Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-12-2024 03:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
51b383a8224cc6fdaafbb6735db4308a74e3165264571afdb7e305a35dab6c86N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
51b383a8224cc6fdaafbb6735db4308a74e3165264571afdb7e305a35dab6c86N.exe
-
Size
454KB
-
MD5
ed19f4cdf4f147928f4ab251c0459300
-
SHA1
c4afb55ba0998f41e53216ea279fb964e03fa3af
-
SHA256
51b383a8224cc6fdaafbb6735db4308a74e3165264571afdb7e305a35dab6c86
-
SHA512
14d4fbba291ecbe6efb744a97c916048bd994f058afaf90e309353344a1b590bb9bf278734f8ae126ed0d51154bafccbdfc94b18b3f94a129342358ff1da5a40
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeU:q7Tc2NYHUrAwfMp3CDU
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2268-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2248-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2180-106-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1188-113-0x0000000000350000-0x000000000037A000-memory.dmp family_blackmoon behavioral1/memory/1188-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1120-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2384-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2416-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1816-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-268-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/316-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1936-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-322-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2396-320-0x0000000077470000-0x000000007758F000-memory.dmp family_blackmoon behavioral1/memory/2568-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/624-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/856-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1224-448-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2228-473-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-487-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/268-500-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1612-546-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-559-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-588-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2744-629-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-668-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-722-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2204-761-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/688-780-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2400-789-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2360 nhbhnt.exe 2792 pppjv.exe 2248 btbbbn.exe 2848 frflrxl.exe 2800 btbhtt.exe 2548 xrfxxfr.exe 2720 9vddj.exe 3012 frllllx.exe 2888 bthnbt.exe 3024 rlrrffr.exe 2180 xrfxlth.exe 1188 lrlxlxl.exe 548 nnhtbt.exe 1624 9xrxrrf.exe 2652 5tnttt.exe 1120 lfrxlxl.exe 560 9xlrffl.exe 2956 pjppj.exe 2224 rlxfllr.exe 2172 9dpvv.exe 1100 7rxfrxf.exe 2384 9vjdd.exe 2416 xrfxffr.exe 1816 vjjjd.exe 356 jjdjv.exe 1712 1hnnnt.exe 2000 dddjv.exe 2448 nhntbh.exe 2456 ddjpd.exe 316 nnbbbh.exe 1936 1ntbht.exe 1688 5xrrxrf.exe 2996 7nntnb.exe 2756 jjdjd.exe 2764 xxrrfrr.exe 2396 3hnttb.exe 1636 7nnhhn.exe 2580 jpjpj.exe 2608 frffllx.exe 2568 rlflxfx.exe 2628 bntntn.exe 1384 pjjpd.exe 1908 rfxrrlr.exe 2884 9bnthn.exe 2912 pjdvd.exe 624 pjdvj.exe 860 bnhhtt.exe 856 ttntnh.exe 484 9jddd.exe 548 1xlfrrf.exe 1656 7ntthn.exe 2880 1hbhht.exe 1224 vvpdp.exe 604 frflxfr.exe 2952 htnhhn.exe 1416 jdppd.exe 2228 1pdvj.exe 2104 lllxlrf.exe 2172 nhhhtb.exe 2400 ttnhbh.exe 268 dvjpp.exe 1300 rlfflrx.exe 2508 tbthhh.exe 1092 7jpvd.exe -
resource yara_rule behavioral1/memory/2268-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1188-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/548-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1188-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1120-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1120-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2416-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1816-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/316-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/624-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/624-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/856-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-473-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-480-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-487-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/268-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-546-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-559-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1012-572-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-596-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-629-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-668-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1356-669-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-688-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1336-696-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-761-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/688-780-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-796-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-816-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nhtht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfffxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrfrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ffllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxxlxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2268 wrote to memory of 2360 2268 51b383a8224cc6fdaafbb6735db4308a74e3165264571afdb7e305a35dab6c86N.exe 31 PID 2268 wrote to memory of 2360 2268 51b383a8224cc6fdaafbb6735db4308a74e3165264571afdb7e305a35dab6c86N.exe 31 PID 2268 wrote to memory of 2360 2268 51b383a8224cc6fdaafbb6735db4308a74e3165264571afdb7e305a35dab6c86N.exe 31 PID 2268 wrote to memory of 2360 2268 51b383a8224cc6fdaafbb6735db4308a74e3165264571afdb7e305a35dab6c86N.exe 31 PID 2360 wrote to memory of 2792 2360 nhbhnt.exe 32 PID 2360 wrote to memory of 2792 2360 nhbhnt.exe 32 PID 2360 wrote to memory of 2792 2360 nhbhnt.exe 32 PID 2360 wrote to memory of 2792 2360 nhbhnt.exe 32 PID 2792 wrote to memory of 2248 2792 pppjv.exe 33 PID 2792 wrote to memory of 2248 2792 pppjv.exe 33 PID 2792 wrote to memory of 2248 2792 pppjv.exe 33 PID 2792 wrote to memory of 2248 2792 pppjv.exe 33 PID 2248 wrote to memory of 2848 2248 btbbbn.exe 34 PID 2248 wrote to memory of 2848 2248 btbbbn.exe 34 PID 2248 wrote to memory of 2848 2248 btbbbn.exe 34 PID 2248 wrote to memory of 2848 2248 btbbbn.exe 34 PID 2848 wrote to memory of 2800 2848 frflrxl.exe 35 PID 2848 wrote to memory of 2800 2848 frflrxl.exe 35 PID 2848 wrote to memory of 2800 2848 frflrxl.exe 35 PID 2848 wrote to memory of 2800 2848 frflrxl.exe 35 PID 2800 wrote to memory of 2548 2800 btbhtt.exe 36 PID 2800 wrote to memory of 2548 2800 btbhtt.exe 36 PID 2800 wrote to memory of 2548 2800 btbhtt.exe 36 PID 2800 wrote to memory of 2548 2800 btbhtt.exe 36 PID 2548 wrote to memory of 2720 2548 xrfxxfr.exe 37 PID 2548 wrote to memory of 2720 2548 xrfxxfr.exe 37 PID 2548 wrote to memory of 2720 2548 xrfxxfr.exe 37 PID 2548 wrote to memory of 2720 2548 xrfxxfr.exe 37 PID 2720 wrote to memory of 3012 2720 9vddj.exe 38 PID 2720 wrote to memory of 3012 2720 9vddj.exe 38 PID 2720 wrote to memory of 3012 2720 9vddj.exe 38 PID 2720 wrote to memory of 3012 2720 9vddj.exe 38 PID 3012 wrote to memory of 2888 3012 frllllx.exe 39 PID 3012 wrote to memory of 2888 3012 frllllx.exe 39 PID 3012 wrote to memory of 2888 3012 frllllx.exe 39 PID 3012 wrote to memory of 2888 3012 frllllx.exe 39 PID 2888 wrote to memory of 3024 2888 bthnbt.exe 40 PID 2888 wrote to memory of 3024 2888 bthnbt.exe 40 PID 2888 wrote to memory of 3024 2888 bthnbt.exe 40 PID 2888 wrote to memory of 3024 2888 bthnbt.exe 40 PID 3024 wrote to memory of 2180 3024 rlrrffr.exe 41 PID 3024 wrote to memory of 2180 3024 rlrrffr.exe 41 PID 3024 wrote to memory of 2180 3024 rlrrffr.exe 41 PID 3024 wrote to memory of 2180 3024 rlrrffr.exe 41 PID 2180 wrote to memory of 1188 2180 xrfxlth.exe 42 PID 2180 wrote to memory of 1188 2180 xrfxlth.exe 42 PID 2180 wrote to memory of 1188 2180 xrfxlth.exe 42 PID 2180 wrote to memory of 1188 2180 xrfxlth.exe 42 PID 1188 wrote to memory of 548 1188 lrlxlxl.exe 43 PID 1188 wrote to memory of 548 1188 lrlxlxl.exe 43 PID 1188 wrote to memory of 548 1188 lrlxlxl.exe 43 PID 1188 wrote to memory of 548 1188 lrlxlxl.exe 43 PID 548 wrote to memory of 1624 548 nnhtbt.exe 44 PID 548 wrote to memory of 1624 548 nnhtbt.exe 44 PID 548 wrote to memory of 1624 548 nnhtbt.exe 44 PID 548 wrote to memory of 1624 548 nnhtbt.exe 44 PID 1624 wrote to memory of 2652 1624 9xrxrrf.exe 45 PID 1624 wrote to memory of 2652 1624 9xrxrrf.exe 45 PID 1624 wrote to memory of 2652 1624 9xrxrrf.exe 45 PID 1624 wrote to memory of 2652 1624 9xrxrrf.exe 45 PID 2652 wrote to memory of 1120 2652 5tnttt.exe 46 PID 2652 wrote to memory of 1120 2652 5tnttt.exe 46 PID 2652 wrote to memory of 1120 2652 5tnttt.exe 46 PID 2652 wrote to memory of 1120 2652 5tnttt.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\51b383a8224cc6fdaafbb6735db4308a74e3165264571afdb7e305a35dab6c86N.exe"C:\Users\Admin\AppData\Local\Temp\51b383a8224cc6fdaafbb6735db4308a74e3165264571afdb7e305a35dab6c86N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\nhbhnt.exec:\nhbhnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\pppjv.exec:\pppjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\btbbbn.exec:\btbbbn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\frflrxl.exec:\frflrxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\btbhtt.exec:\btbhtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\xrfxxfr.exec:\xrfxxfr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\9vddj.exec:\9vddj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\frllllx.exec:\frllllx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\bthnbt.exec:\bthnbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\rlrrffr.exec:\rlrrffr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\xrfxlth.exec:\xrfxlth.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\lrlxlxl.exec:\lrlxlxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
\??\c:\nnhtbt.exec:\nnhtbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
\??\c:\9xrxrrf.exec:\9xrxrrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\5tnttt.exec:\5tnttt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\lfrxlxl.exec:\lfrxlxl.exe17⤵
- Executes dropped EXE
PID:1120 -
\??\c:\9xlrffl.exec:\9xlrffl.exe18⤵
- Executes dropped EXE
PID:560 -
\??\c:\pjppj.exec:\pjppj.exe19⤵
- Executes dropped EXE
PID:2956 -
\??\c:\rlxfllr.exec:\rlxfllr.exe20⤵
- Executes dropped EXE
PID:2224 -
\??\c:\9dpvv.exec:\9dpvv.exe21⤵
- Executes dropped EXE
PID:2172 -
\??\c:\7rxfrxf.exec:\7rxfrxf.exe22⤵
- Executes dropped EXE
PID:1100 -
\??\c:\9vjdd.exec:\9vjdd.exe23⤵
- Executes dropped EXE
PID:2384 -
\??\c:\xrfxffr.exec:\xrfxffr.exe24⤵
- Executes dropped EXE
PID:2416 -
\??\c:\vjjjd.exec:\vjjjd.exe25⤵
- Executes dropped EXE
PID:1816 -
\??\c:\jjdjv.exec:\jjdjv.exe26⤵
- Executes dropped EXE
PID:356 -
\??\c:\1hnnnt.exec:\1hnnnt.exe27⤵
- Executes dropped EXE
PID:1712 -
\??\c:\dddjv.exec:\dddjv.exe28⤵
- Executes dropped EXE
PID:2000 -
\??\c:\nhntbh.exec:\nhntbh.exe29⤵
- Executes dropped EXE
PID:2448 -
\??\c:\ddjpd.exec:\ddjpd.exe30⤵
- Executes dropped EXE
PID:2456 -
\??\c:\nnbbbh.exec:\nnbbbh.exe31⤵
- Executes dropped EXE
PID:316 -
\??\c:\1ntbht.exec:\1ntbht.exe32⤵
- Executes dropped EXE
PID:1936 -
\??\c:\5xrrxrf.exec:\5xrrxrf.exe33⤵
- Executes dropped EXE
PID:1688 -
\??\c:\7nntnb.exec:\7nntnb.exe34⤵
- Executes dropped EXE
PID:2996 -
\??\c:\jjdjd.exec:\jjdjd.exe35⤵
- Executes dropped EXE
PID:2756 -
\??\c:\xxrrfrr.exec:\xxrrfrr.exe36⤵
- Executes dropped EXE
PID:2764 -
\??\c:\3hnttb.exec:\3hnttb.exe37⤵
- Executes dropped EXE
PID:2396 -
\??\c:\vvpvp.exec:\vvpvp.exe38⤵PID:2356
-
\??\c:\7nnhhn.exec:\7nnhhn.exe39⤵
- Executes dropped EXE
PID:1636 -
\??\c:\jpjpj.exec:\jpjpj.exe40⤵
- Executes dropped EXE
PID:2580 -
\??\c:\frffllx.exec:\frffllx.exe41⤵
- Executes dropped EXE
PID:2608 -
\??\c:\rlflxfx.exec:\rlflxfx.exe42⤵
- Executes dropped EXE
PID:2568 -
\??\c:\bntntn.exec:\bntntn.exe43⤵
- Executes dropped EXE
PID:2628 -
\??\c:\pjjpd.exec:\pjjpd.exe44⤵
- Executes dropped EXE
PID:1384 -
\??\c:\rfxrrlr.exec:\rfxrrlr.exe45⤵
- Executes dropped EXE
PID:1908 -
\??\c:\9bnthn.exec:\9bnthn.exe46⤵
- Executes dropped EXE
PID:2884 -
\??\c:\pjdvd.exec:\pjdvd.exe47⤵
- Executes dropped EXE
PID:2912 -
\??\c:\pjdvj.exec:\pjdvj.exe48⤵
- Executes dropped EXE
PID:624 -
\??\c:\bnhhtt.exec:\bnhhtt.exe49⤵
- Executes dropped EXE
PID:860 -
\??\c:\ttntnh.exec:\ttntnh.exe50⤵
- Executes dropped EXE
PID:856 -
\??\c:\9jddd.exec:\9jddd.exe51⤵
- Executes dropped EXE
PID:484 -
\??\c:\1xlfrrf.exec:\1xlfrrf.exe52⤵
- Executes dropped EXE
PID:548 -
\??\c:\7ntthn.exec:\7ntthn.exe53⤵
- Executes dropped EXE
PID:1656 -
\??\c:\1hbhht.exec:\1hbhht.exe54⤵
- Executes dropped EXE
PID:2880 -
\??\c:\vvpdp.exec:\vvpdp.exe55⤵
- Executes dropped EXE
PID:1224 -
\??\c:\frflxfr.exec:\frflxfr.exe56⤵
- Executes dropped EXE
PID:604 -
\??\c:\htnhhn.exec:\htnhhn.exe57⤵
- Executes dropped EXE
PID:2952 -
\??\c:\jdppd.exec:\jdppd.exe58⤵
- Executes dropped EXE
PID:1416 -
\??\c:\1pdvj.exec:\1pdvj.exe59⤵
- Executes dropped EXE
PID:2228 -
\??\c:\lllxlrf.exec:\lllxlrf.exe60⤵
- Executes dropped EXE
PID:2104 -
\??\c:\nhhhtb.exec:\nhhhtb.exe61⤵
- Executes dropped EXE
PID:2172 -
\??\c:\ttnhbh.exec:\ttnhbh.exe62⤵
- Executes dropped EXE
PID:2400 -
\??\c:\dvjpp.exec:\dvjpp.exe63⤵
- Executes dropped EXE
PID:268 -
\??\c:\rlfflrx.exec:\rlfflrx.exe64⤵
- Executes dropped EXE
PID:1300 -
\??\c:\tbthhh.exec:\tbthhh.exe65⤵
- Executes dropped EXE
PID:2508 -
\??\c:\7jpvd.exec:\7jpvd.exe66⤵
- Executes dropped EXE
PID:1092 -
\??\c:\7frflrf.exec:\7frflrf.exe67⤵PID:2212
-
\??\c:\ttnbtt.exec:\ttnbtt.exe68⤵PID:1588
-
\??\c:\hnhthn.exec:\hnhthn.exe69⤵PID:376
-
\??\c:\dvppd.exec:\dvppd.exe70⤵PID:1476
-
\??\c:\lxllxfl.exec:\lxllxfl.exe71⤵PID:1612
-
\??\c:\7nhnbh.exec:\7nhnbh.exe72⤵PID:2976
-
\??\c:\jdpjp.exec:\jdpjp.exe73⤵PID:2460
-
\??\c:\vjvjv.exec:\vjvjv.exe74⤵PID:2472
-
\??\c:\rrxlxfr.exec:\rrxlxfr.exe75⤵PID:1012
-
\??\c:\hhtbnt.exec:\hhtbnt.exe76⤵PID:2424
-
\??\c:\3pddj.exec:\3pddj.exe77⤵PID:2660
-
\??\c:\rxlxrfr.exec:\rxlxrfr.exe78⤵PID:2656
-
\??\c:\hnhbbb.exec:\hnhbbb.exe79⤵PID:2944
-
\??\c:\nnbtnt.exec:\nnbtnt.exe80⤵PID:2828
-
\??\c:\dvjjv.exec:\dvjjv.exe81⤵PID:1520
-
\??\c:\llfxflr.exec:\llfxflr.exe82⤵PID:2576
-
\??\c:\7bbttt.exec:\7bbttt.exe83⤵PID:2744
-
\??\c:\nhhhbh.exec:\nhhhbh.exe84⤵PID:2556
-
\??\c:\vjvvv.exec:\vjvvv.exe85⤵PID:2616
-
\??\c:\lrxfrxr.exec:\lrxfrxr.exe86⤵PID:3004
-
\??\c:\nhbntb.exec:\nhbntb.exe87⤵PID:2720
-
\??\c:\nnbtbb.exec:\nnbtbb.exe88⤵PID:2876
-
\??\c:\vvvpd.exec:\vvvpd.exe89⤵PID:1356
-
\??\c:\9xlrrxf.exec:\9xlrrxf.exe90⤵PID:3040
-
\??\c:\hhhtnn.exec:\hhhtnn.exe91⤵PID:1220
-
\??\c:\jpvdv.exec:\jpvdv.exe92⤵PID:2128
-
\??\c:\xxxxffl.exec:\xxxxffl.exe93⤵PID:1336
-
\??\c:\rlfrxfl.exec:\rlfrxfl.exe94⤵PID:1280
-
\??\c:\bbnhnn.exec:\bbnhnn.exe95⤵PID:1904
-
\??\c:\vvppj.exec:\vvppj.exe96⤵PID:2860
-
\??\c:\1lffllr.exec:\1lffllr.exe97⤵PID:1624
-
\??\c:\xrffrlf.exec:\xrffrlf.exe98⤵PID:2880
-
\??\c:\3bbttb.exec:\3bbttb.exe99⤵PID:1224
-
\??\c:\pjppj.exec:\pjppj.exe100⤵PID:340
-
\??\c:\jjjpj.exec:\jjjpj.exe101⤵PID:2952
-
\??\c:\lrlrlfr.exec:\lrlrlfr.exe102⤵PID:2204
-
\??\c:\hbbhht.exec:\hbbhht.exe103⤵PID:2256
-
\??\c:\ttbtnt.exec:\ttbtnt.exe104⤵PID:2092
-
\??\c:\djjdp.exec:\djjdp.exe105⤵PID:688
-
\??\c:\7fllxxf.exec:\7fllxxf.exe106⤵PID:2400
-
\??\c:\btnnbb.exec:\btnnbb.exe107⤵PID:2516
-
\??\c:\vvjpp.exec:\vvjpp.exe108⤵PID:1696
-
\??\c:\xrfxlfl.exec:\xrfxlfl.exe109⤵PID:592
-
\??\c:\3xffxfl.exec:\3xffxfl.exe110⤵PID:784
-
\??\c:\bthhnt.exec:\bthhnt.exe111⤵PID:1980
-
\??\c:\jjjpv.exec:\jjjpv.exe112⤵PID:828
-
\??\c:\1lrlrlr.exec:\1lrlrlr.exe113⤵PID:2428
-
\??\c:\3tnhbb.exec:\3tnhbb.exe114⤵PID:2064
-
\??\c:\djvdj.exec:\djvdj.exe115⤵
- System Location Discovery: System Language Discovery
PID:1916 -
\??\c:\rlxlflx.exec:\rlxlflx.exe116⤵PID:1928
-
\??\c:\lllrflr.exec:\lllrflr.exe117⤵PID:816
-
\??\c:\pdppd.exec:\pdppd.exe118⤵PID:900
-
\??\c:\7rffxlx.exec:\7rffxlx.exe119⤵PID:2476
-
\??\c:\xlxffxf.exec:\xlxffxf.exe120⤵PID:2708
-
\??\c:\hhbbtn.exec:\hhbbtn.exe121⤵PID:2676
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-