Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-12-2024 01:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bf59e88eee2ed0dd5ff404e78f75ba1c34580aa850bb0b51ae99881e1be7d886N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
bf59e88eee2ed0dd5ff404e78f75ba1c34580aa850bb0b51ae99881e1be7d886N.exe
-
Size
454KB
-
MD5
fa6bbe5a4a7758cf76bef3769567fa50
-
SHA1
b28ba3d4815b241ecadd73d414bece2fa1ed2e1c
-
SHA256
bf59e88eee2ed0dd5ff404e78f75ba1c34580aa850bb0b51ae99881e1be7d886
-
SHA512
9ec5602ac85eeb0adcf2f5703ee6aa1fff313b871ebe4e7cc474c5fcaa67d051f07ba9defd31c3560c58dffde07c6202e0ff87fb59abd94f412046e6665766b0
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbed:q7Tc2NYHUrAwfMp3CDd
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 50 IoCs
resource yara_rule behavioral1/memory/2368-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1916-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1060-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3052-45-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2700-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-105-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/2324-124-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/1816-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/796-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1768-179-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1768-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1768-177-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1860-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1376-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/744-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/552-284-0x0000000077510000-0x000000007762F000-memory.dmp family_blackmoon behavioral1/memory/1616-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2328-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3028-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1244-408-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-464-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1860-490-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1860-491-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1860-516-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2140-530-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2140-531-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2140-529-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2412-533-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/896-551-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2144-588-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-602-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1604-813-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2132-886-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2088-1007-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3004-1010-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1376-1052-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/896-1080-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1608-1101-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1608-1100-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1916 5djvd.exe 1060 rlflrxl.exe 2104 lflrllr.exe 3052 pjdjp.exe 2700 tbhhbn.exe 2724 dvjjv.exe 2704 tnbbhn.exe 2604 vjdpv.exe 2744 rlfxffl.exe 2592 tthhnt.exe 3024 1vjjj.exe 2324 1rlxfff.exe 1816 xlffffl.exe 1208 vvjvj.exe 1948 frffllx.exe 796 btthnt.exe 1372 jvpvv.exe 1768 3rfxxxl.exe 2924 1bnnhh.exe 1484 1jdvd.exe 2088 nhtbnn.exe 1860 jdvvd.exe 632 frflrrx.exe 1780 3tnttb.exe 1628 jdjjj.exe 1376 rfrxxxf.exe 2360 vjvvj.exe 744 rxxfflr.exe 2660 jdpvd.exe 552 xrflrrx.exe 2520 9vppv.exe 2328 xrflrrf.exe 2480 jjvjv.exe 2668 5ffrrxl.exe 3052 htbhhh.exe 2836 tnhhhn.exe 2680 jdpvd.exe 2584 fxxxlxl.exe 2852 rrffflx.exe 2920 nhbhnt.exe 2748 btbhhn.exe 2744 ppjvv.exe 2572 lflxffl.exe 3028 9rxxxxf.exe 3036 nhhhnn.exe 2044 1dpvv.exe 1244 xrllrll.exe 1564 xrflrrx.exe 756 hbthtn.exe 1992 ppddd.exe 1784 pjdvd.exe 2892 xxrlxxl.exe 2232 llfrffl.exe 1768 tnbhnn.exe 2436 jppvj.exe 2188 7vpvd.exe 1872 frfllrx.exe 1016 nhnnnn.exe 408 nbntbb.exe 1860 pjvpv.exe 844 xrffxrx.exe 960 xlrlrrr.exe 1316 btntbh.exe 784 vvjjj.exe -
resource yara_rule behavioral1/memory/2368-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1916-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1060-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-45-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2700-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1816-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/796-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1768-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1768-207-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1860-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1376-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/744-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/552-284-0x0000000077510000-0x000000007762F000-memory.dmp upx behavioral1/memory/1616-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1244-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-464-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1860-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1860-516-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2140-531-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-533-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/896-551-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-588-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-595-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-602-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-610-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1432-716-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/988-761-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-798-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1604-813-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2132-886-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2596-911-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/580-924-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-937-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-981-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-1007-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1868-1027-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrxrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrffflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfflxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rrxrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tbbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btttbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2368 wrote to memory of 1916 2368 bf59e88eee2ed0dd5ff404e78f75ba1c34580aa850bb0b51ae99881e1be7d886N.exe 30 PID 2368 wrote to memory of 1916 2368 bf59e88eee2ed0dd5ff404e78f75ba1c34580aa850bb0b51ae99881e1be7d886N.exe 30 PID 2368 wrote to memory of 1916 2368 bf59e88eee2ed0dd5ff404e78f75ba1c34580aa850bb0b51ae99881e1be7d886N.exe 30 PID 2368 wrote to memory of 1916 2368 bf59e88eee2ed0dd5ff404e78f75ba1c34580aa850bb0b51ae99881e1be7d886N.exe 30 PID 1916 wrote to memory of 1060 1916 5djvd.exe 31 PID 1916 wrote to memory of 1060 1916 5djvd.exe 31 PID 1916 wrote to memory of 1060 1916 5djvd.exe 31 PID 1916 wrote to memory of 1060 1916 5djvd.exe 31 PID 1060 wrote to memory of 2104 1060 rlflrxl.exe 32 PID 1060 wrote to memory of 2104 1060 rlflrxl.exe 32 PID 1060 wrote to memory of 2104 1060 rlflrxl.exe 32 PID 1060 wrote to memory of 2104 1060 rlflrxl.exe 32 PID 2104 wrote to memory of 3052 2104 lflrllr.exe 33 PID 2104 wrote to memory of 3052 2104 lflrllr.exe 33 PID 2104 wrote to memory of 3052 2104 lflrllr.exe 33 PID 2104 wrote to memory of 3052 2104 lflrllr.exe 33 PID 3052 wrote to memory of 2700 3052 pjdjp.exe 34 PID 3052 wrote to memory of 2700 3052 pjdjp.exe 34 PID 3052 wrote to memory of 2700 3052 pjdjp.exe 34 PID 3052 wrote to memory of 2700 3052 pjdjp.exe 34 PID 2700 wrote to memory of 2724 2700 tbhhbn.exe 35 PID 2700 wrote to memory of 2724 2700 tbhhbn.exe 35 PID 2700 wrote to memory of 2724 2700 tbhhbn.exe 35 PID 2700 wrote to memory of 2724 2700 tbhhbn.exe 35 PID 2724 wrote to memory of 2704 2724 dvjjv.exe 36 PID 2724 wrote to memory of 2704 2724 dvjjv.exe 36 PID 2724 wrote to memory of 2704 2724 dvjjv.exe 36 PID 2724 wrote to memory of 2704 2724 dvjjv.exe 36 PID 2704 wrote to memory of 2604 2704 tnbbhn.exe 37 PID 2704 wrote to memory of 2604 2704 tnbbhn.exe 37 PID 2704 wrote to memory of 2604 2704 tnbbhn.exe 37 PID 2704 wrote to memory of 2604 2704 tnbbhn.exe 37 PID 2604 wrote to memory of 2744 2604 vjdpv.exe 38 PID 2604 wrote to memory of 2744 2604 vjdpv.exe 38 PID 2604 wrote to memory of 2744 2604 vjdpv.exe 38 PID 2604 wrote to memory of 2744 2604 vjdpv.exe 38 PID 2744 wrote to memory of 2592 2744 rlfxffl.exe 39 PID 2744 wrote to memory of 2592 2744 rlfxffl.exe 39 PID 2744 wrote to memory of 2592 2744 rlfxffl.exe 39 PID 2744 wrote to memory of 2592 2744 rlfxffl.exe 39 PID 2592 wrote to memory of 3024 2592 tthhnt.exe 40 PID 2592 wrote to memory of 3024 2592 tthhnt.exe 40 PID 2592 wrote to memory of 3024 2592 tthhnt.exe 40 PID 2592 wrote to memory of 3024 2592 tthhnt.exe 40 PID 3024 wrote to memory of 2324 3024 1vjjj.exe 41 PID 3024 wrote to memory of 2324 3024 1vjjj.exe 41 PID 3024 wrote to memory of 2324 3024 1vjjj.exe 41 PID 3024 wrote to memory of 2324 3024 1vjjj.exe 41 PID 2324 wrote to memory of 1816 2324 1rlxfff.exe 42 PID 2324 wrote to memory of 1816 2324 1rlxfff.exe 42 PID 2324 wrote to memory of 1816 2324 1rlxfff.exe 42 PID 2324 wrote to memory of 1816 2324 1rlxfff.exe 42 PID 1816 wrote to memory of 1208 1816 xlffffl.exe 43 PID 1816 wrote to memory of 1208 1816 xlffffl.exe 43 PID 1816 wrote to memory of 1208 1816 xlffffl.exe 43 PID 1816 wrote to memory of 1208 1816 xlffffl.exe 43 PID 1208 wrote to memory of 1948 1208 vvjvj.exe 44 PID 1208 wrote to memory of 1948 1208 vvjvj.exe 44 PID 1208 wrote to memory of 1948 1208 vvjvj.exe 44 PID 1208 wrote to memory of 1948 1208 vvjvj.exe 44 PID 1948 wrote to memory of 796 1948 frffllx.exe 45 PID 1948 wrote to memory of 796 1948 frffllx.exe 45 PID 1948 wrote to memory of 796 1948 frffllx.exe 45 PID 1948 wrote to memory of 796 1948 frffllx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\bf59e88eee2ed0dd5ff404e78f75ba1c34580aa850bb0b51ae99881e1be7d886N.exe"C:\Users\Admin\AppData\Local\Temp\bf59e88eee2ed0dd5ff404e78f75ba1c34580aa850bb0b51ae99881e1be7d886N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\5djvd.exec:\5djvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\rlflrxl.exec:\rlflrxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
\??\c:\lflrllr.exec:\lflrllr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\pjdjp.exec:\pjdjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\tbhhbn.exec:\tbhhbn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\dvjjv.exec:\dvjjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\tnbbhn.exec:\tnbbhn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\vjdpv.exec:\vjdpv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\rlfxffl.exec:\rlfxffl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\tthhnt.exec:\tthhnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\1vjjj.exec:\1vjjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\1rlxfff.exec:\1rlxfff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\xlffffl.exec:\xlffffl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
\??\c:\vvjvj.exec:\vvjvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
\??\c:\frffllx.exec:\frffllx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\btthnt.exec:\btthnt.exe17⤵
- Executes dropped EXE
PID:796 -
\??\c:\jvpvv.exec:\jvpvv.exe18⤵
- Executes dropped EXE
PID:1372 -
\??\c:\3rfxxxl.exec:\3rfxxxl.exe19⤵
- Executes dropped EXE
PID:1768 -
\??\c:\1bnnhh.exec:\1bnnhh.exe20⤵
- Executes dropped EXE
PID:2924 -
\??\c:\1jdvd.exec:\1jdvd.exe21⤵
- Executes dropped EXE
PID:1484 -
\??\c:\nhtbnn.exec:\nhtbnn.exe22⤵
- Executes dropped EXE
PID:2088 -
\??\c:\jdvvd.exec:\jdvvd.exe23⤵
- Executes dropped EXE
PID:1860 -
\??\c:\frflrrx.exec:\frflrrx.exe24⤵
- Executes dropped EXE
PID:632 -
\??\c:\3tnttb.exec:\3tnttb.exe25⤵
- Executes dropped EXE
PID:1780 -
\??\c:\jdjjj.exec:\jdjjj.exe26⤵
- Executes dropped EXE
PID:1628 -
\??\c:\rfrxxxf.exec:\rfrxxxf.exe27⤵
- Executes dropped EXE
PID:1376 -
\??\c:\vjvvj.exec:\vjvvj.exe28⤵
- Executes dropped EXE
PID:2360 -
\??\c:\rxxfflr.exec:\rxxfflr.exe29⤵
- Executes dropped EXE
PID:744 -
\??\c:\jdpvd.exec:\jdpvd.exe30⤵
- Executes dropped EXE
PID:2660 -
\??\c:\xrflrrx.exec:\xrflrrx.exe31⤵
- Executes dropped EXE
PID:552 -
\??\c:\7htbhh.exec:\7htbhh.exe32⤵PID:1616
-
\??\c:\9vppv.exec:\9vppv.exe33⤵
- Executes dropped EXE
PID:2520 -
\??\c:\xrflrrf.exec:\xrflrrf.exe34⤵
- Executes dropped EXE
PID:2328 -
\??\c:\jjvjv.exec:\jjvjv.exe35⤵
- Executes dropped EXE
PID:2480 -
\??\c:\5ffrrxl.exec:\5ffrrxl.exe36⤵
- Executes dropped EXE
PID:2668 -
\??\c:\htbhhh.exec:\htbhhh.exe37⤵
- Executes dropped EXE
PID:3052 -
\??\c:\tnhhhn.exec:\tnhhhn.exe38⤵
- Executes dropped EXE
PID:2836 -
\??\c:\jdpvd.exec:\jdpvd.exe39⤵
- Executes dropped EXE
PID:2680 -
\??\c:\fxxxlxl.exec:\fxxxlxl.exe40⤵
- Executes dropped EXE
PID:2584 -
\??\c:\rrffflx.exec:\rrffflx.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2852 -
\??\c:\nhbhnt.exec:\nhbhnt.exe42⤵
- Executes dropped EXE
PID:2920 -
\??\c:\btbhhn.exec:\btbhhn.exe43⤵
- Executes dropped EXE
PID:2748 -
\??\c:\ppjvv.exec:\ppjvv.exe44⤵
- Executes dropped EXE
PID:2744 -
\??\c:\lflxffl.exec:\lflxffl.exe45⤵
- Executes dropped EXE
PID:2572 -
\??\c:\9rxxxxf.exec:\9rxxxxf.exe46⤵
- Executes dropped EXE
PID:3028 -
\??\c:\nhhhnn.exec:\nhhhnn.exe47⤵
- Executes dropped EXE
PID:3036 -
\??\c:\1dpvv.exec:\1dpvv.exe48⤵
- Executes dropped EXE
PID:2044 -
\??\c:\xrllrll.exec:\xrllrll.exe49⤵
- Executes dropped EXE
PID:1244 -
\??\c:\xrflrrx.exec:\xrflrrx.exe50⤵
- Executes dropped EXE
PID:1564 -
\??\c:\hbthtn.exec:\hbthtn.exe51⤵
- Executes dropped EXE
PID:756 -
\??\c:\ppddd.exec:\ppddd.exe52⤵
- Executes dropped EXE
PID:1992 -
\??\c:\pjdvd.exec:\pjdvd.exe53⤵
- Executes dropped EXE
PID:1784 -
\??\c:\xxrlxxl.exec:\xxrlxxl.exe54⤵
- Executes dropped EXE
PID:2892 -
\??\c:\llfrffl.exec:\llfrffl.exe55⤵
- Executes dropped EXE
PID:2232 -
\??\c:\tnbhnn.exec:\tnbhnn.exe56⤵
- Executes dropped EXE
PID:1768 -
\??\c:\jppvj.exec:\jppvj.exe57⤵
- Executes dropped EXE
PID:2436 -
\??\c:\7vpvd.exec:\7vpvd.exe58⤵
- Executes dropped EXE
PID:2188 -
\??\c:\frfllrx.exec:\frfllrx.exe59⤵
- Executes dropped EXE
PID:1872 -
\??\c:\nhnnnn.exec:\nhnnnn.exe60⤵
- Executes dropped EXE
PID:1016 -
\??\c:\nbntbb.exec:\nbntbb.exe61⤵
- Executes dropped EXE
PID:408 -
\??\c:\pjvpv.exec:\pjvpv.exe62⤵
- Executes dropped EXE
PID:1860 -
\??\c:\xrffxrx.exec:\xrffxrx.exe63⤵
- Executes dropped EXE
PID:844 -
\??\c:\xlrlrrr.exec:\xlrlrrr.exe64⤵
- Executes dropped EXE
PID:960 -
\??\c:\btntbh.exec:\btntbh.exe65⤵
- Executes dropped EXE
PID:1316 -
\??\c:\vvjjj.exec:\vvjjj.exe66⤵
- Executes dropped EXE
PID:784 -
\??\c:\xrllxfl.exec:\xrllxfl.exe67⤵PID:2968
-
\??\c:\lrlxlrx.exec:\lrlxlrx.exe68⤵PID:2140
-
\??\c:\hhthtt.exec:\hhthtt.exe69⤵PID:2412
-
\??\c:\nntbbb.exec:\nntbbb.exe70⤵PID:744
-
\??\c:\5dppp.exec:\5dppp.exe71⤵PID:896
-
\??\c:\rrlrxfl.exec:\rrlrxfl.exe72⤵PID:2056
-
\??\c:\hhnttb.exec:\hhnttb.exe73⤵PID:1616
-
\??\c:\5tnhnh.exec:\5tnhnh.exe74⤵PID:2520
-
\??\c:\jvppv.exec:\jvppv.exe75⤵
- System Location Discovery: System Language Discovery
PID:3008 -
\??\c:\1xxxflr.exec:\1xxxflr.exe76⤵PID:3012
-
\??\c:\1rxxxfl.exec:\1rxxxfl.exe77⤵PID:2144
-
\??\c:\tththh.exec:\tththh.exe78⤵PID:2032
-
\??\c:\7vppd.exec:\7vppd.exe79⤵PID:2768
-
\??\c:\dvpjv.exec:\dvpjv.exe80⤵PID:2772
-
\??\c:\rrlrffr.exec:\rrlrffr.exe81⤵PID:2856
-
\??\c:\bnbbhh.exec:\bnbbhh.exe82⤵PID:2704
-
\??\c:\5nhtbb.exec:\5nhtbb.exe83⤵PID:2852
-
\??\c:\7pppp.exec:\7pppp.exe84⤵PID:2828
-
\??\c:\lfxrllr.exec:\lfxrllr.exe85⤵PID:2620
-
\??\c:\xrffffr.exec:\xrffffr.exe86⤵PID:2592
-
\??\c:\tnhnbb.exec:\tnhnbb.exe87⤵PID:3032
-
\??\c:\jdjdj.exec:\jdjdj.exe88⤵PID:580
-
\??\c:\5vjjj.exec:\5vjjj.exe89⤵PID:3036
-
\??\c:\lrfxfxf.exec:\lrfxfxf.exe90⤵PID:1792
-
\??\c:\7bnnbh.exec:\7bnnbh.exe91⤵PID:2808
-
\??\c:\ntnbnn.exec:\ntnbnn.exe92⤵PID:2812
-
\??\c:\ppjpd.exec:\ppjpd.exe93⤵PID:756
-
\??\c:\rlxffff.exec:\rlxffff.exe94⤵PID:1940
-
\??\c:\9llfxrr.exec:\9llfxrr.exe95⤵PID:1388
-
\??\c:\1bhbtn.exec:\1bhbtn.exe96⤵PID:2012
-
\??\c:\nbtnnh.exec:\nbtnnh.exe97⤵PID:2232
-
\??\c:\vjppp.exec:\vjppp.exe98⤵PID:1432
-
\??\c:\xlxxxfl.exec:\xlxxxfl.exe99⤵PID:2200
-
\??\c:\7rrlfxx.exec:\7rrlfxx.exe100⤵PID:2188
-
\??\c:\btnnbt.exec:\btnnbt.exe101⤵PID:2224
-
\??\c:\jpdvv.exec:\jpdvv.exe102⤵PID:1696
-
\??\c:\ppddj.exec:\ppddj.exe103⤵PID:408
-
\??\c:\lfxrxxl.exec:\lfxrxxl.exe104⤵PID:352
-
\??\c:\hbnnbb.exec:\hbnnbb.exe105⤵PID:988
-
\??\c:\bthnbb.exec:\bthnbb.exe106⤵PID:640
-
\??\c:\vjpjp.exec:\vjpjp.exe107⤵PID:1704
-
\??\c:\frxxxxf.exec:\frxxxxf.exe108⤵PID:2312
-
\??\c:\xlrrxrx.exec:\xlrrxrx.exe109⤵PID:1672
-
\??\c:\hhnnnb.exec:\hhnnnb.exe110⤵PID:2452
-
\??\c:\pdppd.exec:\pdppd.exe111⤵PID:2360
-
\??\c:\pdjvd.exec:\pdjvd.exe112⤵PID:1512
-
\??\c:\rlfllrf.exec:\rlfllrf.exe113⤵PID:1604
-
\??\c:\3lrxlff.exec:\3lrxlff.exe114⤵PID:1612
-
\??\c:\nhhthb.exec:\nhhthb.exe115⤵PID:2996
-
\??\c:\dpjjj.exec:\dpjjj.exe116⤵PID:1928
-
\??\c:\rlxfffl.exec:\rlxfffl.exe117⤵PID:2328
-
\??\c:\llfrflr.exec:\llfrflr.exe118⤵PID:2864
-
\??\c:\3hhtbh.exec:\3hhtbh.exe119⤵PID:2760
-
\??\c:\dpvpp.exec:\dpvpp.exe120⤵PID:2776
-
\??\c:\5dpdd.exec:\5dpdd.exe121⤵PID:2720
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-