Analysis
-
max time kernel
120s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-12-2024 04:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ac34cd531eb071147460eb52ac2c30fde2112c6617cc61ffc350e66ec06a5f76N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
ac34cd531eb071147460eb52ac2c30fde2112c6617cc61ffc350e66ec06a5f76N.exe
-
Size
454KB
-
MD5
ad077435c8f42a5f0f3e35e24bd734f0
-
SHA1
4f140d3c8bf6a466a6ab6abc0e71e57568752b7c
-
SHA256
ac34cd531eb071147460eb52ac2c30fde2112c6617cc61ffc350e66ec06a5f76
-
SHA512
9a471dde6d36e8cb7fa400f8d81117cc0087ec4f512cee60f7009f794a516b221314a0aa314f59c7b580c9a48db8f19684a6b3de6c3269b0298be0b90273253d
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeJV:q7Tc2NYHUrAwfMp3CDJV
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/1728-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2248-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/768-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-87-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2680-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1532-117-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1532-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1756-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1756-125-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1088-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1724-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-189-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2712-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1976-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2052-218-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1084-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/532-252-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1856-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1604-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/112-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-330-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2880-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1492-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1736-405-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2492-486-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1304-506-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2756-612-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-613-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2928-620-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1504-654-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-661-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2428-663-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1344-720-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2412-746-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/628-778-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/628-777-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2952 7hbhtb.exe 2380 jpdvj.exe 2248 ddppv.exe 768 xrlrflx.exe 2724 hhtnnb.exe 3000 rlfrfrf.exe 2624 nhnhtn.exe 2716 rrflxfx.exe 2728 ttthth.exe 2680 5jvjj.exe 1532 tnbhbb.exe 1756 vvjjv.exe 1388 flxxfxf.exe 1088 nhntbb.exe 2024 9rlfxfl.exe 1724 tnhtnn.exe 1416 jjdvd.exe 1956 frlrflx.exe 2712 hhbtbb.exe 1976 ddvdv.exe 2488 5xlrffl.exe 2052 hhbhtt.exe 824 xflrflx.exe 1084 3hnnbt.exe 940 9pdvp.exe 532 xrlxlfl.exe 1856 9hhtnt.exe 1664 rflrlrl.exe 2128 nnthnh.exe 1684 vpdpd.exe 1604 rxlrxrx.exe 1476 nhnthh.exe 2300 pjdvj.exe 2216 ppddp.exe 112 rlxxlxf.exe 2744 bnbhbh.exe 2880 bbhbtb.exe 2948 vpdpj.exe 3000 rrrlffr.exe 2776 3nhntt.exe 2788 vddjv.exe 2808 thnnnn.exe 2672 pvjjv.exe 2736 3lxxxxx.exe 1492 nhntbb.exe 1532 djdpj.exe 1736 vjpjp.exe 316 lfxlrrx.exe 1708 nbnnbt.exe 2136 vjvdj.exe 2516 ppvjd.exe 620 xfrfrlx.exe 1428 9nnbtn.exe 2676 tbtnnn.exe 2604 vpvvj.exe 2684 lxrxrlr.exe 2712 nbnbhh.exe 1868 1hbhbb.exe 2848 1jvjd.exe 2492 9rlxflx.exe 664 1lrlflx.exe 2268 ntntnt.exe 1304 jdppv.exe 2468 frxfxrx.exe -
resource yara_rule behavioral1/memory/1728-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/768-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1532-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1756-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1088-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1976-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1084-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1084-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1856-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1604-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/112-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-330-0x0000000000430000-0x000000000045A000-memory.dmp upx behavioral1/memory/2880-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1492-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1304-506-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/2080-513-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-565-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-612-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-620-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2748-621-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-628-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1504-654-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-663-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-684-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1344-720-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-746-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/628-778-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/628-777-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnthnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllxrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxrlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1fxrxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xxrxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xxffrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxllxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthtbb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1728 wrote to memory of 2952 1728 ac34cd531eb071147460eb52ac2c30fde2112c6617cc61ffc350e66ec06a5f76N.exe 31 PID 1728 wrote to memory of 2952 1728 ac34cd531eb071147460eb52ac2c30fde2112c6617cc61ffc350e66ec06a5f76N.exe 31 PID 1728 wrote to memory of 2952 1728 ac34cd531eb071147460eb52ac2c30fde2112c6617cc61ffc350e66ec06a5f76N.exe 31 PID 1728 wrote to memory of 2952 1728 ac34cd531eb071147460eb52ac2c30fde2112c6617cc61ffc350e66ec06a5f76N.exe 31 PID 2952 wrote to memory of 2380 2952 7hbhtb.exe 32 PID 2952 wrote to memory of 2380 2952 7hbhtb.exe 32 PID 2952 wrote to memory of 2380 2952 7hbhtb.exe 32 PID 2952 wrote to memory of 2380 2952 7hbhtb.exe 32 PID 2380 wrote to memory of 2248 2380 jpdvj.exe 33 PID 2380 wrote to memory of 2248 2380 jpdvj.exe 33 PID 2380 wrote to memory of 2248 2380 jpdvj.exe 33 PID 2380 wrote to memory of 2248 2380 jpdvj.exe 33 PID 2248 wrote to memory of 768 2248 ddppv.exe 34 PID 2248 wrote to memory of 768 2248 ddppv.exe 34 PID 2248 wrote to memory of 768 2248 ddppv.exe 34 PID 2248 wrote to memory of 768 2248 ddppv.exe 34 PID 768 wrote to memory of 2724 768 xrlrflx.exe 35 PID 768 wrote to memory of 2724 768 xrlrflx.exe 35 PID 768 wrote to memory of 2724 768 xrlrflx.exe 35 PID 768 wrote to memory of 2724 768 xrlrflx.exe 35 PID 2724 wrote to memory of 3000 2724 hhtnnb.exe 36 PID 2724 wrote to memory of 3000 2724 hhtnnb.exe 36 PID 2724 wrote to memory of 3000 2724 hhtnnb.exe 36 PID 2724 wrote to memory of 3000 2724 hhtnnb.exe 36 PID 3000 wrote to memory of 2624 3000 rlfrfrf.exe 37 PID 3000 wrote to memory of 2624 3000 rlfrfrf.exe 37 PID 3000 wrote to memory of 2624 3000 rlfrfrf.exe 37 PID 3000 wrote to memory of 2624 3000 rlfrfrf.exe 37 PID 2624 wrote to memory of 2716 2624 nhnhtn.exe 38 PID 2624 wrote to memory of 2716 2624 nhnhtn.exe 38 PID 2624 wrote to memory of 2716 2624 nhnhtn.exe 38 PID 2624 wrote to memory of 2716 2624 nhnhtn.exe 38 PID 2716 wrote to memory of 2728 2716 rrflxfx.exe 39 PID 2716 wrote to memory of 2728 2716 rrflxfx.exe 39 PID 2716 wrote to memory of 2728 2716 rrflxfx.exe 39 PID 2716 wrote to memory of 2728 2716 rrflxfx.exe 39 PID 2728 wrote to memory of 2680 2728 ttthth.exe 40 PID 2728 wrote to memory of 2680 2728 ttthth.exe 40 PID 2728 wrote to memory of 2680 2728 ttthth.exe 40 PID 2728 wrote to memory of 2680 2728 ttthth.exe 40 PID 2680 wrote to memory of 1532 2680 5jvjj.exe 41 PID 2680 wrote to memory of 1532 2680 5jvjj.exe 41 PID 2680 wrote to memory of 1532 2680 5jvjj.exe 41 PID 2680 wrote to memory of 1532 2680 5jvjj.exe 41 PID 1532 wrote to memory of 1756 1532 tnbhbb.exe 42 PID 1532 wrote to memory of 1756 1532 tnbhbb.exe 42 PID 1532 wrote to memory of 1756 1532 tnbhbb.exe 42 PID 1532 wrote to memory of 1756 1532 tnbhbb.exe 42 PID 1756 wrote to memory of 1388 1756 vvjjv.exe 43 PID 1756 wrote to memory of 1388 1756 vvjjv.exe 43 PID 1756 wrote to memory of 1388 1756 vvjjv.exe 43 PID 1756 wrote to memory of 1388 1756 vvjjv.exe 43 PID 1388 wrote to memory of 1088 1388 flxxfxf.exe 44 PID 1388 wrote to memory of 1088 1388 flxxfxf.exe 44 PID 1388 wrote to memory of 1088 1388 flxxfxf.exe 44 PID 1388 wrote to memory of 1088 1388 flxxfxf.exe 44 PID 1088 wrote to memory of 2024 1088 nhntbb.exe 45 PID 1088 wrote to memory of 2024 1088 nhntbb.exe 45 PID 1088 wrote to memory of 2024 1088 nhntbb.exe 45 PID 1088 wrote to memory of 2024 1088 nhntbb.exe 45 PID 2024 wrote to memory of 1724 2024 9rlfxfl.exe 46 PID 2024 wrote to memory of 1724 2024 9rlfxfl.exe 46 PID 2024 wrote to memory of 1724 2024 9rlfxfl.exe 46 PID 2024 wrote to memory of 1724 2024 9rlfxfl.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac34cd531eb071147460eb52ac2c30fde2112c6617cc61ffc350e66ec06a5f76N.exe"C:\Users\Admin\AppData\Local\Temp\ac34cd531eb071147460eb52ac2c30fde2112c6617cc61ffc350e66ec06a5f76N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\7hbhtb.exec:\7hbhtb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\jpdvj.exec:\jpdvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\ddppv.exec:\ddppv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\xrlrflx.exec:\xrlrflx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
\??\c:\hhtnnb.exec:\hhtnnb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\rlfrfrf.exec:\rlfrfrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\nhnhtn.exec:\nhnhtn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\rrflxfx.exec:\rrflxfx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\ttthth.exec:\ttthth.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\5jvjj.exec:\5jvjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\tnbhbb.exec:\tnbhbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\vvjjv.exec:\vvjjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
\??\c:\flxxfxf.exec:\flxxfxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\nhntbb.exec:\nhntbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
\??\c:\9rlfxfl.exec:\9rlfxfl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\tnhtnn.exec:\tnhtnn.exe17⤵
- Executes dropped EXE
PID:1724 -
\??\c:\jjdvd.exec:\jjdvd.exe18⤵
- Executes dropped EXE
PID:1416 -
\??\c:\frlrflx.exec:\frlrflx.exe19⤵
- Executes dropped EXE
PID:1956 -
\??\c:\hhbtbb.exec:\hhbtbb.exe20⤵
- Executes dropped EXE
PID:2712 -
\??\c:\ddvdv.exec:\ddvdv.exe21⤵
- Executes dropped EXE
PID:1976 -
\??\c:\5xlrffl.exec:\5xlrffl.exe22⤵
- Executes dropped EXE
PID:2488 -
\??\c:\hhbhtt.exec:\hhbhtt.exe23⤵
- Executes dropped EXE
PID:2052 -
\??\c:\xflrflx.exec:\xflrflx.exe24⤵
- Executes dropped EXE
PID:824 -
\??\c:\3hnnbt.exec:\3hnnbt.exe25⤵
- Executes dropped EXE
PID:1084 -
\??\c:\9pdvp.exec:\9pdvp.exe26⤵
- Executes dropped EXE
PID:940 -
\??\c:\xrlxlfl.exec:\xrlxlfl.exe27⤵
- Executes dropped EXE
PID:532 -
\??\c:\9hhtnt.exec:\9hhtnt.exe28⤵
- Executes dropped EXE
PID:1856 -
\??\c:\rflrlrl.exec:\rflrlrl.exe29⤵
- Executes dropped EXE
PID:1664 -
\??\c:\nnthnh.exec:\nnthnh.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2128 -
\??\c:\vpdpd.exec:\vpdpd.exe31⤵
- Executes dropped EXE
PID:1684 -
\??\c:\rxlrxrx.exec:\rxlrxrx.exe32⤵
- Executes dropped EXE
PID:1604 -
\??\c:\nhnthh.exec:\nhnthh.exe33⤵
- Executes dropped EXE
PID:1476 -
\??\c:\pjdvj.exec:\pjdvj.exe34⤵
- Executes dropped EXE
PID:2300 -
\??\c:\ppddp.exec:\ppddp.exe35⤵
- Executes dropped EXE
PID:2216 -
\??\c:\rlxxlxf.exec:\rlxxlxf.exe36⤵
- Executes dropped EXE
PID:112 -
\??\c:\bnbhbh.exec:\bnbhbh.exe37⤵
- Executes dropped EXE
PID:2744 -
\??\c:\bbhbtb.exec:\bbhbtb.exe38⤵
- Executes dropped EXE
PID:2880 -
\??\c:\vpdpj.exec:\vpdpj.exe39⤵
- Executes dropped EXE
PID:2948 -
\??\c:\rrrlffr.exec:\rrrlffr.exe40⤵
- Executes dropped EXE
PID:3000 -
\??\c:\3nhntt.exec:\3nhntt.exe41⤵
- Executes dropped EXE
PID:2776 -
\??\c:\vddjv.exec:\vddjv.exe42⤵
- Executes dropped EXE
PID:2788 -
\??\c:\thnnnn.exec:\thnnnn.exe43⤵
- Executes dropped EXE
PID:2808 -
\??\c:\pvjjv.exec:\pvjjv.exe44⤵
- Executes dropped EXE
PID:2672 -
\??\c:\3lxxxxx.exec:\3lxxxxx.exe45⤵
- Executes dropped EXE
PID:2736 -
\??\c:\nhntbb.exec:\nhntbb.exe46⤵
- Executes dropped EXE
PID:1492 -
\??\c:\djdpj.exec:\djdpj.exe47⤵
- Executes dropped EXE
PID:1532 -
\??\c:\vjpjp.exec:\vjpjp.exe48⤵
- Executes dropped EXE
PID:1736 -
\??\c:\lfxlrrx.exec:\lfxlrrx.exe49⤵
- Executes dropped EXE
PID:316 -
\??\c:\nbnnbt.exec:\nbnnbt.exe50⤵
- Executes dropped EXE
PID:1708 -
\??\c:\vjvdj.exec:\vjvdj.exe51⤵
- Executes dropped EXE
PID:2136 -
\??\c:\ppvjd.exec:\ppvjd.exe52⤵
- Executes dropped EXE
PID:2516 -
\??\c:\xfrfrlx.exec:\xfrfrlx.exe53⤵
- Executes dropped EXE
PID:620 -
\??\c:\9nnbtn.exec:\9nnbtn.exe54⤵
- Executes dropped EXE
PID:1428 -
\??\c:\tbtnnn.exec:\tbtnnn.exe55⤵
- Executes dropped EXE
PID:2676 -
\??\c:\vpvvj.exec:\vpvvj.exe56⤵
- Executes dropped EXE
PID:2604 -
\??\c:\lxrxrlr.exec:\lxrxrlr.exe57⤵
- Executes dropped EXE
PID:2684 -
\??\c:\nbnbhh.exec:\nbnbhh.exe58⤵
- Executes dropped EXE
PID:2712 -
\??\c:\1hbhbb.exec:\1hbhbb.exe59⤵
- Executes dropped EXE
PID:1868 -
\??\c:\1jvjd.exec:\1jvjd.exe60⤵
- Executes dropped EXE
PID:2848 -
\??\c:\9rlxflx.exec:\9rlxflx.exe61⤵
- Executes dropped EXE
PID:2492 -
\??\c:\1lrlflx.exec:\1lrlflx.exe62⤵
- Executes dropped EXE
PID:664 -
\??\c:\ntntnt.exec:\ntntnt.exe63⤵
- Executes dropped EXE
PID:2268 -
\??\c:\jdppv.exec:\jdppv.exe64⤵
- Executes dropped EXE
PID:1304 -
\??\c:\frxfxrx.exec:\frxfxrx.exe65⤵
- Executes dropped EXE
PID:2468 -
\??\c:\3xrxflr.exec:\3xrxflr.exe66⤵PID:2080
-
\??\c:\5ntbbh.exec:\5ntbbh.exe67⤵PID:532
-
\??\c:\jjvvp.exec:\jjvvp.exe68⤵PID:3008
-
\??\c:\3jvvd.exec:\3jvvd.exe69⤵PID:2400
-
\??\c:\9fxfxfr.exec:\9fxfxfr.exe70⤵PID:1664
-
\??\c:\nhhthn.exec:\nhhthn.exe71⤵PID:2128
-
\??\c:\jvdjj.exec:\jvdjj.exe72⤵PID:2528
-
\??\c:\7pvdd.exec:\7pvdd.exe73⤵
- System Location Discovery: System Language Discovery
PID:696 -
\??\c:\1rffllx.exec:\1rffllx.exe74⤵PID:3032
-
\??\c:\btthbn.exec:\btthbn.exe75⤵PID:1980
-
\??\c:\7jdpv.exec:\7jdpv.exe76⤵PID:2976
-
\??\c:\xfrrxxf.exec:\xfrrxxf.exe77⤵PID:2376
-
\??\c:\xlffflx.exec:\xlffflx.exe78⤵PID:2328
-
\??\c:\thttnt.exec:\thttnt.exe79⤵PID:2888
-
\??\c:\ddvjd.exec:\ddvjd.exe80⤵PID:2756
-
\??\c:\ffrxlrf.exec:\ffrxlrf.exe81⤵PID:2928
-
\??\c:\frffxxl.exec:\frffxxl.exe82⤵PID:2748
-
\??\c:\nhtbnn.exec:\nhtbnn.exe83⤵PID:2776
-
\??\c:\jdpvd.exec:\jdpvd.exe84⤵PID:2788
-
\??\c:\5xrfxfr.exec:\5xrfxfr.exe85⤵PID:2808
-
\??\c:\rfrxffl.exec:\rfrxffl.exe86⤵PID:1504
-
\??\c:\7nbttb.exec:\7nbttb.exe87⤵PID:2876
-
\??\c:\3pjjp.exec:\3pjjp.exe88⤵PID:2428
-
\??\c:\7pjvd.exec:\7pjvd.exe89⤵PID:1756
-
\??\c:\lfxxllx.exec:\lfxxllx.exe90⤵PID:2188
-
\??\c:\nbthhb.exec:\nbthhb.exe91⤵PID:2044
-
\??\c:\vjvdp.exec:\vjvdp.exe92⤵PID:1152
-
\??\c:\dpvvp.exec:\dpvvp.exe93⤵PID:1436
-
\??\c:\5llllfl.exec:\5llllfl.exe94⤵PID:1724
-
\??\c:\tttnht.exec:\tttnht.exe95⤵PID:2856
-
\??\c:\pjppj.exec:\pjppj.exe96⤵PID:1344
-
\??\c:\7vvpp.exec:\7vvpp.exe97⤵PID:2836
-
\??\c:\lfllxff.exec:\lfllxff.exe98⤵PID:2820
-
\??\c:\bnbtbb.exec:\bnbtbb.exe99⤵PID:2412
-
\??\c:\tnbhhn.exec:\tnbhhn.exe100⤵PID:2440
-
\??\c:\3pvpp.exec:\3pvpp.exe101⤵PID:828
-
\??\c:\9jjvp.exec:\9jjvp.exe102⤵PID:1636
-
\??\c:\xrrfrlx.exec:\xrrfrlx.exe103⤵PID:824
-
\??\c:\hbbnhn.exec:\hbbnhn.exe104⤵PID:628
-
\??\c:\tnhbhb.exec:\tnhbhb.exe105⤵PID:940
-
\??\c:\jvjjp.exec:\jvjjp.exe106⤵PID:1760
-
\??\c:\lxlxfxx.exec:\lxlxfxx.exe107⤵PID:580
-
\??\c:\1frfrlf.exec:\1frfrlf.exe108⤵PID:1876
-
\??\c:\thtbht.exec:\thtbht.exe109⤵PID:1216
-
\??\c:\vjpjp.exec:\vjpjp.exe110⤵PID:2040
-
\??\c:\fxxrffl.exec:\fxxrffl.exe111⤵PID:2240
-
\??\c:\5lfffxl.exec:\5lfffxl.exe112⤵PID:2568
-
\??\c:\nhnthh.exec:\nhnthh.exe113⤵PID:540
-
\??\c:\jdvdp.exec:\jdvdp.exe114⤵PID:1476
-
\??\c:\jpvjd.exec:\jpvjd.exe115⤵PID:2980
-
\??\c:\3xxrxrl.exec:\3xxrxrl.exe116⤵
- System Location Discovery: System Language Discovery
PID:2216 -
\??\c:\htnhth.exec:\htnhth.exe117⤵PID:2760
-
\??\c:\hnhnbt.exec:\hnhnbt.exe118⤵
- System Location Discovery: System Language Discovery
PID:2376 -
\??\c:\pdpvj.exec:\pdpvj.exe119⤵PID:2940
-
\??\c:\9xrxfxf.exec:\9xrxfxf.exe120⤵PID:2888
-
\??\c:\lfllfrr.exec:\lfllfrr.exe121⤵PID:2308
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-