Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 09:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
11a9129695ceaa7e8416397242fd42786f8857cef71cb767976d89ad273a2688.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
11a9129695ceaa7e8416397242fd42786f8857cef71cb767976d89ad273a2688.exe
-
Size
455KB
-
MD5
73840ae348c002e76799d16e9cb1ec38
-
SHA1
1085bb6307d1fc9c075fabfb1b279e1009813be3
-
SHA256
11a9129695ceaa7e8416397242fd42786f8857cef71cb767976d89ad273a2688
-
SHA512
2f0a6ede90d4cba102fb3bac83373c0d671d014ca422559ef2081f81f4a0ee1b35c715425f543190274060787cb965e161bcebffc87a56e3bbae32c87d14018b
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeJ:q7Tc2NYHUrAwfMp3CDJ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/1852-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1764-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/880-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2284-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2284-43-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2692-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-82-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2832-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-121-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1368-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-156-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2824-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1880-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2452-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2056-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1512-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1640-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1640-228-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1428-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-341-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2840-344-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2840-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-412-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1728-420-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-427-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/3056-440-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/704-478-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1856-485-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/816-498-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/352-524-0x0000000001C70000-0x0000000001C9A000-memory.dmp family_blackmoon behavioral1/memory/3000-544-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1548-689-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/348-765-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/888-785-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2900-822-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2088-837-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2568-863-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2960-1044-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-1250-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1760-1317-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1764 nnntht.exe 880 flrlrfr.exe 2940 vpvdd.exe 2284 ffxflrl.exe 2808 hhthtb.exe 2692 djjpj.exe 2904 fllflxr.exe 2832 bbtbnn.exe 2732 rrlfffr.exe 2680 nbhttt.exe 3048 rlfrfxr.exe 2628 tnhnhn.exe 2888 ddppj.exe 1368 flfrflf.exe 2756 vdvjd.exe 2824 rlxfrrl.exe 1880 bnbttn.exe 2600 lffrflx.exe 2452 nnbhhh.exe 2056 xrllflx.exe 2196 3bbhnt.exe 1564 rllrlxl.exe 1512 btnbnh.exe 1640 vdvjj.exe 1688 5fflxfx.exe 1424 nhbhtb.exe 2340 3xrxrxl.exe 2252 lfrxfrf.exe 2072 jvpvp.exe 2348 nhbthb.exe 2076 ddjjp.exe 2492 xxxfrff.exe 1428 dddjv.exe 2364 ppjvp.exe 2664 ffxlrfx.exe 2192 btntth.exe 2860 vvppd.exe 2816 rffrxfr.exe 2880 xxfrfxf.exe 2840 bthhhn.exe 2760 dvvdp.exe 2580 ffrxlrl.exe 2732 3bnthh.exe 2876 djvjp.exe 1808 ddpdj.exe 2772 3fxxrxl.exe 2928 3nntbh.exe 2888 pvpjj.exe 548 vppdp.exe 2784 rlxrxfl.exe 1728 hbttht.exe 2892 7jppd.exe 1996 7pjpj.exe 3056 lfxxlrx.exe 3028 hbtbtt.exe 2392 bttthn.exe 2208 pjdvj.exe 1948 rxrfrxr.exe 1448 rlflxfx.exe 704 bhhbth.exe 1856 1ppvj.exe 1748 fxrxflr.exe 816 bbbntb.exe 1544 bbtbnn.exe -
resource yara_rule behavioral1/memory/1852-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/880-26-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/880-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1368-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1880-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1880-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1512-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1640-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1424-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1428-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-344-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2840-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1448-465-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/704-478-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1856-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/816-498-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/324-525-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-544-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-557-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-601-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-620-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-629-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1548-682-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1548-689-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-702-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/348-758-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/348-765-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-822-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2860-844-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-888-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-913-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-932-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1992-939-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/964-994-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/796-1037-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-1044-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-1051-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-1112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-1144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-1151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-1224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-1324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-1337-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrlrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrxlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7htbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rxxlxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5llrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hhnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ttbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfrrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxlfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1852 wrote to memory of 1764 1852 11a9129695ceaa7e8416397242fd42786f8857cef71cb767976d89ad273a2688.exe 31 PID 1852 wrote to memory of 1764 1852 11a9129695ceaa7e8416397242fd42786f8857cef71cb767976d89ad273a2688.exe 31 PID 1852 wrote to memory of 1764 1852 11a9129695ceaa7e8416397242fd42786f8857cef71cb767976d89ad273a2688.exe 31 PID 1852 wrote to memory of 1764 1852 11a9129695ceaa7e8416397242fd42786f8857cef71cb767976d89ad273a2688.exe 31 PID 1764 wrote to memory of 880 1764 nnntht.exe 32 PID 1764 wrote to memory of 880 1764 nnntht.exe 32 PID 1764 wrote to memory of 880 1764 nnntht.exe 32 PID 1764 wrote to memory of 880 1764 nnntht.exe 32 PID 880 wrote to memory of 2940 880 flrlrfr.exe 33 PID 880 wrote to memory of 2940 880 flrlrfr.exe 33 PID 880 wrote to memory of 2940 880 flrlrfr.exe 33 PID 880 wrote to memory of 2940 880 flrlrfr.exe 33 PID 2940 wrote to memory of 2284 2940 vpvdd.exe 34 PID 2940 wrote to memory of 2284 2940 vpvdd.exe 34 PID 2940 wrote to memory of 2284 2940 vpvdd.exe 34 PID 2940 wrote to memory of 2284 2940 vpvdd.exe 34 PID 2284 wrote to memory of 2808 2284 ffxflrl.exe 35 PID 2284 wrote to memory of 2808 2284 ffxflrl.exe 35 PID 2284 wrote to memory of 2808 2284 ffxflrl.exe 35 PID 2284 wrote to memory of 2808 2284 ffxflrl.exe 35 PID 2808 wrote to memory of 2692 2808 hhthtb.exe 36 PID 2808 wrote to memory of 2692 2808 hhthtb.exe 36 PID 2808 wrote to memory of 2692 2808 hhthtb.exe 36 PID 2808 wrote to memory of 2692 2808 hhthtb.exe 36 PID 2692 wrote to memory of 2904 2692 djjpj.exe 37 PID 2692 wrote to memory of 2904 2692 djjpj.exe 37 PID 2692 wrote to memory of 2904 2692 djjpj.exe 37 PID 2692 wrote to memory of 2904 2692 djjpj.exe 37 PID 2904 wrote to memory of 2832 2904 fllflxr.exe 38 PID 2904 wrote to memory of 2832 2904 fllflxr.exe 38 PID 2904 wrote to memory of 2832 2904 fllflxr.exe 38 PID 2904 wrote to memory of 2832 2904 fllflxr.exe 38 PID 2832 wrote to memory of 2732 2832 bbtbnn.exe 39 PID 2832 wrote to memory of 2732 2832 bbtbnn.exe 39 PID 2832 wrote to memory of 2732 2832 bbtbnn.exe 39 PID 2832 wrote to memory of 2732 2832 bbtbnn.exe 39 PID 2732 wrote to memory of 2680 2732 rrlfffr.exe 40 PID 2732 wrote to memory of 2680 2732 rrlfffr.exe 40 PID 2732 wrote to memory of 2680 2732 rrlfffr.exe 40 PID 2732 wrote to memory of 2680 2732 rrlfffr.exe 40 PID 2680 wrote to memory of 3048 2680 nbhttt.exe 41 PID 2680 wrote to memory of 3048 2680 nbhttt.exe 41 PID 2680 wrote to memory of 3048 2680 nbhttt.exe 41 PID 2680 wrote to memory of 3048 2680 nbhttt.exe 41 PID 3048 wrote to memory of 2628 3048 rlfrfxr.exe 42 PID 3048 wrote to memory of 2628 3048 rlfrfxr.exe 42 PID 3048 wrote to memory of 2628 3048 rlfrfxr.exe 42 PID 3048 wrote to memory of 2628 3048 rlfrfxr.exe 42 PID 2628 wrote to memory of 2888 2628 tnhnhn.exe 43 PID 2628 wrote to memory of 2888 2628 tnhnhn.exe 43 PID 2628 wrote to memory of 2888 2628 tnhnhn.exe 43 PID 2628 wrote to memory of 2888 2628 tnhnhn.exe 43 PID 2888 wrote to memory of 1368 2888 ddppj.exe 44 PID 2888 wrote to memory of 1368 2888 ddppj.exe 44 PID 2888 wrote to memory of 1368 2888 ddppj.exe 44 PID 2888 wrote to memory of 1368 2888 ddppj.exe 44 PID 1368 wrote to memory of 2756 1368 flfrflf.exe 45 PID 1368 wrote to memory of 2756 1368 flfrflf.exe 45 PID 1368 wrote to memory of 2756 1368 flfrflf.exe 45 PID 1368 wrote to memory of 2756 1368 flfrflf.exe 45 PID 2756 wrote to memory of 2824 2756 vdvjd.exe 46 PID 2756 wrote to memory of 2824 2756 vdvjd.exe 46 PID 2756 wrote to memory of 2824 2756 vdvjd.exe 46 PID 2756 wrote to memory of 2824 2756 vdvjd.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\11a9129695ceaa7e8416397242fd42786f8857cef71cb767976d89ad273a2688.exe"C:\Users\Admin\AppData\Local\Temp\11a9129695ceaa7e8416397242fd42786f8857cef71cb767976d89ad273a2688.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\nnntht.exec:\nnntht.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\flrlrfr.exec:\flrlrfr.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:880 -
\??\c:\vpvdd.exec:\vpvdd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\ffxflrl.exec:\ffxflrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\hhthtb.exec:\hhthtb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\djjpj.exec:\djjpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\fllflxr.exec:\fllflxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\bbtbnn.exec:\bbtbnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\rrlfffr.exec:\rrlfffr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\nbhttt.exec:\nbhttt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\rlfrfxr.exec:\rlfrfxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\tnhnhn.exec:\tnhnhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\ddppj.exec:\ddppj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\flfrflf.exec:\flfrflf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
\??\c:\vdvjd.exec:\vdvjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\rlxfrrl.exec:\rlxfrrl.exe17⤵
- Executes dropped EXE
PID:2824 -
\??\c:\bnbttn.exec:\bnbttn.exe18⤵
- Executes dropped EXE
PID:1880 -
\??\c:\lffrflx.exec:\lffrflx.exe19⤵
- Executes dropped EXE
PID:2600 -
\??\c:\nnbhhh.exec:\nnbhhh.exe20⤵
- Executes dropped EXE
PID:2452 -
\??\c:\xrllflx.exec:\xrllflx.exe21⤵
- Executes dropped EXE
PID:2056 -
\??\c:\3bbhnt.exec:\3bbhnt.exe22⤵
- Executes dropped EXE
PID:2196 -
\??\c:\rllrlxl.exec:\rllrlxl.exe23⤵
- Executes dropped EXE
PID:1564 -
\??\c:\btnbnh.exec:\btnbnh.exe24⤵
- Executes dropped EXE
PID:1512 -
\??\c:\vdvjj.exec:\vdvjj.exe25⤵
- Executes dropped EXE
PID:1640 -
\??\c:\5fflxfx.exec:\5fflxfx.exe26⤵
- Executes dropped EXE
PID:1688 -
\??\c:\nhbhtb.exec:\nhbhtb.exe27⤵
- Executes dropped EXE
PID:1424 -
\??\c:\3xrxrxl.exec:\3xrxrxl.exe28⤵
- Executes dropped EXE
PID:2340 -
\??\c:\lfrxfrf.exec:\lfrxfrf.exe29⤵
- Executes dropped EXE
PID:2252 -
\??\c:\jvpvp.exec:\jvpvp.exe30⤵
- Executes dropped EXE
PID:2072 -
\??\c:\nhbthb.exec:\nhbthb.exe31⤵
- Executes dropped EXE
PID:2348 -
\??\c:\ddjjp.exec:\ddjjp.exe32⤵
- Executes dropped EXE
PID:2076 -
\??\c:\xxxfrff.exec:\xxxfrff.exe33⤵
- Executes dropped EXE
PID:2492 -
\??\c:\dddjv.exec:\dddjv.exe34⤵
- Executes dropped EXE
PID:1428 -
\??\c:\ppjvp.exec:\ppjvp.exe35⤵
- Executes dropped EXE
PID:2364 -
\??\c:\ffxlrfx.exec:\ffxlrfx.exe36⤵
- Executes dropped EXE
PID:2664 -
\??\c:\btntth.exec:\btntth.exe37⤵
- Executes dropped EXE
PID:2192 -
\??\c:\vvppd.exec:\vvppd.exe38⤵
- Executes dropped EXE
PID:2860 -
\??\c:\rffrxfr.exec:\rffrxfr.exe39⤵
- Executes dropped EXE
PID:2816 -
\??\c:\xxfrfxf.exec:\xxfrfxf.exe40⤵
- Executes dropped EXE
PID:2880 -
\??\c:\bthhhn.exec:\bthhhn.exe41⤵
- Executes dropped EXE
PID:2840 -
\??\c:\dvvdp.exec:\dvvdp.exe42⤵
- Executes dropped EXE
PID:2760 -
\??\c:\ffrxlrl.exec:\ffrxlrl.exe43⤵
- Executes dropped EXE
PID:2580 -
\??\c:\3bnthh.exec:\3bnthh.exe44⤵
- Executes dropped EXE
PID:2732 -
\??\c:\djvjp.exec:\djvjp.exe45⤵
- Executes dropped EXE
PID:2876 -
\??\c:\ddpdj.exec:\ddpdj.exe46⤵
- Executes dropped EXE
PID:1808 -
\??\c:\3fxxrxl.exec:\3fxxrxl.exe47⤵
- Executes dropped EXE
PID:2772 -
\??\c:\3nntbh.exec:\3nntbh.exe48⤵
- Executes dropped EXE
PID:2928 -
\??\c:\pvpjj.exec:\pvpjj.exe49⤵
- Executes dropped EXE
PID:2888 -
\??\c:\vppdp.exec:\vppdp.exe50⤵
- Executes dropped EXE
PID:548 -
\??\c:\rlxrxfl.exec:\rlxrxfl.exe51⤵
- Executes dropped EXE
PID:2784 -
\??\c:\hbttht.exec:\hbttht.exe52⤵
- Executes dropped EXE
PID:1728 -
\??\c:\7jppd.exec:\7jppd.exe53⤵
- Executes dropped EXE
PID:2892 -
\??\c:\7pjpj.exec:\7pjpj.exe54⤵
- Executes dropped EXE
PID:1996 -
\??\c:\lfxxlrx.exec:\lfxxlrx.exe55⤵
- Executes dropped EXE
PID:3056 -
\??\c:\hbtbtt.exec:\hbtbtt.exe56⤵
- Executes dropped EXE
PID:3028 -
\??\c:\bttthn.exec:\bttthn.exe57⤵
- Executes dropped EXE
PID:2392 -
\??\c:\pjdvj.exec:\pjdvj.exe58⤵
- Executes dropped EXE
PID:2208 -
\??\c:\rxrfrxr.exec:\rxrfrxr.exe59⤵
- Executes dropped EXE
PID:1948 -
\??\c:\rlflxfx.exec:\rlflxfx.exe60⤵
- Executes dropped EXE
PID:1448 -
\??\c:\bhhbth.exec:\bhhbth.exe61⤵
- Executes dropped EXE
PID:704 -
\??\c:\1ppvj.exec:\1ppvj.exe62⤵
- Executes dropped EXE
PID:1856 -
\??\c:\fxrxflr.exec:\fxrxflr.exe63⤵
- Executes dropped EXE
PID:1748 -
\??\c:\bbbntb.exec:\bbbntb.exe64⤵
- Executes dropped EXE
PID:816 -
\??\c:\bbtbnn.exec:\bbtbnn.exe65⤵
- Executes dropped EXE
PID:1544 -
\??\c:\vdjpj.exec:\vdjpj.exe66⤵PID:2408
-
\??\c:\rrlrflx.exec:\rrlrflx.exe67⤵PID:624
-
\??\c:\hbnthn.exec:\hbnthn.exe68⤵PID:352
-
\??\c:\9hhtnt.exec:\9hhtnt.exe69⤵PID:324
-
\??\c:\jvvvd.exec:\jvvvd.exe70⤵PID:2072
-
\??\c:\ffffxxl.exec:\ffffxxl.exe71⤵PID:3000
-
\??\c:\ttthtb.exec:\ttthtb.exe72⤵PID:1224
-
\??\c:\5bbnnt.exec:\5bbnnt.exe73⤵PID:2332
-
\??\c:\9jjvd.exec:\9jjvd.exe74⤵PID:2640
-
\??\c:\fxxfrxx.exec:\fxxfrxx.exe75⤵PID:2896
-
\??\c:\3xfrfrl.exec:\3xfrfrl.exe76⤵PID:2364
-
\??\c:\3bnnth.exec:\3bnnth.exe77⤵PID:2284
-
\??\c:\jjvdp.exec:\jjvdp.exe78⤵PID:2864
-
\??\c:\vdvdp.exec:\vdvdp.exe79⤵PID:2812
-
\??\c:\fxrfxlr.exec:\fxrfxlr.exe80⤵PID:2744
-
\??\c:\tnhhbb.exec:\tnhhbb.exe81⤵PID:2012
-
\??\c:\jjdvj.exec:\jjdvj.exe82⤵PID:2828
-
\??\c:\5pddd.exec:\5pddd.exe83⤵PID:2916
-
\??\c:\1fllrxl.exec:\1fllrxl.exe84⤵PID:2560
-
\??\c:\nhbhtb.exec:\nhbhtb.exe85⤵PID:2140
-
\??\c:\nhbhnt.exec:\nhbhnt.exe86⤵PID:3052
-
\??\c:\pppdv.exec:\pppdv.exe87⤵PID:2920
-
\??\c:\fxrrffx.exec:\fxrrffx.exe88⤵PID:2628
-
\??\c:\nhbhhb.exec:\nhbhhb.exe89⤵PID:792
-
\??\c:\3vvvd.exec:\3vvvd.exe90⤵PID:320
-
\??\c:\jjdjp.exec:\jjdjp.exe91⤵PID:484
-
\??\c:\fxrxlrl.exec:\fxrxlrl.exe92⤵PID:1976
-
\??\c:\bnnbtb.exec:\bnnbtb.exe93⤵PID:1060
-
\??\c:\ntbbnn.exec:\ntbbnn.exe94⤵PID:1548
-
\??\c:\pppjd.exec:\pppjd.exe95⤵PID:2008
-
\??\c:\7xxflxf.exec:\7xxflxf.exe96⤵PID:3060
-
\??\c:\hhtnbt.exec:\hhtnbt.exe97⤵PID:2200
-
\??\c:\9bnhtb.exec:\9bnhtb.exe98⤵PID:2384
-
\??\c:\vppdd.exec:\vppdd.exe99⤵PID:2100
-
\??\c:\llfxflx.exec:\llfxflx.exe100⤵PID:444
-
\??\c:\rrrxlfr.exec:\rrrxlfr.exe101⤵PID:2196
-
\??\c:\tnnbnb.exec:\tnnbnb.exe102⤵PID:1312
-
\??\c:\vddvv.exec:\vddvv.exe103⤵PID:1196
-
\??\c:\3lfxllx.exec:\3lfxllx.exe104⤵PID:1956
-
\??\c:\7xlrxxf.exec:\7xlrxxf.exe105⤵PID:1588
-
\??\c:\hhtnbh.exec:\hhtnbh.exe106⤵PID:348
-
\??\c:\ppjvj.exec:\ppjvj.exe107⤵PID:1424
-
\??\c:\rlrlxfr.exec:\rlrlxfr.exe108⤵PID:2232
-
\??\c:\5xxlxxl.exec:\5xxlxxl.exe109⤵PID:888
-
\??\c:\nhbnbh.exec:\nhbnbh.exe110⤵PID:676
-
\??\c:\vppjv.exec:\vppjv.exe111⤵PID:1852
-
\??\c:\fxrxrrl.exec:\fxrxrrl.exe112⤵PID:1504
-
\??\c:\1nbhhh.exec:\1nbhhh.exe113⤵PID:3000
-
\??\c:\bbnnhn.exec:\bbnnhn.exe114⤵PID:2500
-
\??\c:\7dvvd.exec:\7dvvd.exe115⤵PID:2900
-
\??\c:\llxflxx.exec:\llxflxx.exe116⤵PID:1900
-
\??\c:\rrlfrrl.exec:\rrlfrrl.exe117⤵PID:2088
-
\??\c:\ttnhtt.exec:\ttnhtt.exe118⤵PID:2852
-
\??\c:\9jddp.exec:\9jddp.exe119⤵PID:2860
-
\??\c:\jvdpd.exec:\jvdpd.exe120⤵PID:2712
-
\??\c:\fxrxlrl.exec:\fxrxlrl.exe121⤵
- System Location Discovery: System Language Discovery
PID:2568
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-