Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 08:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
858522ade56ef8346756e95f4ffc9ce5db17b6f4b7070cf92abc1d1854b78397.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
858522ade56ef8346756e95f4ffc9ce5db17b6f4b7070cf92abc1d1854b78397.exe
-
Size
456KB
-
MD5
879edf229a3ad8d1bd495ee5144949c4
-
SHA1
c016fedda18e1a7bd17e50beecb3e16447901e72
-
SHA256
858522ade56ef8346756e95f4ffc9ce5db17b6f4b7070cf92abc1d1854b78397
-
SHA512
b46534caf4c14742000ecef02f7a14f574a060d3a2cbaa4455df966080a51450c684322814de035afa7d1a7af8d231e56efc9bd0d055cada9e511ffc6276497d
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRM:q7Tc2NYHUrAwfMp3CDRM
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/1956-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2376-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-91-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2208-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2208-111-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2136-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/824-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-148-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1852-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3028-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1628-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1628-204-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1072-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1300-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/868-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1056-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2036-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1800-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-335-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2676-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1484-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-364-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2044-396-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2044-395-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/568-416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2044-417-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3008-445-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2132-468-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1056-556-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1504-555-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1680-569-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-638-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-669-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/544-716-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2248-836-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-900-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2860-899-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2784-963-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-962-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/352-1328-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2376 rllxlrr.exe 2928 hntttb.exe 2556 dpvjj.exe 2216 dvjjd.exe 2848 rfrxrxr.exe 2740 bbnhhb.exe 2824 lxllflr.exe 2180 jjvdv.exe 2632 lxlflff.exe 2628 btbhnn.exe 2208 rfrrflf.exe 2572 bnttnn.exe 2136 xxxllrl.exe 824 ttbtnb.exe 2808 llrlxlf.exe 2960 7bbbbt.exe 1852 3ffrflf.exe 3012 7xlxxrr.exe 3028 rxxrrxx.exe 2104 bbbntb.exe 1628 1hhtht.exe 1072 1llxlfr.exe 2564 vddjv.exe 1044 3nnnbn.exe 2544 tbhhht.exe 2444 1ppdv.exe 868 xrxrxfr.exe 1300 tttbth.exe 1488 5ntthn.exe 1056 djjdv.exe 2540 pvvpv.exe 2036 nnthhn.exe 2376 bhbntn.exe 1800 ffxllxf.exe 1928 hhbhtb.exe 1548 dddjv.exe 2676 dvdpj.exe 2876 xfrlfrx.exe 2848 bbbnnb.exe 1484 hbhnbn.exe 2824 djddj.exe 2624 flrlfxx.exe 2016 hhhtbn.exe 2660 hhnhbn.exe 1480 vvvvp.exe 2044 rrrffxr.exe 2644 9fxfrfr.exe 2416 hhhtth.exe 568 dddvv.exe 2812 vvvjd.exe 2944 lrffxlf.exe 2488 3nbthb.exe 1848 ttnthn.exe 3008 1pvdp.exe 3004 fllxllf.exe 3016 nnnbhh.exe 2132 ntttnb.exe 2100 vdddd.exe 2464 flxxrfx.exe 744 fxrfffr.exe 3024 hhbnhn.exe 1132 jjjpj.exe 1292 lrfflrx.exe 1044 xxfrxlf.exe -
resource yara_rule behavioral1/memory/1956-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-109-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2136-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/824-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1852-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-147-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/1852-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1072-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1044-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1300-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/868-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1056-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1484-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-395-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/568-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-445-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2132-468-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1056-556-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1504-555-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-569-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-594-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-607-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-638-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-669-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-690-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-697-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/544-716-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-724-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-786-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-836-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-861-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-919-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-963-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1356-964-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1072-1021-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-1070-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-1083-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-1230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/352-1328-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1300-1329-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frflffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nntth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rxfxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ddjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5llrflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1956 wrote to memory of 2376 1956 858522ade56ef8346756e95f4ffc9ce5db17b6f4b7070cf92abc1d1854b78397.exe 30 PID 1956 wrote to memory of 2376 1956 858522ade56ef8346756e95f4ffc9ce5db17b6f4b7070cf92abc1d1854b78397.exe 30 PID 1956 wrote to memory of 2376 1956 858522ade56ef8346756e95f4ffc9ce5db17b6f4b7070cf92abc1d1854b78397.exe 30 PID 1956 wrote to memory of 2376 1956 858522ade56ef8346756e95f4ffc9ce5db17b6f4b7070cf92abc1d1854b78397.exe 30 PID 2376 wrote to memory of 2928 2376 rllxlrr.exe 31 PID 2376 wrote to memory of 2928 2376 rllxlrr.exe 31 PID 2376 wrote to memory of 2928 2376 rllxlrr.exe 31 PID 2376 wrote to memory of 2928 2376 rllxlrr.exe 31 PID 2928 wrote to memory of 2556 2928 hntttb.exe 32 PID 2928 wrote to memory of 2556 2928 hntttb.exe 32 PID 2928 wrote to memory of 2556 2928 hntttb.exe 32 PID 2928 wrote to memory of 2556 2928 hntttb.exe 32 PID 2556 wrote to memory of 2216 2556 dpvjj.exe 33 PID 2556 wrote to memory of 2216 2556 dpvjj.exe 33 PID 2556 wrote to memory of 2216 2556 dpvjj.exe 33 PID 2556 wrote to memory of 2216 2556 dpvjj.exe 33 PID 2216 wrote to memory of 2848 2216 dvjjd.exe 34 PID 2216 wrote to memory of 2848 2216 dvjjd.exe 34 PID 2216 wrote to memory of 2848 2216 dvjjd.exe 34 PID 2216 wrote to memory of 2848 2216 dvjjd.exe 34 PID 2848 wrote to memory of 2740 2848 rfrxrxr.exe 35 PID 2848 wrote to memory of 2740 2848 rfrxrxr.exe 35 PID 2848 wrote to memory of 2740 2848 rfrxrxr.exe 35 PID 2848 wrote to memory of 2740 2848 rfrxrxr.exe 35 PID 2740 wrote to memory of 2824 2740 bbnhhb.exe 36 PID 2740 wrote to memory of 2824 2740 bbnhhb.exe 36 PID 2740 wrote to memory of 2824 2740 bbnhhb.exe 36 PID 2740 wrote to memory of 2824 2740 bbnhhb.exe 36 PID 2824 wrote to memory of 2180 2824 lxllflr.exe 37 PID 2824 wrote to memory of 2180 2824 lxllflr.exe 37 PID 2824 wrote to memory of 2180 2824 lxllflr.exe 37 PID 2824 wrote to memory of 2180 2824 lxllflr.exe 37 PID 2180 wrote to memory of 2632 2180 jjvdv.exe 38 PID 2180 wrote to memory of 2632 2180 jjvdv.exe 38 PID 2180 wrote to memory of 2632 2180 jjvdv.exe 38 PID 2180 wrote to memory of 2632 2180 jjvdv.exe 38 PID 2632 wrote to memory of 2628 2632 lxlflff.exe 39 PID 2632 wrote to memory of 2628 2632 lxlflff.exe 39 PID 2632 wrote to memory of 2628 2632 lxlflff.exe 39 PID 2632 wrote to memory of 2628 2632 lxlflff.exe 39 PID 2628 wrote to memory of 2208 2628 btbhnn.exe 40 PID 2628 wrote to memory of 2208 2628 btbhnn.exe 40 PID 2628 wrote to memory of 2208 2628 btbhnn.exe 40 PID 2628 wrote to memory of 2208 2628 btbhnn.exe 40 PID 2208 wrote to memory of 2572 2208 rfrrflf.exe 41 PID 2208 wrote to memory of 2572 2208 rfrrflf.exe 41 PID 2208 wrote to memory of 2572 2208 rfrrflf.exe 41 PID 2208 wrote to memory of 2572 2208 rfrrflf.exe 41 PID 2572 wrote to memory of 2136 2572 bnttnn.exe 42 PID 2572 wrote to memory of 2136 2572 bnttnn.exe 42 PID 2572 wrote to memory of 2136 2572 bnttnn.exe 42 PID 2572 wrote to memory of 2136 2572 bnttnn.exe 42 PID 2136 wrote to memory of 824 2136 xxxllrl.exe 43 PID 2136 wrote to memory of 824 2136 xxxllrl.exe 43 PID 2136 wrote to memory of 824 2136 xxxllrl.exe 43 PID 2136 wrote to memory of 824 2136 xxxllrl.exe 43 PID 824 wrote to memory of 2808 824 ttbtnb.exe 44 PID 824 wrote to memory of 2808 824 ttbtnb.exe 44 PID 824 wrote to memory of 2808 824 ttbtnb.exe 44 PID 824 wrote to memory of 2808 824 ttbtnb.exe 44 PID 2808 wrote to memory of 2960 2808 llrlxlf.exe 45 PID 2808 wrote to memory of 2960 2808 llrlxlf.exe 45 PID 2808 wrote to memory of 2960 2808 llrlxlf.exe 45 PID 2808 wrote to memory of 2960 2808 llrlxlf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\858522ade56ef8346756e95f4ffc9ce5db17b6f4b7070cf92abc1d1854b78397.exe"C:\Users\Admin\AppData\Local\Temp\858522ade56ef8346756e95f4ffc9ce5db17b6f4b7070cf92abc1d1854b78397.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\rllxlrr.exec:\rllxlrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\hntttb.exec:\hntttb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\dpvjj.exec:\dpvjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\dvjjd.exec:\dvjjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\rfrxrxr.exec:\rfrxrxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\bbnhhb.exec:\bbnhhb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\lxllflr.exec:\lxllflr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\jjvdv.exec:\jjvdv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\lxlflff.exec:\lxlflff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\btbhnn.exec:\btbhnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\rfrrflf.exec:\rfrrflf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\bnttnn.exec:\bnttnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\xxxllrl.exec:\xxxllrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\ttbtnb.exec:\ttbtnb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
\??\c:\llrlxlf.exec:\llrlxlf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\7bbbbt.exec:\7bbbbt.exe17⤵
- Executes dropped EXE
PID:2960 -
\??\c:\3ffrflf.exec:\3ffrflf.exe18⤵
- Executes dropped EXE
PID:1852 -
\??\c:\7xlxxrr.exec:\7xlxxrr.exe19⤵
- Executes dropped EXE
PID:3012 -
\??\c:\rxxrrxx.exec:\rxxrrxx.exe20⤵
- Executes dropped EXE
PID:3028 -
\??\c:\bbbntb.exec:\bbbntb.exe21⤵
- Executes dropped EXE
PID:2104 -
\??\c:\1hhtht.exec:\1hhtht.exe22⤵
- Executes dropped EXE
PID:1628 -
\??\c:\1llxlfr.exec:\1llxlfr.exe23⤵
- Executes dropped EXE
PID:1072 -
\??\c:\vddjv.exec:\vddjv.exe24⤵
- Executes dropped EXE
PID:2564 -
\??\c:\3nnnbn.exec:\3nnnbn.exe25⤵
- Executes dropped EXE
PID:1044 -
\??\c:\tbhhht.exec:\tbhhht.exe26⤵
- Executes dropped EXE
PID:2544 -
\??\c:\1ppdv.exec:\1ppdv.exe27⤵
- Executes dropped EXE
PID:2444 -
\??\c:\xrxrxfr.exec:\xrxrxfr.exe28⤵
- Executes dropped EXE
PID:868 -
\??\c:\tttbth.exec:\tttbth.exe29⤵
- Executes dropped EXE
PID:1300 -
\??\c:\5ntthn.exec:\5ntthn.exe30⤵
- Executes dropped EXE
PID:1488 -
\??\c:\djjdv.exec:\djjdv.exe31⤵
- Executes dropped EXE
PID:1056 -
\??\c:\pvvpv.exec:\pvvpv.exe32⤵
- Executes dropped EXE
PID:2540 -
\??\c:\nnthhn.exec:\nnthhn.exe33⤵
- Executes dropped EXE
PID:2036 -
\??\c:\bhbntn.exec:\bhbntn.exe34⤵
- Executes dropped EXE
PID:2376 -
\??\c:\ffxllxf.exec:\ffxllxf.exe35⤵
- Executes dropped EXE
PID:1800 -
\??\c:\hhbhtb.exec:\hhbhtb.exe36⤵
- Executes dropped EXE
PID:1928 -
\??\c:\dddjv.exec:\dddjv.exe37⤵
- Executes dropped EXE
PID:1548 -
\??\c:\dvdpj.exec:\dvdpj.exe38⤵
- Executes dropped EXE
PID:2676 -
\??\c:\xfrlfrx.exec:\xfrlfrx.exe39⤵
- Executes dropped EXE
PID:2876 -
\??\c:\bbbnnb.exec:\bbbnnb.exe40⤵
- Executes dropped EXE
PID:2848 -
\??\c:\hbhnbn.exec:\hbhnbn.exe41⤵
- Executes dropped EXE
PID:1484 -
\??\c:\djddj.exec:\djddj.exe42⤵
- Executes dropped EXE
PID:2824 -
\??\c:\flrlfxx.exec:\flrlfxx.exe43⤵
- Executes dropped EXE
PID:2624 -
\??\c:\hhhtbn.exec:\hhhtbn.exe44⤵
- Executes dropped EXE
PID:2016 -
\??\c:\hhnhbn.exec:\hhnhbn.exe45⤵
- Executes dropped EXE
PID:2660 -
\??\c:\vvvvp.exec:\vvvvp.exe46⤵
- Executes dropped EXE
PID:1480 -
\??\c:\rrrffxr.exec:\rrrffxr.exe47⤵
- Executes dropped EXE
PID:2044 -
\??\c:\9fxfrfr.exec:\9fxfrfr.exe48⤵
- Executes dropped EXE
PID:2644 -
\??\c:\hhhtth.exec:\hhhtth.exe49⤵
- Executes dropped EXE
PID:2416 -
\??\c:\dddvv.exec:\dddvv.exe50⤵
- Executes dropped EXE
PID:568 -
\??\c:\vvvjd.exec:\vvvjd.exe51⤵
- Executes dropped EXE
PID:2812 -
\??\c:\lrffxlf.exec:\lrffxlf.exe52⤵
- Executes dropped EXE
PID:2944 -
\??\c:\3nbthb.exec:\3nbthb.exe53⤵
- Executes dropped EXE
PID:2488 -
\??\c:\ttnthn.exec:\ttnthn.exe54⤵
- Executes dropped EXE
PID:1848 -
\??\c:\1pvdp.exec:\1pvdp.exe55⤵
- Executes dropped EXE
PID:3008 -
\??\c:\fllxllf.exec:\fllxllf.exe56⤵
- Executes dropped EXE
PID:3004 -
\??\c:\nnnbhh.exec:\nnnbhh.exe57⤵
- Executes dropped EXE
PID:3016 -
\??\c:\ntttnb.exec:\ntttnb.exe58⤵
- Executes dropped EXE
PID:2132 -
\??\c:\vdddd.exec:\vdddd.exe59⤵
- Executes dropped EXE
PID:2100 -
\??\c:\flxxrfx.exec:\flxxrfx.exe60⤵
- Executes dropped EXE
PID:2464 -
\??\c:\fxrfffr.exec:\fxrfffr.exe61⤵
- Executes dropped EXE
PID:744 -
\??\c:\hhbnhn.exec:\hhbnhn.exe62⤵
- Executes dropped EXE
PID:3024 -
\??\c:\jjjpj.exec:\jjjpj.exe63⤵
- Executes dropped EXE
PID:1132 -
\??\c:\lrfflrx.exec:\lrfflrx.exe64⤵
- Executes dropped EXE
PID:1292 -
\??\c:\xxfrxlf.exec:\xxfrxlf.exe65⤵
- Executes dropped EXE
PID:1044 -
\??\c:\tnhnhn.exec:\tnhnhn.exe66⤵PID:1556
-
\??\c:\pvpvj.exec:\pvpvj.exe67⤵PID:1552
-
\??\c:\dvjjj.exec:\dvjjj.exe68⤵PID:2256
-
\??\c:\ffflxfr.exec:\ffflxfr.exe69⤵PID:1084
-
\??\c:\bbnhbn.exec:\bbnhbn.exe70⤵PID:1740
-
\??\c:\pppdv.exec:\pppdv.exe71⤵PID:2400
-
\??\c:\3jjvj.exec:\3jjvj.exe72⤵PID:1504
-
\??\c:\llfrfrr.exec:\llfrfrr.exe73⤵PID:1056
-
\??\c:\ttttth.exec:\ttttth.exe74⤵PID:1680
-
\??\c:\1jdjj.exec:\1jdjj.exe75⤵PID:1572
-
\??\c:\lfrlfxf.exec:\lfrlfxf.exe76⤵PID:1704
-
\??\c:\fxxrffl.exec:\fxxrffl.exe77⤵PID:2924
-
\??\c:\nbhbhb.exec:\nbhbhb.exe78⤵PID:1048
-
\??\c:\dvpvj.exec:\dvpvj.exe79⤵PID:1960
-
\??\c:\ddjpd.exec:\ddjpd.exe80⤵PID:2724
-
\??\c:\xrrrxfx.exec:\xrrrxfx.exe81⤵PID:2424
-
\??\c:\5tbnbh.exec:\5tbnbh.exe82⤵PID:2836
-
\??\c:\vjvvp.exec:\vjvvp.exe83⤵PID:3056
-
\??\c:\vjjjd.exec:\vjjjd.exe84⤵PID:2620
-
\??\c:\ffffrxl.exec:\ffffrxl.exe85⤵PID:2796
-
\??\c:\nnnnht.exec:\nnnnht.exe86⤵PID:2916
-
\??\c:\ddvpd.exec:\ddvpd.exe87⤵PID:2648
-
\??\c:\7jpvp.exec:\7jpvp.exe88⤵PID:2636
-
\??\c:\9rrffrx.exec:\9rrffrx.exe89⤵PID:2920
-
\??\c:\hhhtnh.exec:\hhhtnh.exe90⤵PID:1196
-
\??\c:\5tnbbt.exec:\5tnbbt.exe91⤵PID:2572
-
\??\c:\djpjj.exec:\djpjj.exe92⤵PID:1988
-
\??\c:\3flrlxx.exec:\3flrlxx.exe93⤵PID:1524
-
\??\c:\hnthhh.exec:\hnthhh.exe94⤵PID:2900
-
\??\c:\vjjjd.exec:\vjjjd.exe95⤵PID:2004
-
\??\c:\dvppd.exec:\dvppd.exe96⤵PID:2120
-
\??\c:\lrrxlrl.exec:\lrrxlrl.exe97⤵PID:544
-
\??\c:\5hhttn.exec:\5hhttn.exe98⤵PID:1152
-
\??\c:\ddvdv.exec:\ddvdv.exe99⤵PID:2336
-
\??\c:\ppppv.exec:\ppppv.exe100⤵PID:3036
-
\??\c:\llrfxlf.exec:\llrfxlf.exe101⤵PID:2680
-
\??\c:\bbthth.exec:\bbthth.exe102⤵PID:640
-
\??\c:\5nthht.exec:\5nthht.exe103⤵PID:2056
-
\??\c:\vvdvd.exec:\vvdvd.exe104⤵PID:2264
-
\??\c:\3lxrxrr.exec:\3lxrxrr.exe105⤵PID:1036
-
\??\c:\hnnhhb.exec:\hnnhhb.exe106⤵PID:1900
-
\??\c:\btnbnb.exec:\btnbnb.exe107⤵PID:952
-
\??\c:\djvvp.exec:\djvvp.exe108⤵PID:1388
-
\??\c:\fffrlxx.exec:\fffrlxx.exe109⤵PID:2156
-
\??\c:\frflxfl.exec:\frflxfl.exe110⤵PID:3052
-
\??\c:\hhhttb.exec:\hhhttb.exe111⤵PID:2304
-
\??\c:\dpppp.exec:\dpppp.exe112⤵PID:1084
-
\??\c:\5vpvd.exec:\5vpvd.exe113⤵PID:2804
-
\??\c:\xlxlxlx.exec:\xlxlxlx.exe114⤵PID:2196
-
\??\c:\vjpvp.exec:\vjpvp.exe115⤵PID:1372
-
\??\c:\rlfrlrl.exec:\rlfrlrl.exe116⤵PID:2248
-
\??\c:\fffrfrl.exec:\fffrfrl.exe117⤵PID:1588
-
\??\c:\7hbntb.exec:\7hbntb.exe118⤵PID:2548
-
\??\c:\vvpvj.exec:\vvpvj.exe119⤵PID:1596
-
\??\c:\vdvdv.exec:\vdvdv.exe120⤵PID:2408
-
\??\c:\xrfxxff.exec:\xrfxxff.exe121⤵PID:2492
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-