 2812 ntthhn.exe 33 PID 2560 wrote to memory of 2780 2560 vdppv.exe 34 PID 2560 wrote to memory of 2780 2560 vdppv.exe 34 PID 2560 wrote to memory of 2780 2560 vdppv.exe 34 PID 2560 wrote to memory of 2780 2560 vdppv.exe 34 PID 2780 wrote to memory of 2724 2780 5lxlxll.exe 35 PID 2780 wrote to memory of 2724 2780 5lxlxll.exe 35 PID 2780 wrote to memory of 2724 2780 5lxlxll.exe 35 PID 2780 wrote to memory of 2724 2780 5lxlxll.exe 35 PID 2724 wrote to memory of 2572 2724 bnttnt.exe 36 PID 2724 wrote to memory of 2572 2724 bnttnt.exe 36 PID 2724 wrote to memory of 2572 2724 bnttnt.exe 36 PID 2724 wrote to memory of 2572 2724 bnttnt.exe 36 PID 2572 wrote to memory of 2824 2572 djjdp.exe 37 PID 2572 wrote to memory of 2824 2572 djjdp.exe 37 PID 2572 wrote to memory of 2824 2572 djjdp.exe 37 PID 2572 wrote to memory of 2824 2572 djjdp.exe 37 PID 2824 wrote to memory of 1724 2824 1jvpv.exe 38 PID 2824 wrote to memory of 1724 2824 1jvpv.exe 38 PID 2824 wrote to memory of 1724 2824 1jvpv.exe 38 PID 2824 wrote to memory of 1724 2824 1jvpv.exe 38 PID 1724 wrote to memory of 2884 1724 ddjpj.exe 39 PID 1724 wrote to memory of 2884 1724 ddjpj.exe 39 PID 1724 wrote to memory of 2884 1724 ddjpj.exe 39 PID 1724 wrote to memory of 2884 1724 ddjpj.exe 39 PID 2884 wrote to memory of 2592 2884 ffrfxfx.exe 40 PID 2884 wrote to memory of 2592 2884 ffrfxfx.exe 40 PID 2884 wrote to memory of 2592 2884 ffrfxfx.exe 40 PID 2884 wrote to memory of 2592 2884 ffrfxfx.exe 40 PID 2592 wrote to memory of 1264 2592 ddpvd.exe 41 PID 2592 wrote to memory of 1264 2592 ddpvd.exe 41 PID 2592 wrote to memory of 1264 2592 ddpvd.exe 41 PID 2592 wrote to memory of 1264 2592 ddpvd.exe 41 PID 1264 wrote to memory of 2272 1264 ffxlflx.exe 42 PID 1264 wrote to memory of 2272 1264 ffxlflx.exe 42 PID 1264 wrote to memory of 2272 1264 ffxlflx.exe 42 PID 1264 wrote to memory of 2272 1264 ffxlflx.exe 42 PID 2272 wrote to memory of 644 2272 ppjvp.exe 43 PID 2272 wrote to memory of 644 2272 ppjvp.exe 43 PID 2272 wrote to memory of 644 2272 ppjvp.exe 43 PID 2272 wrote to memory of 644 2272 ppjvp.exe 43 PID 644 wrote to memory of 1324 644 frxflfr.exe 44 PID 644 wrote to memory of 1324 644 frxflfr.exe 44 PID 644 wrote to memory of 1324 644 frxflfr.exe 44 PID 644 wrote to memory of 1324 644 frxflfr.exe 44 PID 1324 wrote to memory of 2736 1324 hbntnn.exe 45 PID 1324 wrote to memory of 2736 1324 hbntnn.exe 45 PID 1324 wrote to memory of 2736 1324 hbntnn.exe 45 PID 1324 wrote to memory of 2736 1324 hbntnn.exe 45 PID 2736 wrote to memory of 2940 2736 fffrrxr.exe 46 PID 2736 wrote to memory of 2940 2736 fffrrxr.exe 46 PID 2736 wrote to memory of 2940 2736 fffrrxr.exe 46 PID 2736 wrote to memory of 2940 2736 fffrrxr.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\feb510fdcd70fca7f5ff632514d108a252fad0c392281e46d6580a9665094e4b.exe"C:\Users\Admin\AppData\Local\Temp\feb510fdcd70fca7f5ff632514d108a252fad0c392281e46d6580a9665094e4b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\fflxfrl.exec:\fflxfrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\ntthhn.exec:\ntthhn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\vdppv.exec:\vdppv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\5lxlxll.exec:\5lxlxll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\bnttnt.exec:\bnttnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\djjdp.exec:\djjdp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\1jvpv.exec:\1jvpv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\ddjpj.exec:\ddjpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\ffrfxfx.exec:\ffrfxfx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\ddpvd.exec:\ddpvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\ffxlflx.exec:\ffxlflx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
\??\c:\ppjvp.exec:\ppjvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\frxflfr.exec:\frxflfr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:644 -
\??\c:\hbntnn.exec:\hbntnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
\??\c:\fffrrxr.exec:\fffrrxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\hbbntb.exec:\hbbntb.exe17⤵
- Executes dropped EXE
PID:2940 -
\??\c:\xxxflrl.exec:\xxxflrl.exe18⤵
- Executes dropped EXE
PID:704 -
\??\c:\vvpvd.exec:\vvpvd.exe19⤵
- Executes dropped EXE
PID:2020 -
\??\c:\rrfrffr.exec:\rrfrffr.exe20⤵
- Executes dropped EXE
PID:2404 -
\??\c:\3jdjv.exec:\3jdjv.exe21⤵
- Executes dropped EXE
PID:848 -
\??\c:\xlrlllf.exec:\xlrlllf.exe22⤵
- Executes dropped EXE
PID:1800 -
\??\c:\jjjjj.exec:\jjjjj.exe23⤵
- Executes dropped EXE
PID:540 -
\??\c:\1lrxrfx.exec:\1lrxrfx.exe24⤵
- Executes dropped EXE
PID:2212 -
\??\c:\vdjvv.exec:\vdjvv.exe25⤵
- Executes dropped EXE
PID:1588 -
\??\c:\lrffrfl.exec:\lrffrfl.exe26⤵
- Executes dropped EXE
PID:1884 -
\??\c:\7vjjv.exec:\7vjjv.exe27⤵
- Executes dropped EXE
PID:2100 -
\??\c:\nbbttb.exec:\nbbttb.exe28⤵
- Executes dropped EXE
PID:2064 -
\??\c:\ppjpd.exec:\ppjpd.exe29⤵
- Executes dropped EXE
PID:3044 -
\??\c:\xlrlrlr.exec:\xlrlrlr.exe30⤵
- Executes dropped EXE
PID:1944 -
\??\c:\jpjdp.exec:\jpjdp.exe31⤵
- Executes dropped EXE
PID:2740 -
\??\c:\bbhnbn.exec:\bbhnbn.exe32⤵
- Executes dropped EXE
PID:2472 -
\??\c:\5jpdd.exec:\5jpdd.exe33⤵
- Executes dropped EXE
PID:2704 -
\??\c:\lrlxrxx.exec:\lrlxrxx.exe34⤵
- Executes dropped EXE
PID:2248 -
\??\c:\vvjvd.exec:\vvjvd.exe35⤵
- Executes dropped EXE
PID:2760 -
\??\c:\3xrrllr.exec:\3xrrllr.exe36⤵
- Executes dropped EXE
PID:2336 -
\??\c:\ntttth.exec:\ntttth.exe37⤵
- Executes dropped EXE
PID:2872 -
\??\c:\jjddp.exec:\jjddp.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2772 -
\??\c:\jjdvp.exec:\jjdvp.exe39⤵
- Executes dropped EXE
PID:2564 -
\??\c:\hhtbhn.exec:\hhtbhn.exe40⤵
- Executes dropped EXE
PID:2628 -
\??\c:\7nnnht.exec:\7nnnht.exe41⤵
- Executes dropped EXE
PID:3068 -
\??\c:\pvppp.exec:\pvppp.exe42⤵
- Executes dropped EXE
PID:2672 -
\??\c:\9xrfxxx.exec:\9xrfxxx.exe43⤵
- Executes dropped EXE
PID:1740 -
\??\c:\nnbhbh.exec:\nnbhbh.exe44⤵
- Executes dropped EXE
PID:2988 -
\??\c:\ddvjd.exec:\ddvjd.exe45⤵
- Executes dropped EXE
PID:2892 -
\??\c:\7llxxfx.exec:\7llxxfx.exe46⤵
- Executes dropped EXE
PID:2128 -
\??\c:\hhbbth.exec:\hhbbth.exe47⤵
- Executes dropped EXE
PID:1616 -
\??\c:\jppvp.exec:\jppvp.exe48⤵
- Executes dropped EXE
PID:1728 -
\??\c:\xrlxllf.exec:\xrlxllf.exe49⤵
- Executes dropped EXE
PID:2036 -
\??\c:\hbhnnt.exec:\hbhnnt.exe50⤵
- Executes dropped EXE
PID:1256 -
\??\c:\pvpdp.exec:\pvpdp.exe51⤵
- Executes dropped EXE
PID:276 -
\??\c:\dvpdv.exec:\dvpdv.exe52⤵
- Executes dropped EXE
PID:2880 -
\??\c:\llflxfr.exec:\llflxfr.exe53⤵
- Executes dropped EXE
PID:2148 -
\??\c:\bbttnn.exec:\bbttnn.exe54⤵
- Executes dropped EXE
PID:2228 -
\??\c:\jjdpd.exec:\jjdpd.exe55⤵
- Executes dropped EXE
PID:2256 -
\??\c:\fxrxllf.exec:\fxrxllf.exe56⤵
- Executes dropped EXE
PID:2096 -
\??\c:\bbnbtn.exec:\bbnbtn.exe57⤵
- Executes dropped EXE
PID:1100 -
\??\c:\9tntnh.exec:\9tntnh.exe58⤵
- Executes dropped EXE
PID:2384 -
\??\c:\ppvdv.exec:\ppvdv.exe59⤵
- Executes dropped EXE
PID:976 -
\??\c:\xxxfxll.exec:\xxxfxll.exe60⤵
- Executes dropped EXE
PID:1212 -
\??\c:\tnbnbb.exec:\tnbnbb.exe61⤵
- Executes dropped EXE
PID:960 -
\??\c:\dppdv.exec:\dppdv.exe62⤵
- Executes dropped EXE
PID:568 -
\??\c:\fxxlrxl.exec:\fxxlrxl.exe63⤵
- Executes dropped EXE
PID:784 -
\??\c:\fffllxf.exec:\fffllxf.exe64⤵
- Executes dropped EXE
PID:376 -
\??\c:\bbnbbn.exec:\bbnbbn.exe65⤵
- Executes dropped EXE
PID:828 -
\??\c:\jvpdp.exec:\jvpdp.exe66⤵PID:1612
-
\??\c:\hnntbh.exec:\hnntbh.exe67⤵PID:2460
-
\??\c:\tnntht.exec:\tnntht.exe68⤵PID:2936
-
\??\c:\dddpd.exec:\dddpd.exe69⤵PID:2464
-
\??\c:\hnnbtt.exec:\hnnbtt.exe70⤵PID:2832
-
\??\c:\1pjpj.exec:\1pjpj.exe71⤵PID:1924
-
\??\c:\xffxxlf.exec:\xffxxlf.exe72⤵PID:2268
-
\??\c:\lrlxrxr.exec:\lrlxrxr.exe73⤵PID:2748
-
\??\c:\bbbnbh.exec:\bbbnbh.exe74⤵PID:2792
-
\??\c:\jdvvd.exec:\jdvvd.exe75⤵PID:2828
-
\??\c:\xrflxfl.exec:\xrflxfl.exe76⤵PID:2928
-
\??\c:\tthbht.exec:\tthbht.exe77⤵PID:2760
-
\??\c:\jjdvv.exec:\jjdvv.exe78⤵PID:2804
-
\??\c:\9rflxlx.exec:\9rflxlx.exe79⤵PID:2872
-
\??\c:\thhthn.exec:\thhthn.exe80⤵PID:2800
-
\??\c:\hnnhbt.exec:\hnnhbt.exe81⤵PID:2624
-
\??\c:\pjvjp.exec:\pjvjp.exe82⤵PID:2628
-
\??\c:\flxrlxx.exec:\flxrlxx.exe83⤵PID:1988
-
\??\c:\bbbnbn.exec:\bbbnbn.exe84⤵PID:2888
-
\??\c:\1ppvp.exec:\1ppvp.exe85⤵PID:1740
-
\??\c:\flrfxll.exec:\flrfxll.exe86⤵PID:2236
-
\??\c:\thbbth.exec:\thbbth.exe87⤵PID:2592
-
\??\c:\vdvpv.exec:\vdvpv.exe88⤵PID:1220
-
\??\c:\jddjv.exec:\jddjv.exe89⤵PID:2180
-
\??\c:\1xlrxfl.exec:\1xlrxfl.exe90⤵PID:1608
-
\??\c:\btbnbh.exec:\btbnbh.exe91⤵PID:1336
-
\??\c:\9jjpj.exec:\9jjpj.exe92⤵PID:1624
-
\??\c:\1xfrllx.exec:\1xfrllx.exe93⤵PID:1324
-
\??\c:\xffrlrr.exec:\xffrlrr.exe94⤵PID:1732
-
\??\c:\bhthth.exec:\bhthth.exe95⤵PID:1736
-
\??\c:\jpdvp.exec:\jpdvp.exe96⤵PID:2172
-
\??\c:\lffrrxl.exec:\lffrrxl.exe97⤵PID:704
-
\??\c:\pjpdd.exec:\pjpdd.exe98⤵PID:1440
-
\??\c:\rrflxxx.exec:\rrflxxx.exe99⤵PID:2044
-
\??\c:\bhbtnt.exec:\bhbtnt.exe100⤵PID:1008
-
\??\c:\ppjdp.exec:\ppjdp.exe101⤵PID:1536
-
\??\c:\ddjdv.exec:\ddjdv.exe102⤵PID:1544
-
\??\c:\bbbnhb.exec:\bbbnhb.exe103⤵PID:1772
-
\??\c:\1ppdp.exec:\1ppdp.exe104⤵PID:1712
-
\??\c:\jjjvd.exec:\jjjvd.exe105⤵PID:592
-
\??\c:\flxrxll.exec:\flxrxll.exe106⤵PID:1588
-
\??\c:\hhhbnb.exec:\hhhbnb.exe107⤵PID:3052
-
\??\c:\jjjpj.exec:\jjjpj.exe108⤵PID:2976
-
\??\c:\rlffflx.exec:\rlffflx.exe109⤵PID:1916
-
\??\c:\ffxlxfr.exec:\ffxlxfr.exe110⤵PID:2064
-
\??\c:\bbbtnb.exec:\bbbtnb.exe111⤵PID:3044
-
\??\c:\dvpvj.exec:\dvpvj.exe112⤵PID:900
-
\??\c:\llfrlrl.exec:\llfrlrl.exe113⤵PID:1804
-
\??\c:\hnthnn.exec:\hnthnn.exe114⤵PID:764
-
\??\c:\1hhbnt.exec:\1hhbnt.exe115⤵PID:2660
-
\??\c:\jjpdj.exec:\jjpdj.exe116⤵PID:2684
-
\??\c:\rxrffrr.exec:\rxrffrr.exe117⤵PID:2932
-
\??\c:\tnhnnt.exec:\tnhnnt.exe118⤵PID:1628
-
\??\c:\ttbbbb.exec:\ttbbbb.exe119⤵PID:1528
-
\??\c:\djppd.exec:\djppd.exe120⤵PID:2780
-
\??\c:\llfrrfx.exec:\llfrrfx.exe121⤵PID:2688
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-