Analysis
-
max time kernel
120s -
max time network
21s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-12-2024 03:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
79e43598037799f51c687a9b8e476d278664e503a6d58467b3f013a9cdffb101N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
79e43598037799f51c687a9b8e476d278664e503a6d58467b3f013a9cdffb101N.exe
-
Size
454KB
-
MD5
cda2374ed123383a6ca4815a46f961a0
-
SHA1
8c1e6fafece381afdfbaab2bc046b0112c896812
-
SHA256
79e43598037799f51c687a9b8e476d278664e503a6d58467b3f013a9cdffb101
-
SHA512
b09c1bbbecdcd4559e76dce673efcd824c78f3bd0b2c61981fd93c4d45730e3735259bbf48c5b7ffac78f1e2e755d4c2cf198bbf7d377cc4c6adac016014ff54
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbek:q7Tc2NYHUrAwfMp3CDk
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/2344-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1044-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1044-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2280-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2388-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2228-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/772-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/580-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1696-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1716-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2428-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2416-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2948-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1528-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/108-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1356-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1672-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/880-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2492-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2492-300-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1644-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1644-307-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/3004-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-345-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2828-364-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/680-414-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/772-418-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1780-447-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-508-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1744-516-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-548-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/1580-582-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1580-581-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2716-651-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2716-653-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-690-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3040-856-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1044-875-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2556-941-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2240-1001-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/696-1026-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/696-1046-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1044 lflfflf.exe 2280 lxfxxrr.exe 2348 vvppd.exe 1708 lfxrflr.exe 2808 lfrflfl.exe 2708 5tbnbh.exe 2388 xflxffl.exe 2892 nntbbn.exe 2112 lxlfxxf.exe 2632 bbnnht.exe 2228 ffxlfrl.exe 2024 thbbbt.exe 772 vpjpd.exe 580 7lfxlxl.exe 1696 9tnnbh.exe 1716 xfxlxxr.exe 2624 9rlrflx.exe 2428 7hbbhn.exe 2116 djjvp.exe 2416 bnntnt.exe 2772 rxlxfrx.exe 1352 tnntth.exe 2652 5thnbh.exe 2856 nnbtbb.exe 2948 9hhnhn.exe 1528 dpvjd.exe 108 tbhbtb.exe 1356 dppdd.exe 1672 jvjdd.exe 880 5vjvd.exe 2496 bhnhnn.exe 2492 jvppj.exe 1644 htthhn.exe 2092 ddvdv.exe 3060 hnthbh.exe 3004 vjjpp.exe 2684 flfrfrx.exe 2828 thhthb.exe 2932 dvddv.exe 2152 rrrrffr.exe 2848 7nnnbn.exe 2200 jpdpp.exe 2292 lflfrff.exe 2792 hnbbth.exe 3020 dpddd.exe 2572 dpjjj.exe 2608 llrlflf.exe 1300 vvppp.exe 680 xflxfrr.exe 772 bnhhbn.exe 2352 jvpdd.exe 2332 rlrllxx.exe 1884 nnttnh.exe 1780 vdvjd.exe 1408 nnhthb.exe 2912 vvvpd.exe 2392 xlffrrr.exe 948 tnnnbn.exe 2376 vpjdp.exe 1256 frffrrf.exe 1032 btthbn.exe 1704 dvvpv.exe 1700 lfxlrfr.exe 2540 nnhttb.exe -
resource yara_rule behavioral1/memory/2344-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1044-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/772-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/580-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2416-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/108-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1356-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/880-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/772-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1780-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-516-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1580-582-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-653-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-856-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2676-928-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2240-994-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/608-1033-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbtbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nhtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxrflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nnhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flflrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflfrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffflfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxllxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxrlxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllrxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flflxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllflfl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2344 wrote to memory of 1044 2344 79e43598037799f51c687a9b8e476d278664e503a6d58467b3f013a9cdffb101N.exe 31 PID 2344 wrote to memory of 1044 2344 79e43598037799f51c687a9b8e476d278664e503a6d58467b3f013a9cdffb101N.exe 31 PID 2344 wrote to memory of 1044 2344 79e43598037799f51c687a9b8e476d278664e503a6d58467b3f013a9cdffb101N.exe 31 PID 2344 wrote to memory of 1044 2344 79e43598037799f51c687a9b8e476d278664e503a6d58467b3f013a9cdffb101N.exe 31 PID 1044 wrote to memory of 2280 1044 lflfflf.exe 32 PID 1044 wrote to memory of 2280 1044 lflfflf.exe 32 PID 1044 wrote to memory of 2280 1044 lflfflf.exe 32 PID 1044 wrote to memory of 2280 1044 lflfflf.exe 32 PID 2280 wrote to memory of 2348 2280 lxfxxrr.exe 33 PID 2280 wrote to memory of 2348 2280 lxfxxrr.exe 33 PID 2280 wrote to memory of 2348 2280 lxfxxrr.exe 33 PID 2280 wrote to memory of 2348 2280 lxfxxrr.exe 33 PID 2348 wrote to memory of 1708 2348 vvppd.exe 34 PID 2348 wrote to memory of 1708 2348 vvppd.exe 34 PID 2348 wrote to memory of 1708 2348 vvppd.exe 34 PID 2348 wrote to memory of 1708 2348 vvppd.exe 34 PID 1708 wrote to memory of 2808 1708 lfxrflr.exe 35 PID 1708 wrote to memory of 2808 1708 lfxrflr.exe 35 PID 1708 wrote to memory of 2808 1708 lfxrflr.exe 35 PID 1708 wrote to memory of 2808 1708 lfxrflr.exe 35 PID 2808 wrote to memory of 2708 2808 lfrflfl.exe 36 PID 2808 wrote to memory of 2708 2808 lfrflfl.exe 36 PID 2808 wrote to memory of 2708 2808 lfrflfl.exe 36 PID 2808 wrote to memory of 2708 2808 lfrflfl.exe 36 PID 2708 wrote to memory of 2388 2708 5tbnbh.exe 37 PID 2708 wrote to memory of 2388 2708 5tbnbh.exe 37 PID 2708 wrote to memory of 2388 2708 5tbnbh.exe 37 PID 2708 wrote to memory of 2388 2708 5tbnbh.exe 37 PID 2388 wrote to memory of 2892 2388 xflxffl.exe 38 PID 2388 wrote to memory of 2892 2388 xflxffl.exe 38 PID 2388 wrote to memory of 2892 2388 xflxffl.exe 38 PID 2388 wrote to memory of 2892 2388 xflxffl.exe 38 PID 2892 wrote to memory of 2112 2892 nntbbn.exe 39 PID 2892 wrote to memory of 2112 2892 nntbbn.exe 39 PID 2892 wrote to memory of 2112 2892 nntbbn.exe 39 PID 2892 wrote to memory of 2112 2892 nntbbn.exe 39 PID 2112 wrote to memory of 2632 2112 lxlfxxf.exe 40 PID 2112 wrote to memory of 2632 2112 lxlfxxf.exe 40 PID 2112 wrote to memory of 2632 2112 lxlfxxf.exe 40 PID 2112 wrote to memory of 2632 2112 lxlfxxf.exe 40 PID 2632 wrote to memory of 2228 2632 bbnnht.exe 41 PID 2632 wrote to memory of 2228 2632 bbnnht.exe 41 PID 2632 wrote to memory of 2228 2632 bbnnht.exe 41 PID 2632 wrote to memory of 2228 2632 bbnnht.exe 41 PID 2228 wrote to memory of 2024 2228 ffxlfrl.exe 42 PID 2228 wrote to memory of 2024 2228 ffxlfrl.exe 42 PID 2228 wrote to memory of 2024 2228 ffxlfrl.exe 42 PID 2228 wrote to memory of 2024 2228 ffxlfrl.exe 42 PID 2024 wrote to memory of 772 2024 thbbbt.exe 43 PID 2024 wrote to memory of 772 2024 thbbbt.exe 43 PID 2024 wrote to memory of 772 2024 thbbbt.exe 43 PID 2024 wrote to memory of 772 2024 thbbbt.exe 43 PID 772 wrote to memory of 580 772 vpjpd.exe 44 PID 772 wrote to memory of 580 772 vpjpd.exe 44 PID 772 wrote to memory of 580 772 vpjpd.exe 44 PID 772 wrote to memory of 580 772 vpjpd.exe 44 PID 580 wrote to memory of 1696 580 7lfxlxl.exe 45 PID 580 wrote to memory of 1696 580 7lfxlxl.exe 45 PID 580 wrote to memory of 1696 580 7lfxlxl.exe 45 PID 580 wrote to memory of 1696 580 7lfxlxl.exe 45 PID 1696 wrote to memory of 1716 1696 9tnnbh.exe 46 PID 1696 wrote to memory of 1716 1696 9tnnbh.exe 46 PID 1696 wrote to memory of 1716 1696 9tnnbh.exe 46 PID 1696 wrote to memory of 1716 1696 9tnnbh.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\79e43598037799f51c687a9b8e476d278664e503a6d58467b3f013a9cdffb101N.exe"C:\Users\Admin\AppData\Local\Temp\79e43598037799f51c687a9b8e476d278664e503a6d58467b3f013a9cdffb101N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\lflfflf.exec:\lflfflf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
\??\c:\lxfxxrr.exec:\lxfxxrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\vvppd.exec:\vvppd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\lfxrflr.exec:\lfxrflr.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\lfrflfl.exec:\lfrflfl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\5tbnbh.exec:\5tbnbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\xflxffl.exec:\xflxffl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\nntbbn.exec:\nntbbn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\lxlfxxf.exec:\lxlfxxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\bbnnht.exec:\bbnnht.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\ffxlfrl.exec:\ffxlfrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\thbbbt.exec:\thbbbt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\vpjpd.exec:\vpjpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
\??\c:\7lfxlxl.exec:\7lfxlxl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:580 -
\??\c:\9tnnbh.exec:\9tnnbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\xfxlxxr.exec:\xfxlxxr.exe17⤵
- Executes dropped EXE
PID:1716 -
\??\c:\9rlrflx.exec:\9rlrflx.exe18⤵
- Executes dropped EXE
PID:2624 -
\??\c:\7hbbhn.exec:\7hbbhn.exe19⤵
- Executes dropped EXE
PID:2428 -
\??\c:\djjvp.exec:\djjvp.exe20⤵
- Executes dropped EXE
PID:2116 -
\??\c:\bnntnt.exec:\bnntnt.exe21⤵
- Executes dropped EXE
PID:2416 -
\??\c:\rxlxfrx.exec:\rxlxfrx.exe22⤵
- Executes dropped EXE
PID:2772 -
\??\c:\tnntth.exec:\tnntth.exe23⤵
- Executes dropped EXE
PID:1352 -
\??\c:\5thnbh.exec:\5thnbh.exe24⤵
- Executes dropped EXE
PID:2652 -
\??\c:\nnbtbb.exec:\nnbtbb.exe25⤵
- Executes dropped EXE
PID:2856 -
\??\c:\9hhnhn.exec:\9hhnhn.exe26⤵
- Executes dropped EXE
PID:2948 -
\??\c:\dpvjd.exec:\dpvjd.exe27⤵
- Executes dropped EXE
PID:1528 -
\??\c:\tbhbtb.exec:\tbhbtb.exe28⤵
- Executes dropped EXE
PID:108 -
\??\c:\dppdd.exec:\dppdd.exe29⤵
- Executes dropped EXE
PID:1356 -
\??\c:\jvjdd.exec:\jvjdd.exe30⤵
- Executes dropped EXE
PID:1672 -
\??\c:\5vjvd.exec:\5vjvd.exe31⤵
- Executes dropped EXE
PID:880 -
\??\c:\bhnhnn.exec:\bhnhnn.exe32⤵
- Executes dropped EXE
PID:2496 -
\??\c:\jvppj.exec:\jvppj.exe33⤵
- Executes dropped EXE
PID:2492 -
\??\c:\htthhn.exec:\htthhn.exe34⤵
- Executes dropped EXE
PID:1644 -
\??\c:\ddvdv.exec:\ddvdv.exe35⤵
- Executes dropped EXE
PID:2092 -
\??\c:\hnthbh.exec:\hnthbh.exe36⤵
- Executes dropped EXE
PID:3060 -
\??\c:\vjjpp.exec:\vjjpp.exe37⤵
- Executes dropped EXE
PID:3004 -
\??\c:\flfrfrx.exec:\flfrfrx.exe38⤵
- Executes dropped EXE
PID:2684 -
\??\c:\thhthb.exec:\thhthb.exe39⤵
- Executes dropped EXE
PID:2828 -
\??\c:\dvddv.exec:\dvddv.exe40⤵
- Executes dropped EXE
PID:2932 -
\??\c:\rrrrffr.exec:\rrrrffr.exe41⤵
- Executes dropped EXE
PID:2152 -
\??\c:\7nnnbn.exec:\7nnnbn.exe42⤵
- Executes dropped EXE
PID:2848 -
\??\c:\jpdpp.exec:\jpdpp.exe43⤵
- Executes dropped EXE
PID:2200 -
\??\c:\lflfrff.exec:\lflfrff.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2292 -
\??\c:\hnbbth.exec:\hnbbth.exe45⤵
- Executes dropped EXE
PID:2792 -
\??\c:\dpddd.exec:\dpddd.exe46⤵
- Executes dropped EXE
PID:3020 -
\??\c:\dpjjj.exec:\dpjjj.exe47⤵
- Executes dropped EXE
PID:2572 -
\??\c:\llrlflf.exec:\llrlflf.exe48⤵
- Executes dropped EXE
PID:2608 -
\??\c:\vvppp.exec:\vvppp.exe49⤵
- Executes dropped EXE
PID:1300 -
\??\c:\xflxfrr.exec:\xflxfrr.exe50⤵
- Executes dropped EXE
PID:680 -
\??\c:\bnhhbn.exec:\bnhhbn.exe51⤵
- Executes dropped EXE
PID:772 -
\??\c:\jvpdd.exec:\jvpdd.exe52⤵
- Executes dropped EXE
PID:2352 -
\??\c:\rlrllxx.exec:\rlrllxx.exe53⤵
- Executes dropped EXE
PID:2332 -
\??\c:\nnttnh.exec:\nnttnh.exe54⤵
- Executes dropped EXE
PID:1884 -
\??\c:\vdvjd.exec:\vdvjd.exe55⤵
- Executes dropped EXE
PID:1780 -
\??\c:\nnhthb.exec:\nnhthb.exe56⤵
- Executes dropped EXE
PID:1408 -
\??\c:\vvvpd.exec:\vvvpd.exe57⤵
- Executes dropped EXE
PID:2912 -
\??\c:\xlffrrr.exec:\xlffrrr.exe58⤵
- Executes dropped EXE
PID:2392 -
\??\c:\tnnnbn.exec:\tnnnbn.exe59⤵
- Executes dropped EXE
PID:948 -
\??\c:\vpjdp.exec:\vpjdp.exe60⤵
- Executes dropped EXE
PID:2376 -
\??\c:\frffrrf.exec:\frffrrf.exe61⤵
- Executes dropped EXE
PID:1256 -
\??\c:\btthbn.exec:\btthbn.exe62⤵
- Executes dropped EXE
PID:1032 -
\??\c:\dvvpv.exec:\dvvpv.exe63⤵
- Executes dropped EXE
PID:1704 -
\??\c:\lfxlrfr.exec:\lfxlrfr.exe64⤵
- Executes dropped EXE
PID:1700 -
\??\c:\nnhttb.exec:\nnhttb.exe65⤵
- Executes dropped EXE
PID:2540 -
\??\c:\vpjdp.exec:\vpjdp.exe66⤵PID:1744
-
\??\c:\hhbbtt.exec:\hhbbtt.exe67⤵PID:1520
-
\??\c:\vvpjd.exec:\vvpjd.exe68⤵PID:996
-
\??\c:\flfxrff.exec:\flfxrff.exe69⤵PID:2224
-
\??\c:\nnnthn.exec:\nnnthn.exe70⤵PID:2100
-
\??\c:\9ddjd.exec:\9ddjd.exe71⤵PID:2448
-
\??\c:\lrxlrll.exec:\lrxlrll.exe72⤵PID:2244
-
\??\c:\xlflrrf.exec:\xlflrrf.exe73⤵PID:1672
-
\??\c:\7bbnbt.exec:\7bbnbt.exe74⤵PID:2992
-
\??\c:\pdpdp.exec:\pdpdp.exe75⤵PID:2496
-
\??\c:\xxxfrxl.exec:\xxxfrxl.exe76⤵PID:1580
-
\??\c:\hnthhb.exec:\hnthhb.exe77⤵PID:2160
-
\??\c:\bbhbnb.exec:\bbhbnb.exe78⤵PID:1044
-
\??\c:\9vpvj.exec:\9vpvj.exe79⤵PID:2860
-
\??\c:\1lrlrfl.exec:\1lrlrfl.exe80⤵PID:2372
-
\??\c:\9nnhhh.exec:\9nnhhh.exe81⤵PID:2804
-
\??\c:\vpdjv.exec:\vpdjv.exe82⤵PID:2184
-
\??\c:\rllrlrl.exec:\rllrlrl.exe83⤵PID:2828
-
\??\c:\bntnnn.exec:\bntnnn.exe84⤵PID:2592
-
\??\c:\pdppv.exec:\pdppv.exe85⤵PID:2712
-
\??\c:\lllrflx.exec:\lllrflx.exe86⤵PID:2752
-
\??\c:\hhnbtb.exec:\hhnbtb.exe87⤵PID:2716
-
\??\c:\3vdpv.exec:\3vdpv.exe88⤵PID:2560
-
\??\c:\xrlrxxf.exec:\xrlrxxf.exe89⤵PID:2632
-
\??\c:\htbtbn.exec:\htbtbn.exe90⤵PID:2600
-
\??\c:\pjdvd.exec:\pjdvd.exe91⤵PID:836
-
\??\c:\5ffllrx.exec:\5ffllrx.exe92⤵PID:2608
-
\??\c:\hntnnh.exec:\hntnnh.exe93⤵PID:2620
-
\??\c:\pvpjj.exec:\pvpjj.exe94⤵PID:2004
-
\??\c:\flrrflr.exec:\flrrflr.exe95⤵PID:1488
-
\??\c:\ttbbth.exec:\ttbbth.exe96⤵PID:1624
-
\??\c:\dvddd.exec:\dvddd.exe97⤵PID:1960
-
\??\c:\fffrxlx.exec:\fffrxlx.exe98⤵PID:1716
-
\??\c:\3bbhtb.exec:\3bbhtb.exe99⤵PID:2656
-
\??\c:\tnbbnt.exec:\tnbbnt.exe100⤵PID:2908
-
\??\c:\jdvdp.exec:\jdvdp.exe101⤵PID:2876
-
\??\c:\fxxfxfx.exec:\fxxfxfx.exe102⤵PID:2368
-
\??\c:\hbthhn.exec:\hbthhn.exe103⤵PID:664
-
\??\c:\1djvv.exec:\1djvv.exe104⤵PID:2780
-
\??\c:\fxrrffr.exec:\fxrrffr.exe105⤵PID:1256
-
\??\c:\5tbnht.exec:\5tbnht.exe106⤵PID:1032
-
\??\c:\vpjvp.exec:\vpjvp.exe107⤵PID:1704
-
\??\c:\jjjvj.exec:\jjjvj.exe108⤵PID:1880
-
\??\c:\rlffrxr.exec:\rlffrxr.exe109⤵PID:980
-
\??\c:\tbtbtt.exec:\tbtbtt.exe110⤵
- System Location Discovery: System Language Discovery
PID:2856 -
\??\c:\vpjdd.exec:\vpjdd.exe111⤵PID:2532
-
\??\c:\ffrfffr.exec:\ffrfffr.exe112⤵PID:1652
-
\??\c:\3bthnh.exec:\3bthnh.exe113⤵PID:1588
-
\??\c:\nnbhbh.exec:\nnbhbh.exe114⤵PID:2400
-
\??\c:\3pddp.exec:\3pddp.exe115⤵PID:2072
-
\??\c:\9xflxfl.exec:\9xflxfl.exe116⤵PID:2320
-
\??\c:\3thtnh.exec:\3thtnh.exe117⤵PID:1980
-
\??\c:\jjdjp.exec:\jjdjp.exe118⤵PID:2076
-
\??\c:\9fflxlx.exec:\9fflxlx.exe119⤵PID:320
-
\??\c:\nhhnnt.exec:\nhhnnt.exe120⤵PID:3040
-
\??\c:\jjvvj.exec:\jjvvj.exe121⤵PID:1644
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-