Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 09:35
Behavioral task
behavioral1
Sample
e4f42584224e4c2d0a0c28a7b40cbd1a96081f7fd71ffd13283965f63f27178c.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
e4f42584224e4c2d0a0c28a7b40cbd1a96081f7fd71ffd13283965f63f27178c.exe
-
Size
345KB
-
MD5
87a2b4f821111d88d54c35236913829c
-
SHA1
a4aff11fa7a3bc446b682cb8eafeb4e68fa62f42
-
SHA256
e4f42584224e4c2d0a0c28a7b40cbd1a96081f7fd71ffd13283965f63f27178c
-
SHA512
1578e2e2b3faf87c77b0b31b89f675aef8a05368b9d661f6087c2e6090290bbd2bf2ac53ecec49ae0f83e2df55d28f206b50556f664bd1d3145000d63fcd421d
-
SSDEEP
6144:Lcm4FmowdHoSEYW5fNZWB5hFfci3Add4kGYA8:R4wFHoS3WXZshJX2VGd8
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/1884-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2060-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2060-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2964-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3040-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2708-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2740-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2548-76-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2548-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2532-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2976-95-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2976-93-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/808-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/572-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2804-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2600-143-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/852-150-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1336-158-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/1336-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1836-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1836-169-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2236-192-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2000-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/600-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/676-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1324-248-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1240-259-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/944-272-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2132-278-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2896-286-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2592-335-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1676-362-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2816-421-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2588-433-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1076-493-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2468-495-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1644-529-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/1240-553-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1956-589-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2060 llxfllx.exe 2964 bbntbt.exe 3040 7ffllxl.exe 2712 djvvv.exe 2632 nthnhh.exe 2708 vjvvv.exe 2740 xlxlrrr.exe 2548 nhbbht.exe 2532 1dvjd.exe 2976 thtnhh.exe 1256 vvjjv.exe 808 ffrxrxl.exe 572 jddpv.exe 1868 rrrxlll.exe 2804 ttnbnt.exe 2600 9pppj.exe 852 xrflffr.exe 1336 9hbhnt.exe 1836 jdpdd.exe 1560 fxlfxxx.exe 2996 7tnttb.exe 2236 dvdvd.exe 2000 xxrfxlf.exe 2360 ppvdp.exe 2944 rflxxrl.exe 600 tttbnn.exe 676 5pjpd.exe 1252 lrxrrlf.exe 1324 jppdv.exe 1788 9nnnhn.exe 1240 pppdv.exe 944 flfrflx.exe 2132 9btbth.exe 2896 3vjvd.exe 1940 ffxrxll.exe 2240 hhhtht.exe 2584 jppdj.exe 2272 dvpvd.exe 1732 lrflrrl.exe 2292 htnbbn.exe 2592 pdvpp.exe 2880 jppvp.exe 2196 7rlxlxr.exe 2748 tttbhn.exe 2656 bnnhbn.exe 3068 djdvp.exe 2508 flrlrrx.exe 2836 hbtnhh.exe 1676 vjddj.exe 2504 vpjpv.exe 2548 frrffrr.exe 2532 1ntnht.exe 2988 7jjvv.exe 1824 5fxxflx.exe 1256 ffxfrrl.exe 576 hhthnb.exe 648 hhhbnt.exe 1484 jdvdv.exe 2816 ffrfrxl.exe 2588 xfxlxxl.exe 2336 hbthbh.exe 2868 ppvdp.exe 324 xrrrfrx.exe 1336 xxxffrf.exe -
resource yara_rule behavioral1/memory/1884-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000a00000001225c-6.dat upx behavioral1/memory/1884-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2060-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000014b28-16.dat upx behavioral1/memory/2060-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2964-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000014bda-25.dat upx behavioral1/memory/3040-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2712-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000014c23-34.dat upx behavioral1/files/0x0007000000014cde-44.dat upx behavioral1/files/0x0007000000014f7b-52.dat upx behavioral1/memory/2708-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015016-60.dat upx behavioral1/files/0x0007000000016cf8-69.dat upx behavioral1/memory/2740-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2548-78-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d11-77.dat upx behavioral1/memory/2532-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d33-86.dat upx behavioral1/files/0x0006000000016d46-94.dat upx behavioral1/memory/2976-95-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d4a-102.dat upx behavioral1/files/0x0006000000016d4e-110.dat upx behavioral1/memory/808-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016db3-118.dat upx behavioral1/memory/572-119-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016db8-127.dat upx behavioral1/files/0x0006000000016dc7-135.dat upx behavioral1/memory/2804-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016dd2-142.dat upx behavioral1/memory/2600-143-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016dd6-151.dat upx behavioral1/memory/852-150-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x003500000001487e-159.dat upx behavioral1/memory/1336-160-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1836-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1836-168-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0006000000016ee0-170.dat upx behavioral1/memory/1560-177-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0006000000017051-178.dat upx behavioral1/files/0x00060000000170b5-185.dat upx behavioral1/files/0x0006000000017546-193.dat upx behavioral1/memory/2000-202-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000175c6-201.dat upx behavioral1/files/0x00060000000175cc-210.dat upx behavioral1/files/0x00060000000175d2-217.dat upx behavioral1/memory/600-224-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0031000000018654-225.dat upx behavioral1/memory/676-233-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018669-234.dat upx behavioral1/files/0x00050000000186d2-241.dat upx behavioral1/memory/1324-248-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000186de-249.dat upx behavioral1/files/0x00050000000186ee-257.dat upx behavioral1/memory/1240-259-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001875d-265.dat upx behavioral1/memory/944-272-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2896-279-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2132-278-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2896-286-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2196-327-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2592-335-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxlrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlrxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3frxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrrlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrflrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxrlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxlxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xrxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrfllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxlxxl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1884 wrote to memory of 2060 1884 e4f42584224e4c2d0a0c28a7b40cbd1a96081f7fd71ffd13283965f63f27178c.exe 28 PID 1884 wrote to memory of 2060 1884 e4f42584224e4c2d0a0c28a7b40cbd1a96081f7fd71ffd13283965f63f27178c.exe 28 PID 1884 wrote to memory of 2060 1884 e4f42584224e4c2d0a0c28a7b40cbd1a96081f7fd71ffd13283965f63f27178c.exe 28 PID 1884 wrote to memory of 2060 1884 e4f42584224e4c2d0a0c28a7b40cbd1a96081f7fd71ffd13283965f63f27178c.exe 28 PID 2060 wrote to memory of 2964 2060 llxfllx.exe 29 PID 2060 wrote to memory of 2964 2060 llxfllx.exe 29 PID 2060 wrote to memory of 2964 2060 llxfllx.exe 29 PID 2060 wrote to memory of 2964 2060 llxfllx.exe 29 PID 2964 wrote to memory of 3040 2964 bbntbt.exe 30 PID 2964 wrote to memory of 3040 2964 bbntbt.exe 30 PID 2964 wrote to memory of 3040 2964 bbntbt.exe 30 PID 2964 wrote to memory of 3040 2964 bbntbt.exe 30 PID 3040 wrote to memory of 2712 3040 7ffllxl.exe 31 PID 3040 wrote to memory of 2712 3040 7ffllxl.exe 31 PID 3040 wrote to memory of 2712 3040 7ffllxl.exe 31 PID 3040 wrote to memory of 2712 3040 7ffllxl.exe 31 PID 2712 wrote to memory of 2632 2712 djvvv.exe 32 PID 2712 wrote to memory of 2632 2712 djvvv.exe 32 PID 2712 wrote to memory of 2632 2712 djvvv.exe 32 PID 2712 wrote to memory of 2632 2712 djvvv.exe 32 PID 2632 wrote to memory of 2708 2632 nthnhh.exe 33 PID 2632 wrote to memory of 2708 2632 nthnhh.exe 33 PID 2632 wrote to memory of 2708 2632 nthnhh.exe 33 PID 2632 wrote to memory of 2708 2632 nthnhh.exe 33 PID 2708 wrote to memory of 2740 2708 vjvvv.exe 34 PID 2708 wrote to memory of 2740 2708 vjvvv.exe 34 PID 2708 wrote to memory of 2740 2708 vjvvv.exe 34 PID 2708 wrote to memory of 2740 2708 vjvvv.exe 34 PID 2740 wrote to memory of 2548 2740 xlxlrrr.exe 35 PID 2740 wrote to memory of 2548 2740 xlxlrrr.exe 35 PID 2740 wrote to memory of 2548 2740 xlxlrrr.exe 35 PID 2740 wrote to memory of 2548 2740 xlxlrrr.exe 35 PID 2548 wrote to memory of 2532 2548 nhbbht.exe 36 PID 2548 wrote to memory of 2532 2548 nhbbht.exe 36 PID 2548 wrote to memory of 2532 2548 nhbbht.exe 36 PID 2548 wrote to memory of 2532 2548 nhbbht.exe 36 PID 2532 wrote to memory of 2976 2532 1dvjd.exe 37 PID 2532 wrote to memory of 2976 2532 1dvjd.exe 37 PID 2532 wrote to memory of 2976 2532 1dvjd.exe 37 PID 2532 wrote to memory of 2976 2532 1dvjd.exe 37 PID 2976 wrote to memory of 1256 2976 thtnhh.exe 38 PID 2976 wrote to memory of 1256 2976 thtnhh.exe 38 PID 2976 wrote to memory of 1256 2976 thtnhh.exe 38 PID 2976 wrote to memory of 1256 2976 thtnhh.exe 38 PID 1256 wrote to memory of 808 1256 vvjjv.exe 39 PID 1256 wrote to memory of 808 1256 vvjjv.exe 39 PID 1256 wrote to memory of 808 1256 vvjjv.exe 39 PID 1256 wrote to memory of 808 1256 vvjjv.exe 39 PID 808 wrote to memory of 572 808 ffrxrxl.exe 40 PID 808 wrote to memory of 572 808 ffrxrxl.exe 40 PID 808 wrote to memory of 572 808 ffrxrxl.exe 40 PID 808 wrote to memory of 572 808 ffrxrxl.exe 40 PID 572 wrote to memory of 1868 572 jddpv.exe 41 PID 572 wrote to memory of 1868 572 jddpv.exe 41 PID 572 wrote to memory of 1868 572 jddpv.exe 41 PID 572 wrote to memory of 1868 572 jddpv.exe 41 PID 1868 wrote to memory of 2804 1868 rrrxlll.exe 42 PID 1868 wrote to memory of 2804 1868 rrrxlll.exe 42 PID 1868 wrote to memory of 2804 1868 rrrxlll.exe 42 PID 1868 wrote to memory of 2804 1868 rrrxlll.exe 42 PID 2804 wrote to memory of 2600 2804 ttnbnt.exe 43 PID 2804 wrote to memory of 2600 2804 ttnbnt.exe 43 PID 2804 wrote to memory of 2600 2804 ttnbnt.exe 43 PID 2804 wrote to memory of 2600 2804 ttnbnt.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\e4f42584224e4c2d0a0c28a7b40cbd1a96081f7fd71ffd13283965f63f27178c.exe"C:\Users\Admin\AppData\Local\Temp\e4f42584224e4c2d0a0c28a7b40cbd1a96081f7fd71ffd13283965f63f27178c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\llxfllx.exec:\llxfllx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\bbntbt.exec:\bbntbt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\7ffllxl.exec:\7ffllxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\djvvv.exec:\djvvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\nthnhh.exec:\nthnhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\vjvvv.exec:\vjvvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\xlxlrrr.exec:\xlxlrrr.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\nhbbht.exec:\nhbbht.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\1dvjd.exec:\1dvjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\thtnhh.exec:\thtnhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\vvjjv.exec:\vvjjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
\??\c:\ffrxrxl.exec:\ffrxrxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
\??\c:\jddpv.exec:\jddpv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:572 -
\??\c:\rrrxlll.exec:\rrrxlll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\ttnbnt.exec:\ttnbnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\9pppj.exec:\9pppj.exe17⤵
- Executes dropped EXE
PID:2600 -
\??\c:\xrflffr.exec:\xrflffr.exe18⤵
- Executes dropped EXE
PID:852 -
\??\c:\9hbhnt.exec:\9hbhnt.exe19⤵
- Executes dropped EXE
PID:1336 -
\??\c:\jdpdd.exec:\jdpdd.exe20⤵
- Executes dropped EXE
PID:1836 -
\??\c:\fxlfxxx.exec:\fxlfxxx.exe21⤵
- Executes dropped EXE
PID:1560 -
\??\c:\7tnttb.exec:\7tnttb.exe22⤵
- Executes dropped EXE
PID:2996 -
\??\c:\dvdvd.exec:\dvdvd.exe23⤵
- Executes dropped EXE
PID:2236 -
\??\c:\xxrfxlf.exec:\xxrfxlf.exe24⤵
- Executes dropped EXE
PID:2000 -
\??\c:\ppvdp.exec:\ppvdp.exe25⤵
- Executes dropped EXE
PID:2360 -
\??\c:\rflxxrl.exec:\rflxxrl.exe26⤵
- Executes dropped EXE
PID:2944 -
\??\c:\tttbnn.exec:\tttbnn.exe27⤵
- Executes dropped EXE
PID:600 -
\??\c:\5pjpd.exec:\5pjpd.exe28⤵
- Executes dropped EXE
PID:676 -
\??\c:\lrxrrlf.exec:\lrxrrlf.exe29⤵
- Executes dropped EXE
PID:1252 -
\??\c:\jppdv.exec:\jppdv.exe30⤵
- Executes dropped EXE
PID:1324 -
\??\c:\9nnnhn.exec:\9nnnhn.exe31⤵
- Executes dropped EXE
PID:1788 -
\??\c:\pppdv.exec:\pppdv.exe32⤵
- Executes dropped EXE
PID:1240 -
\??\c:\flfrflx.exec:\flfrflx.exe33⤵
- Executes dropped EXE
PID:944 -
\??\c:\9btbth.exec:\9btbth.exe34⤵
- Executes dropped EXE
PID:2132 -
\??\c:\3vjvd.exec:\3vjvd.exe35⤵
- Executes dropped EXE
PID:2896 -
\??\c:\ffxrxll.exec:\ffxrxll.exe36⤵
- Executes dropped EXE
PID:1940 -
\??\c:\hhhtht.exec:\hhhtht.exe37⤵
- Executes dropped EXE
PID:2240 -
\??\c:\jppdj.exec:\jppdj.exe38⤵
- Executes dropped EXE
PID:2584 -
\??\c:\dvpvd.exec:\dvpvd.exe39⤵
- Executes dropped EXE
PID:2272 -
\??\c:\lrflrrl.exec:\lrflrrl.exe40⤵
- Executes dropped EXE
PID:1732 -
\??\c:\htnbbn.exec:\htnbbn.exe41⤵
- Executes dropped EXE
PID:2292 -
\??\c:\pdvpp.exec:\pdvpp.exe42⤵
- Executes dropped EXE
PID:2592 -
\??\c:\jppvp.exec:\jppvp.exe43⤵
- Executes dropped EXE
PID:2880 -
\??\c:\7rlxlxr.exec:\7rlxlxr.exe44⤵
- Executes dropped EXE
PID:2196 -
\??\c:\tttbhn.exec:\tttbhn.exe45⤵
- Executes dropped EXE
PID:2748 -
\??\c:\bnnhbn.exec:\bnnhbn.exe46⤵
- Executes dropped EXE
PID:2656 -
\??\c:\djdvp.exec:\djdvp.exe47⤵
- Executes dropped EXE
PID:3068 -
\??\c:\flrlrrx.exec:\flrlrrx.exe48⤵
- Executes dropped EXE
PID:2508 -
\??\c:\hbtnhh.exec:\hbtnhh.exe49⤵
- Executes dropped EXE
PID:2836 -
\??\c:\vjddj.exec:\vjddj.exe50⤵
- Executes dropped EXE
PID:1676 -
\??\c:\vpjpv.exec:\vpjpv.exe51⤵
- Executes dropped EXE
PID:2504 -
\??\c:\frrffrr.exec:\frrffrr.exe52⤵
- Executes dropped EXE
PID:2548 -
\??\c:\1ntnht.exec:\1ntnht.exe53⤵
- Executes dropped EXE
PID:2532 -
\??\c:\7jjvv.exec:\7jjvv.exe54⤵
- Executes dropped EXE
PID:2988 -
\??\c:\5fxxflx.exec:\5fxxflx.exe55⤵
- Executes dropped EXE
PID:1824 -
\??\c:\ffxfrrl.exec:\ffxfrrl.exe56⤵
- Executes dropped EXE
PID:1256 -
\??\c:\hhthnb.exec:\hhthnb.exe57⤵
- Executes dropped EXE
PID:576 -
\??\c:\hhhbnt.exec:\hhhbnt.exe58⤵
- Executes dropped EXE
PID:648 -
\??\c:\jdvdv.exec:\jdvdv.exe59⤵
- Executes dropped EXE
PID:1484 -
\??\c:\ffrfrxl.exec:\ffrfrxl.exe60⤵
- Executes dropped EXE
PID:2816 -
\??\c:\xfxlxxl.exec:\xfxlxxl.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2588 -
\??\c:\hbthbh.exec:\hbthbh.exe62⤵
- Executes dropped EXE
PID:2336 -
\??\c:\ppvdp.exec:\ppvdp.exe63⤵
- Executes dropped EXE
PID:2868 -
\??\c:\xrrrfrx.exec:\xrrrfrx.exe64⤵
- Executes dropped EXE
PID:324 -
\??\c:\xxxffrf.exec:\xxxffrf.exe65⤵
- Executes dropped EXE
PID:1336 -
\??\c:\ttnhnb.exec:\ttnhnb.exe66⤵PID:1836
-
\??\c:\1jvjd.exec:\1jvjd.exe67⤵PID:1076
-
\??\c:\xxxrfrf.exec:\xxxrfrf.exe68⤵PID:2472
-
\??\c:\ffxrlxf.exec:\ffxrlxf.exe69⤵PID:1988
-
\??\c:\tbtbtb.exec:\tbtbtb.exe70⤵PID:1992
-
\??\c:\ntntbb.exec:\ntntbb.exe71⤵PID:2468
-
\??\c:\ddjpd.exec:\ddjpd.exe72⤵PID:1796
-
\??\c:\xfrfxfx.exec:\xfrfxfx.exe73⤵PID:2900
-
\??\c:\bbthth.exec:\bbthth.exe74⤵PID:2356
-
\??\c:\9bbnbh.exec:\9bbnbh.exe75⤵PID:2160
-
\??\c:\vpddv.exec:\vpddv.exe76⤵PID:316
-
\??\c:\jjjvp.exec:\jjjvp.exe77⤵PID:1644
-
\??\c:\lffrflx.exec:\lffrflx.exe78⤵PID:1252
-
\??\c:\thnhhh.exec:\thnhhh.exe79⤵PID:1324
-
\??\c:\vvvdd.exec:\vvvdd.exe80⤵PID:812
-
\??\c:\ddjdp.exec:\ddjdp.exe81⤵PID:1240
-
\??\c:\llllfrf.exec:\llllfrf.exe82⤵PID:928
-
\??\c:\fxllrrf.exec:\fxllrrf.exe83⤵PID:2328
-
\??\c:\ttthbb.exec:\ttthbb.exe84⤵PID:1652
-
\??\c:\dpddp.exec:\dpddp.exe85⤵PID:2084
-
\??\c:\rxlfrrr.exec:\rxlfrrr.exe86⤵PID:892
-
\??\c:\ttntnt.exec:\ttntnt.exe87⤵PID:1956
-
\??\c:\thtbhh.exec:\thtbhh.exe88⤵PID:2284
-
\??\c:\vpjpv.exec:\vpjpv.exe89⤵PID:1736
-
\??\c:\rllrlfr.exec:\rllrlfr.exe90⤵PID:3044
-
\??\c:\7rxfxfr.exec:\7rxfxfr.exe91⤵PID:2644
-
\??\c:\tbthnn.exec:\tbthnn.exe92⤵PID:2228
-
\??\c:\jpdvd.exec:\jpdvd.exe93⤵PID:2760
-
\??\c:\xxrrxxr.exec:\xxrrxxr.exe94⤵PID:2716
-
\??\c:\9xflxll.exec:\9xflxll.exe95⤵PID:2652
-
\??\c:\nttnnt.exec:\nttnnt.exe96⤵PID:2704
-
\??\c:\9tbnbn.exec:\9tbnbn.exe97⤵PID:2848
-
\??\c:\vvpjv.exec:\vvpjv.exe98⤵PID:2840
-
\??\c:\rrrlflf.exec:\rrrlflf.exe99⤵PID:1340
-
\??\c:\7tnbnb.exec:\7tnbnb.exe100⤵PID:2564
-
\??\c:\tttbnb.exec:\tttbnb.exe101⤵PID:2576
-
\??\c:\pjjpd.exec:\pjjpd.exe102⤵PID:3004
-
\??\c:\jjpvv.exec:\jjpvv.exe103⤵PID:2784
-
\??\c:\flrflfr.exec:\flrflfr.exe104⤵PID:792
-
\??\c:\9ntnbn.exec:\9ntnbn.exe105⤵PID:896
-
\??\c:\ttthbn.exec:\ttthbn.exe106⤵PID:704
-
\??\c:\jdvjd.exec:\jdvjd.exe107⤵PID:2736
-
\??\c:\xrffxfx.exec:\xrffxfx.exe108⤵PID:572
-
\??\c:\rrrrlrf.exec:\rrrrlrf.exe109⤵
- System Location Discovery: System Language Discovery
PID:2808 -
\??\c:\9bbnbn.exec:\9bbnbn.exe110⤵PID:1932
-
\??\c:\hnntbn.exec:\hnntbn.exe111⤵PID:2588
-
\??\c:\dddjp.exec:\dddjp.exe112⤵PID:764
-
\??\c:\xxxffxl.exec:\xxxffxl.exe113⤵PID:1812
-
\??\c:\lrxlrfr.exec:\lrxlrfr.exe114⤵PID:2036
-
\??\c:\bttbnn.exec:\bttbnn.exe115⤵PID:1764
-
\??\c:\1hbhtb.exec:\1hbhtb.exe116⤵PID:1508
-
\??\c:\vdvdp.exec:\vdvdp.exe117⤵PID:2996
-
\??\c:\ffrfrrf.exec:\ffrfrrf.exe118⤵PID:1080
-
\??\c:\ffffxxr.exec:\ffffxxr.exe119⤵PID:2236
-
\??\c:\tnbntb.exec:\tnbntb.exe120⤵PID:2100
-
\??\c:\btnbnt.exec:\btnbnt.exe121⤵PID:1776
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-