Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 20:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
98b4a726ec08d483ff06aa31e91a7cef621e5ab3e76ce6023158ef016e0c4be6N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
98b4a726ec08d483ff06aa31e91a7cef621e5ab3e76ce6023158ef016e0c4be6N.exe
-
Size
453KB
-
MD5
ae0c8696e320fcc071dc4fe3e0c0cd00
-
SHA1
c23d284ee60f45744e16b9143e66cdeab0464c41
-
SHA256
98b4a726ec08d483ff06aa31e91a7cef621e5ab3e76ce6023158ef016e0c4be6
-
SHA512
6317afdfff2565b284670f41f7379a083792e35721d4b4014b43bcb55f053830d363a7242ad167989e7c33cb0d3945fc87d0188853078cb1fa08c95e3029e20d
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe9:q7Tc2NYHUrAwfMp3CD9
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/1672-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2528-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/776-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1484-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1864-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2340-156-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2340-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-229-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2396-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2436-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1576-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/944-411-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2560-433-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1752-446-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/792-516-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1548-529-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2320-570-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1256-585-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-611-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-625-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2548-658-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2540-712-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1964-764-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-770-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2952-842-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2692-875-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1344-890-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2184 pjdjv.exe 2640 nbnnbh.exe 2816 pjddp.exe 2916 9htbhh.exe 2528 lxrxlrf.exe 2548 5xllrxl.exe 2516 dvdvd.exe 2988 lfrxffl.exe 2544 hhttbb.exe 776 1vjpv.exe 1484 ffrlfrx.exe 1864 bbnthn.exe 2892 xlffrxl.exe 3024 bthntn.exe 2752 fxrrxfl.exe 2340 7btthn.exe 2744 vdpvd.exe 1736 xxlrfrx.exe 1828 dvjdp.exe 852 5rllxxf.exe 2152 btntth.exe 2392 7ddpp.exe 2364 7nbthh.exe 1400 bbnthn.exe 2944 vvjjp.exe 1000 rlfxflr.exe 1328 pjjpd.exe 2004 xrlrfxl.exe 620 jjjvj.exe 2396 rrrxflr.exe 1768 btnnnt.exe 1956 dvddp.exe 1508 hthhtb.exe 2436 ttntnn.exe 1576 jdpvv.exe 2256 ffrxlll.exe 2708 htbbbh.exe 2796 pdpvd.exe 2624 9rfrlll.exe 2824 5ffrxlx.exe 2616 tnbbnh.exe 2680 1dppv.exe 2800 fxlxfrf.exe 2564 nbhhnn.exe 2792 bthnbh.exe 2996 1vvjp.exe 2544 lxrxflr.exe 604 hbtbhn.exe 596 vpjvd.exe 1488 pjjjj.exe 944 3frrlfl.exe 3012 thtnnn.exe 2892 pdvpd.exe 2560 9jddp.exe 2084 1xrrxfl.exe 1752 tbbtht.exe 1316 jvjdd.exe 2748 dvjpj.exe 2732 xfrrxfl.exe 808 tnbhnt.exe 1984 pdvvd.exe 2484 jpjjp.exe 2112 ffrxfxr.exe 2092 3tthnt.exe -
resource yara_rule behavioral1/memory/1672-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/776-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1484-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1864-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1576-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/944-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-418-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-446-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/792-516-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-556-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-570-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1256-585-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-611-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-644-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-651-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-658-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/3004-665-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-693-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-712-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1028-745-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-764-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-770-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2924-829-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-842-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/3056-862-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-875-0x0000000000220000-0x000000000024A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrlrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frffffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlflxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrllrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xlflll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrlllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9htbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xlrffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1672 wrote to memory of 2184 1672 98b4a726ec08d483ff06aa31e91a7cef621e5ab3e76ce6023158ef016e0c4be6N.exe 28 PID 1672 wrote to memory of 2184 1672 98b4a726ec08d483ff06aa31e91a7cef621e5ab3e76ce6023158ef016e0c4be6N.exe 28 PID 1672 wrote to memory of 2184 1672 98b4a726ec08d483ff06aa31e91a7cef621e5ab3e76ce6023158ef016e0c4be6N.exe 28 PID 1672 wrote to memory of 2184 1672 98b4a726ec08d483ff06aa31e91a7cef621e5ab3e76ce6023158ef016e0c4be6N.exe 28 PID 2184 wrote to memory of 2640 2184 pjdjv.exe 29 PID 2184 wrote to memory of 2640 2184 pjdjv.exe 29 PID 2184 wrote to memory of 2640 2184 pjdjv.exe 29 PID 2184 wrote to memory of 2640 2184 pjdjv.exe 29 PID 2640 wrote to memory of 2816 2640 nbnnbh.exe 30 PID 2640 wrote to memory of 2816 2640 nbnnbh.exe 30 PID 2640 wrote to memory of 2816 2640 nbnnbh.exe 30 PID 2640 wrote to memory of 2816 2640 nbnnbh.exe 30 PID 2816 wrote to memory of 2916 2816 pjddp.exe 31 PID 2816 wrote to memory of 2916 2816 pjddp.exe 31 PID 2816 wrote to memory of 2916 2816 pjddp.exe 31 PID 2816 wrote to memory of 2916 2816 pjddp.exe 31 PID 2916 wrote to memory of 2528 2916 9htbhh.exe 32 PID 2916 wrote to memory of 2528 2916 9htbhh.exe 32 PID 2916 wrote to memory of 2528 2916 9htbhh.exe 32 PID 2916 wrote to memory of 2528 2916 9htbhh.exe 32 PID 2528 wrote to memory of 2548 2528 lxrxlrf.exe 33 PID 2528 wrote to memory of 2548 2528 lxrxlrf.exe 33 PID 2528 wrote to memory of 2548 2528 lxrxlrf.exe 33 PID 2528 wrote to memory of 2548 2528 lxrxlrf.exe 33 PID 2548 wrote to memory of 2516 2548 5xllrxl.exe 34 PID 2548 wrote to memory of 2516 2548 5xllrxl.exe 34 PID 2548 wrote to memory of 2516 2548 5xllrxl.exe 34 PID 2548 wrote to memory of 2516 2548 5xllrxl.exe 34 PID 2516 wrote to memory of 2988 2516 dvdvd.exe 35 PID 2516 wrote to memory of 2988 2516 dvdvd.exe 35 PID 2516 wrote to memory of 2988 2516 dvdvd.exe 35 PID 2516 wrote to memory of 2988 2516 dvdvd.exe 35 PID 2988 wrote to memory of 2544 2988 lfrxffl.exe 36 PID 2988 wrote to memory of 2544 2988 lfrxffl.exe 36 PID 2988 wrote to memory of 2544 2988 lfrxffl.exe 36 PID 2988 wrote to memory of 2544 2988 lfrxffl.exe 36 PID 2544 wrote to memory of 776 2544 hhttbb.exe 37 PID 2544 wrote to memory of 776 2544 hhttbb.exe 37 PID 2544 wrote to memory of 776 2544 hhttbb.exe 37 PID 2544 wrote to memory of 776 2544 hhttbb.exe 37 PID 776 wrote to memory of 1484 776 1vjpv.exe 38 PID 776 wrote to memory of 1484 776 1vjpv.exe 38 PID 776 wrote to memory of 1484 776 1vjpv.exe 38 PID 776 wrote to memory of 1484 776 1vjpv.exe 38 PID 1484 wrote to memory of 1864 1484 ffrlfrx.exe 39 PID 1484 wrote to memory of 1864 1484 ffrlfrx.exe 39 PID 1484 wrote to memory of 1864 1484 ffrlfrx.exe 39 PID 1484 wrote to memory of 1864 1484 ffrlfrx.exe 39 PID 1864 wrote to memory of 2892 1864 bbnthn.exe 40 PID 1864 wrote to memory of 2892 1864 bbnthn.exe 40 PID 1864 wrote to memory of 2892 1864 bbnthn.exe 40 PID 1864 wrote to memory of 2892 1864 bbnthn.exe 40 PID 2892 wrote to memory of 3024 2892 xlffrxl.exe 41 PID 2892 wrote to memory of 3024 2892 xlffrxl.exe 41 PID 2892 wrote to memory of 3024 2892 xlffrxl.exe 41 PID 2892 wrote to memory of 3024 2892 xlffrxl.exe 41 PID 3024 wrote to memory of 2752 3024 bthntn.exe 42 PID 3024 wrote to memory of 2752 3024 bthntn.exe 42 PID 3024 wrote to memory of 2752 3024 bthntn.exe 42 PID 3024 wrote to memory of 2752 3024 bthntn.exe 42 PID 2752 wrote to memory of 2340 2752 fxrrxfl.exe 43 PID 2752 wrote to memory of 2340 2752 fxrrxfl.exe 43 PID 2752 wrote to memory of 2340 2752 fxrrxfl.exe 43 PID 2752 wrote to memory of 2340 2752 fxrrxfl.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\98b4a726ec08d483ff06aa31e91a7cef621e5ab3e76ce6023158ef016e0c4be6N.exe"C:\Users\Admin\AppData\Local\Temp\98b4a726ec08d483ff06aa31e91a7cef621e5ab3e76ce6023158ef016e0c4be6N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\pjdjv.exec:\pjdjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\nbnnbh.exec:\nbnnbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\pjddp.exec:\pjddp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\9htbhh.exec:\9htbhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\lxrxlrf.exec:\lxrxlrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\5xllrxl.exec:\5xllrxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\dvdvd.exec:\dvdvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\lfrxffl.exec:\lfrxffl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\hhttbb.exec:\hhttbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\1vjpv.exec:\1vjpv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
\??\c:\ffrlfrx.exec:\ffrlfrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\bbnthn.exec:\bbnthn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\xlffrxl.exec:\xlffrxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\bthntn.exec:\bthntn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\fxrrxfl.exec:\fxrrxfl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\7btthn.exec:\7btthn.exe17⤵
- Executes dropped EXE
PID:2340 -
\??\c:\vdpvd.exec:\vdpvd.exe18⤵
- Executes dropped EXE
PID:2744 -
\??\c:\xxlrfrx.exec:\xxlrfrx.exe19⤵
- Executes dropped EXE
PID:1736 -
\??\c:\dvjdp.exec:\dvjdp.exe20⤵
- Executes dropped EXE
PID:1828 -
\??\c:\5rllxxf.exec:\5rllxxf.exe21⤵
- Executes dropped EXE
PID:852 -
\??\c:\btntth.exec:\btntth.exe22⤵
- Executes dropped EXE
PID:2152 -
\??\c:\7ddpp.exec:\7ddpp.exe23⤵
- Executes dropped EXE
PID:2392 -
\??\c:\7nbthh.exec:\7nbthh.exe24⤵
- Executes dropped EXE
PID:2364 -
\??\c:\bbnthn.exec:\bbnthn.exe25⤵
- Executes dropped EXE
PID:1400 -
\??\c:\vvjjp.exec:\vvjjp.exe26⤵
- Executes dropped EXE
PID:2944 -
\??\c:\rlfxflr.exec:\rlfxflr.exe27⤵
- Executes dropped EXE
PID:1000 -
\??\c:\pjjpd.exec:\pjjpd.exe28⤵
- Executes dropped EXE
PID:1328 -
\??\c:\xrlrfxl.exec:\xrlrfxl.exe29⤵
- Executes dropped EXE
PID:2004 -
\??\c:\jjjvj.exec:\jjjvj.exe30⤵
- Executes dropped EXE
PID:620 -
\??\c:\rrrxflr.exec:\rrrxflr.exe31⤵
- Executes dropped EXE
PID:2396 -
\??\c:\btnnnt.exec:\btnnnt.exe32⤵
- Executes dropped EXE
PID:1768 -
\??\c:\dvddp.exec:\dvddp.exe33⤵
- Executes dropped EXE
PID:1956 -
\??\c:\hthhtb.exec:\hthhtb.exe34⤵
- Executes dropped EXE
PID:1508 -
\??\c:\ttntnn.exec:\ttntnn.exe35⤵
- Executes dropped EXE
PID:2436 -
\??\c:\jdpvv.exec:\jdpvv.exe36⤵
- Executes dropped EXE
PID:1576 -
\??\c:\ffrxlll.exec:\ffrxlll.exe37⤵
- Executes dropped EXE
PID:2256 -
\??\c:\htbbbh.exec:\htbbbh.exe38⤵
- Executes dropped EXE
PID:2708 -
\??\c:\pdpvd.exec:\pdpvd.exe39⤵
- Executes dropped EXE
PID:2796 -
\??\c:\9rfrlll.exec:\9rfrlll.exe40⤵
- Executes dropped EXE
PID:2624 -
\??\c:\5ffrxlx.exec:\5ffrxlx.exe41⤵
- Executes dropped EXE
PID:2824 -
\??\c:\tnbbnh.exec:\tnbbnh.exe42⤵
- Executes dropped EXE
PID:2616 -
\??\c:\1dppv.exec:\1dppv.exe43⤵
- Executes dropped EXE
PID:2680 -
\??\c:\fxlxfrf.exec:\fxlxfrf.exe44⤵
- Executes dropped EXE
PID:2800 -
\??\c:\nbhhnn.exec:\nbhhnn.exe45⤵
- Executes dropped EXE
PID:2564 -
\??\c:\bthnbh.exec:\bthnbh.exe46⤵
- Executes dropped EXE
PID:2792 -
\??\c:\1vvjp.exec:\1vvjp.exe47⤵
- Executes dropped EXE
PID:2996 -
\??\c:\lxrxflr.exec:\lxrxflr.exe48⤵
- Executes dropped EXE
PID:2544 -
\??\c:\hbtbhn.exec:\hbtbhn.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:604 -
\??\c:\vpjvd.exec:\vpjvd.exe50⤵
- Executes dropped EXE
PID:596 -
\??\c:\pjjjj.exec:\pjjjj.exe51⤵
- Executes dropped EXE
PID:1488 -
\??\c:\3frrlfl.exec:\3frrlfl.exe52⤵
- Executes dropped EXE
PID:944 -
\??\c:\thtnnn.exec:\thtnnn.exe53⤵
- Executes dropped EXE
PID:3012 -
\??\c:\pdvpd.exec:\pdvpd.exe54⤵
- Executes dropped EXE
PID:2892 -
\??\c:\9jddp.exec:\9jddp.exe55⤵
- Executes dropped EXE
PID:2560 -
\??\c:\1xrrxfl.exec:\1xrrxfl.exe56⤵
- Executes dropped EXE
PID:2084 -
\??\c:\tbbtht.exec:\tbbtht.exe57⤵
- Executes dropped EXE
PID:1752 -
\??\c:\jvjdd.exec:\jvjdd.exe58⤵
- Executes dropped EXE
PID:1316 -
\??\c:\dvjpj.exec:\dvjpj.exe59⤵
- Executes dropped EXE
PID:2748 -
\??\c:\xfrrxfl.exec:\xfrrxfl.exe60⤵
- Executes dropped EXE
PID:2732 -
\??\c:\tnbhnt.exec:\tnbhnt.exe61⤵
- Executes dropped EXE
PID:808 -
\??\c:\pdvvd.exec:\pdvvd.exe62⤵
- Executes dropped EXE
PID:1984 -
\??\c:\jpjjp.exec:\jpjjp.exe63⤵
- Executes dropped EXE
PID:2484 -
\??\c:\ffrxfxr.exec:\ffrxfxr.exe64⤵
- Executes dropped EXE
PID:2112 -
\??\c:\3tthnt.exec:\3tthnt.exe65⤵
- Executes dropped EXE
PID:2092 -
\??\c:\dvjpp.exec:\dvjpp.exe66⤵PID:2936
-
\??\c:\3djpd.exec:\3djpd.exe67⤵PID:2480
-
\??\c:\lfxrffl.exec:\lfxrffl.exe68⤵PID:792
-
\??\c:\tnhnnt.exec:\tnhnnt.exe69⤵PID:1548
-
\??\c:\ppvvj.exec:\ppvvj.exe70⤵PID:1568
-
\??\c:\9jjdp.exec:\9jjdp.exe71⤵PID:2924
-
\??\c:\lflxlrf.exec:\lflxlrf.exe72⤵PID:2200
-
\??\c:\htbhhb.exec:\htbhhb.exe73⤵PID:2324
-
\??\c:\dppjd.exec:\dppjd.exe74⤵PID:2300
-
\??\c:\jdpvj.exec:\jdpvj.exe75⤵PID:2320
-
\??\c:\lxrxffl.exec:\lxrxffl.exe76⤵PID:2960
-
\??\c:\5bnhnn.exec:\5bnhnn.exe77⤵PID:1256
-
\??\c:\7vjpp.exec:\7vjpp.exe78⤵PID:2124
-
\??\c:\vvpdv.exec:\vvpdv.exe79⤵PID:2840
-
\??\c:\rrlrxfl.exec:\rrlrxfl.exe80⤵PID:2592
-
\??\c:\tbnthn.exec:\tbnthn.exe81⤵PID:1272
-
\??\c:\9jppd.exec:\9jppd.exe82⤵PID:2652
-
\??\c:\vpddp.exec:\vpddp.exe83⤵PID:2816
-
\??\c:\lxlxfrx.exec:\lxlxfrx.exe84⤵PID:2804
-
\??\c:\btnhbb.exec:\btnhbb.exe85⤵PID:2556
-
\??\c:\tnhthn.exec:\tnhthn.exe86⤵PID:2772
-
\??\c:\ppvvj.exec:\ppvvj.exe87⤵PID:2512
-
\??\c:\5lrxxxf.exec:\5lrxxxf.exe88⤵PID:2548
-
\??\c:\7bnnhh.exec:\7bnnhh.exe89⤵PID:1064
-
\??\c:\btnnbb.exec:\btnnbb.exe90⤵PID:3004
-
\??\c:\1ppdv.exec:\1ppdv.exe91⤵PID:2544
-
\??\c:\rlxflrx.exec:\rlxflrx.exe92⤵PID:592
-
\??\c:\rrllrxf.exec:\rrllrxf.exe93⤵PID:2852
-
\??\c:\hbnntb.exec:\hbnntb.exe94⤵PID:2884
-
\??\c:\pjvdv.exec:\pjvdv.exe95⤵PID:2876
-
\??\c:\pjddd.exec:\pjddd.exe96⤵PID:2540
-
\??\c:\xlxrllx.exec:\xlxrllx.exe97⤵PID:3032
-
\??\c:\nnbnbb.exec:\nnbnbb.exe98⤵PID:1796
-
\??\c:\hnbhtt.exec:\hnbhtt.exe99⤵PID:2568
-
\??\c:\3vvjp.exec:\3vvjp.exe100⤵PID:1556
-
\??\c:\vpdjp.exec:\vpdjp.exe101⤵PID:1976
-
\??\c:\7lrrrlx.exec:\7lrrrlx.exe102⤵PID:1028
-
\??\c:\hhtnth.exec:\hhtnth.exe103⤵PID:2732
-
\??\c:\7nhhnt.exec:\7nhhnt.exe104⤵PID:1964
-
\??\c:\pdjvv.exec:\pdjvv.exe105⤵PID:2000
-
\??\c:\xrlrffx.exec:\xrlrffx.exe106⤵PID:2012
-
\??\c:\nhttnh.exec:\nhttnh.exe107⤵PID:2348
-
\??\c:\tnbnbh.exec:\tnbnbh.exe108⤵PID:2204
-
\??\c:\pvjjv.exec:\pvjjv.exe109⤵PID:2948
-
\??\c:\xxxxlrf.exec:\xxxxlrf.exe110⤵PID:1040
-
\??\c:\7bnntb.exec:\7bnntb.exe111⤵PID:1784
-
\??\c:\7bnbhh.exec:\7bnbhh.exe112⤵PID:968
-
\??\c:\1jddj.exec:\1jddj.exe113⤵PID:1328
-
\??\c:\xxffrrx.exec:\xxffrrx.exe114⤵PID:1628
-
\??\c:\9frrrxf.exec:\9frrrxf.exe115⤵PID:2924
-
\??\c:\tbtnnt.exec:\tbtnnt.exe116⤵PID:2952
-
\??\c:\5jjjv.exec:\5jjjv.exe117⤵PID:2288
-
\??\c:\5dppv.exec:\5dppv.exe118⤵PID:1032
-
\??\c:\xxffrxl.exec:\xxffrxl.exe119⤵PID:2344
-
\??\c:\thhbht.exec:\thhbht.exe120⤵PID:3056
-
\??\c:\vdppd.exec:\vdppd.exe121⤵
- System Location Discovery: System Language Discovery
PID:2692
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-