Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
20-12-2024 04:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
28e8484f5e4fc7154a3f7556fb5d6cd78455abe4e196bbf81c05e1a6252cbbb3N.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
28e8484f5e4fc7154a3f7556fb5d6cd78455abe4e196bbf81c05e1a6252cbbb3N.exe
-
Size
454KB
-
MD5
1fe989f63790ff338c72e305d6addf10
-
SHA1
d51d53c83754a9691cde009327ab834d1f937d37
-
SHA256
28e8484f5e4fc7154a3f7556fb5d6cd78455abe4e196bbf81c05e1a6252cbbb3
-
SHA512
84642d7eba94ed6e567b49e10b992510e7088a1224c3d4b160e42b1f0df3c424dbbcb1ee5bf3346411369f0de33b93426f216a5d790d3dea1e107ed7309faf95
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeg:q7Tc2NYHUrAwfMp3CDg
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/1944-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2028-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1488-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1304-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1728-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1272-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1960-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1532-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2400-206-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2008-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1360-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1744-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2008-227-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1860-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-263-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1936-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2280-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-295-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2248-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1304-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1672-422-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2868-442-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1760-451-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1760-450-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1532-485-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2352-499-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-538-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2260-610-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2360-635-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2472-673-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/1940-727-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1440-930-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1440-928-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1304-974-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1992-1007-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2728-1023-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1072-1033-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2076-1037-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2872-1042-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-1114-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1488 7btttn.exe 2028 xrxxxfl.exe 2404 4628888.exe 2128 1htttb.exe 2952 s2006.exe 2840 rlrflxr.exe 2968 rfrxxxl.exe 2716 e60622.exe 2736 086204.exe 2704 u428446.exe 2576 bthhht.exe 2588 thtnhh.exe 1304 fxllxxx.exe 1672 thnhnh.exe 1136 e22226.exe 1728 vpjjp.exe 2896 1bnhnn.exe 596 5xfxxff.exe 1960 006240.exe 1272 thnttn.exe 1548 6400600.exe 1532 3vdpv.exe 2400 82646.exe 1360 tbbttn.exe 2008 7nbbbb.exe 1744 44024.exe 1860 dvjjj.exe 552 bhthhb.exe 2236 0266662.exe 2280 c088440.exe 1936 7rlrfll.exe 876 bhbntt.exe 2116 042206.exe 1604 086682.exe 1232 lxrrxxf.exe 1720 bbtbhn.exe 2260 486284.exe 2248 vpdjv.exe 2992 8206486.exe 2832 dpvdj.exe 2360 nhhbhn.exe 2716 2028068.exe 2712 4484008.exe 2688 848466.exe 2656 fxlrxxl.exe 2720 26668.exe 2564 9thnnn.exe 2740 4486246.exe 1164 bnhnhh.exe 768 666206.exe 1304 60802.exe 1672 nhbtbb.exe 1092 5tnnbh.exe 2924 u268402.exe 2868 4824660.exe 1760 4800280.exe 1852 vpdpv.exe 544 8646846.exe 2668 bbnntb.exe 2040 lfflrrf.exe 1532 08220.exe 2364 60468.exe 2352 3lfrlxl.exe 2256 hbnbhn.exe -
resource yara_rule behavioral1/memory/1944-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1488-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1304-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1272-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1532-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1360-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1360-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1860-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/876-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1232-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1604-324-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2248-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/768-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1304-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1852-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/544-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1532-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-499-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-513-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-538-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-575-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1604-582-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1604-586-0x00000000002A0000-0x00000000002CA000-memory.dmp upx behavioral1/memory/2316-590-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-604-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-673-0x00000000002A0000-0x00000000002CA000-memory.dmp upx behavioral1/memory/2864-695-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1092-710-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2500-840-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-886-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1440-930-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-988-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-1023-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1072-1027-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-1042-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-1097-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-1129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-1166-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e64062.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlffllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrfxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlxfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language o804822.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a2000.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68000.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 04228.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 848466.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 468248.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1944 wrote to memory of 1488 1944 28e8484f5e4fc7154a3f7556fb5d6cd78455abe4e196bbf81c05e1a6252cbbb3N.exe 30 PID 1944 wrote to memory of 1488 1944 28e8484f5e4fc7154a3f7556fb5d6cd78455abe4e196bbf81c05e1a6252cbbb3N.exe 30 PID 1944 wrote to memory of 1488 1944 28e8484f5e4fc7154a3f7556fb5d6cd78455abe4e196bbf81c05e1a6252cbbb3N.exe 30 PID 1944 wrote to memory of 1488 1944 28e8484f5e4fc7154a3f7556fb5d6cd78455abe4e196bbf81c05e1a6252cbbb3N.exe 30 PID 1488 wrote to memory of 2028 1488 7btttn.exe 31 PID 1488 wrote to memory of 2028 1488 7btttn.exe 31 PID 1488 wrote to memory of 2028 1488 7btttn.exe 31 PID 1488 wrote to memory of 2028 1488 7btttn.exe 31 PID 2028 wrote to memory of 2404 2028 xrxxxfl.exe 32 PID 2028 wrote to memory of 2404 2028 xrxxxfl.exe 32 PID 2028 wrote to memory of 2404 2028 xrxxxfl.exe 32 PID 2028 wrote to memory of 2404 2028 xrxxxfl.exe 32 PID 2404 wrote to memory of 2128 2404 4628888.exe 33 PID 2404 wrote to memory of 2128 2404 4628888.exe 33 PID 2404 wrote to memory of 2128 2404 4628888.exe 33 PID 2404 wrote to memory of 2128 2404 4628888.exe 33 PID 2128 wrote to memory of 2952 2128 1htttb.exe 34 PID 2128 wrote to memory of 2952 2128 1htttb.exe 34 PID 2128 wrote to memory of 2952 2128 1htttb.exe 34 PID 2128 wrote to memory of 2952 2128 1htttb.exe 34 PID 2952 wrote to memory of 2840 2952 s2006.exe 35 PID 2952 wrote to memory of 2840 2952 s2006.exe 35 PID 2952 wrote to memory of 2840 2952 s2006.exe 35 PID 2952 wrote to memory of 2840 2952 s2006.exe 35 PID 2840 wrote to memory of 2968 2840 rlrflxr.exe 36 PID 2840 wrote to memory of 2968 2840 rlrflxr.exe 36 PID 2840 wrote to memory of 2968 2840 rlrflxr.exe 36 PID 2840 wrote to memory of 2968 2840 rlrflxr.exe 36 PID 2968 wrote to memory of 2716 2968 rfrxxxl.exe 37 PID 2968 wrote to memory of 2716 2968 rfrxxxl.exe 37 PID 2968 wrote to memory of 2716 2968 rfrxxxl.exe 37 PID 2968 wrote to memory of 2716 2968 rfrxxxl.exe 37 PID 2716 wrote to memory of 2736 2716 e60622.exe 38 PID 2716 wrote to memory of 2736 2716 e60622.exe 38 PID 2716 wrote to memory of 2736 2716 e60622.exe 38 PID 2716 wrote to memory of 2736 2716 e60622.exe 38 PID 2736 wrote to memory of 2704 2736 086204.exe 39 PID 2736 wrote to memory of 2704 2736 086204.exe 39 PID 2736 wrote to memory of 2704 2736 086204.exe 39 PID 2736 wrote to memory of 2704 2736 086204.exe 39 PID 2704 wrote to memory of 2576 2704 u428446.exe 40 PID 2704 wrote to memory of 2576 2704 u428446.exe 40 PID 2704 wrote to memory of 2576 2704 u428446.exe 40 PID 2704 wrote to memory of 2576 2704 u428446.exe 40 PID 2576 wrote to memory of 2588 2576 bthhht.exe 41 PID 2576 wrote to memory of 2588 2576 bthhht.exe 41 PID 2576 wrote to memory of 2588 2576 bthhht.exe 41 PID 2576 wrote to memory of 2588 2576 bthhht.exe 41 PID 2588 wrote to memory of 1304 2588 thtnhh.exe 42 PID 2588 wrote to memory of 1304 2588 thtnhh.exe 42 PID 2588 wrote to memory of 1304 2588 thtnhh.exe 42 PID 2588 wrote to memory of 1304 2588 thtnhh.exe 42 PID 1304 wrote to memory of 1672 1304 fxllxxx.exe 43 PID 1304 wrote to memory of 1672 1304 fxllxxx.exe 43 PID 1304 wrote to memory of 1672 1304 fxllxxx.exe 43 PID 1304 wrote to memory of 1672 1304 fxllxxx.exe 43 PID 1672 wrote to memory of 1136 1672 thnhnh.exe 44 PID 1672 wrote to memory of 1136 1672 thnhnh.exe 44 PID 1672 wrote to memory of 1136 1672 thnhnh.exe 44 PID 1672 wrote to memory of 1136 1672 thnhnh.exe 44 PID 1136 wrote to memory of 1728 1136 e22226.exe 45 PID 1136 wrote to memory of 1728 1136 e22226.exe 45 PID 1136 wrote to memory of 1728 1136 e22226.exe 45 PID 1136 wrote to memory of 1728 1136 e22226.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\28e8484f5e4fc7154a3f7556fb5d6cd78455abe4e196bbf81c05e1a6252cbbb3N.exe"C:\Users\Admin\AppData\Local\Temp\28e8484f5e4fc7154a3f7556fb5d6cd78455abe4e196bbf81c05e1a6252cbbb3N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\7btttn.exec:\7btttn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\xrxxxfl.exec:\xrxxxfl.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\4628888.exec:\4628888.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\1htttb.exec:\1htttb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\s2006.exec:\s2006.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\rlrflxr.exec:\rlrflxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\rfrxxxl.exec:\rfrxxxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\e60622.exec:\e60622.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\086204.exec:\086204.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\u428446.exec:\u428446.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\bthhht.exec:\bthhht.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\thtnhh.exec:\thtnhh.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\fxllxxx.exec:\fxllxxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
\??\c:\thnhnh.exec:\thnhnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\e22226.exec:\e22226.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
\??\c:\vpjjp.exec:\vpjjp.exe17⤵
- Executes dropped EXE
PID:1728 -
\??\c:\1bnhnn.exec:\1bnhnn.exe18⤵
- Executes dropped EXE
PID:2896 -
\??\c:\5xfxxff.exec:\5xfxxff.exe19⤵
- Executes dropped EXE
PID:596 -
\??\c:\006240.exec:\006240.exe20⤵
- Executes dropped EXE
PID:1960 -
\??\c:\thnttn.exec:\thnttn.exe21⤵
- Executes dropped EXE
PID:1272 -
\??\c:\6400600.exec:\6400600.exe22⤵
- Executes dropped EXE
PID:1548 -
\??\c:\3vdpv.exec:\3vdpv.exe23⤵
- Executes dropped EXE
PID:1532 -
\??\c:\82646.exec:\82646.exe24⤵
- Executes dropped EXE
PID:2400 -
\??\c:\tbbttn.exec:\tbbttn.exe25⤵
- Executes dropped EXE
PID:1360 -
\??\c:\7nbbbb.exec:\7nbbbb.exe26⤵
- Executes dropped EXE
PID:2008 -
\??\c:\44024.exec:\44024.exe27⤵
- Executes dropped EXE
PID:1744 -
\??\c:\dvjjj.exec:\dvjjj.exe28⤵
- Executes dropped EXE
PID:1860 -
\??\c:\bhthhb.exec:\bhthhb.exe29⤵
- Executes dropped EXE
PID:552 -
\??\c:\0266662.exec:\0266662.exe30⤵
- Executes dropped EXE
PID:2236 -
\??\c:\c088440.exec:\c088440.exe31⤵
- Executes dropped EXE
PID:2280 -
\??\c:\7rlrfll.exec:\7rlrfll.exe32⤵
- Executes dropped EXE
PID:1936 -
\??\c:\bhbntt.exec:\bhbntt.exe33⤵
- Executes dropped EXE
PID:876 -
\??\c:\042206.exec:\042206.exe34⤵
- Executes dropped EXE
PID:2116 -
\??\c:\086682.exec:\086682.exe35⤵
- Executes dropped EXE
PID:1604 -
\??\c:\lxrrxxf.exec:\lxrrxxf.exe36⤵
- Executes dropped EXE
PID:1232 -
\??\c:\bbtbhn.exec:\bbtbhn.exe37⤵
- Executes dropped EXE
PID:1720 -
\??\c:\486284.exec:\486284.exe38⤵
- Executes dropped EXE
PID:2260 -
\??\c:\vpdjv.exec:\vpdjv.exe39⤵
- Executes dropped EXE
PID:2248 -
\??\c:\8206486.exec:\8206486.exe40⤵
- Executes dropped EXE
PID:2992 -
\??\c:\dpvdj.exec:\dpvdj.exe41⤵
- Executes dropped EXE
PID:2832 -
\??\c:\nhhbhn.exec:\nhhbhn.exe42⤵
- Executes dropped EXE
PID:2360 -
\??\c:\2028068.exec:\2028068.exe43⤵
- Executes dropped EXE
PID:2716 -
\??\c:\4484008.exec:\4484008.exe44⤵
- Executes dropped EXE
PID:2712 -
\??\c:\848466.exec:\848466.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2688 -
\??\c:\fxlrxxl.exec:\fxlrxxl.exe46⤵
- Executes dropped EXE
PID:2656 -
\??\c:\26668.exec:\26668.exe47⤵
- Executes dropped EXE
PID:2720 -
\??\c:\9thnnn.exec:\9thnnn.exe48⤵
- Executes dropped EXE
PID:2564 -
\??\c:\4486246.exec:\4486246.exe49⤵
- Executes dropped EXE
PID:2740 -
\??\c:\bnhnhh.exec:\bnhnhh.exe50⤵
- Executes dropped EXE
PID:1164 -
\??\c:\666206.exec:\666206.exe51⤵
- Executes dropped EXE
PID:768 -
\??\c:\60802.exec:\60802.exe52⤵
- Executes dropped EXE
PID:1304 -
\??\c:\nhbtbb.exec:\nhbtbb.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1672 -
\??\c:\5tnnbh.exec:\5tnnbh.exe54⤵
- Executes dropped EXE
PID:1092 -
\??\c:\u268402.exec:\u268402.exe55⤵
- Executes dropped EXE
PID:2924 -
\??\c:\4824660.exec:\4824660.exe56⤵
- Executes dropped EXE
PID:2868 -
\??\c:\4800280.exec:\4800280.exe57⤵
- Executes dropped EXE
PID:1760 -
\??\c:\vpdpv.exec:\vpdpv.exe58⤵
- Executes dropped EXE
PID:1852 -
\??\c:\8646846.exec:\8646846.exe59⤵
- Executes dropped EXE
PID:544 -
\??\c:\bbnntb.exec:\bbnntb.exe60⤵
- Executes dropped EXE
PID:2668 -
\??\c:\lfflrrf.exec:\lfflrrf.exe61⤵
- Executes dropped EXE
PID:2040 -
\??\c:\08220.exec:\08220.exe62⤵
- Executes dropped EXE
PID:1532 -
\??\c:\60468.exec:\60468.exe63⤵
- Executes dropped EXE
PID:2364 -
\??\c:\3lfrlxl.exec:\3lfrlxl.exe64⤵
- Executes dropped EXE
PID:2352 -
\??\c:\hbnbhn.exec:\hbnbhn.exe65⤵
- Executes dropped EXE
PID:2256 -
\??\c:\6646284.exec:\6646284.exe66⤵PID:1732
-
\??\c:\7rrrlrr.exec:\7rrrlrr.exe67⤵PID:1744
-
\??\c:\8228068.exec:\8228068.exe68⤵PID:764
-
\??\c:\6088002.exec:\6088002.exe69⤵PID:2072
-
\??\c:\2668002.exec:\2668002.exe70⤵PID:2104
-
\??\c:\7vpdv.exec:\7vpdv.exe71⤵PID:1812
-
\??\c:\hhhnnn.exec:\hhhnnn.exe72⤵PID:288
-
\??\c:\xrxffxx.exec:\xrxffxx.exe73⤵
- System Location Discovery: System Language Discovery
PID:2624 -
\??\c:\vpjpp.exec:\vpjpp.exe74⤵PID:2500
-
\??\c:\g4228.exec:\g4228.exe75⤵PID:2508
-
\??\c:\0880848.exec:\0880848.exe76⤵PID:2368
-
\??\c:\4828008.exec:\4828008.exe77⤵PID:2036
-
\??\c:\5lfllrr.exec:\5lfllrr.exe78⤵PID:1604
-
\??\c:\8228628.exec:\8228628.exe79⤵PID:2316
-
\??\c:\64464.exec:\64464.exe80⤵PID:2492
-
\??\c:\bnbbnt.exec:\bnbbnt.exe81⤵PID:2260
-
\??\c:\ddvjp.exec:\ddvjp.exe82⤵PID:2956
-
\??\c:\c266224.exec:\c266224.exe83⤵PID:2820
-
\??\c:\jjvdj.exec:\jjvdj.exe84⤵PID:2804
-
\??\c:\5vpvv.exec:\5vpvv.exe85⤵PID:2360
-
\??\c:\8240284.exec:\8240284.exe86⤵PID:2852
-
\??\c:\1jjjv.exec:\1jjjv.exe87⤵PID:2344
-
\??\c:\e66806.exec:\e66806.exe88⤵PID:2692
-
\??\c:\26068.exec:\26068.exe89⤵PID:2708
-
\??\c:\0484062.exec:\0484062.exe90⤵PID:980
-
\??\c:\82240.exec:\82240.exe91⤵PID:2472
-
\??\c:\4868068.exec:\4868068.exe92⤵PID:592
-
\??\c:\2084040.exec:\2084040.exe93⤵PID:2232
-
\??\c:\tnbbnh.exec:\tnbbnh.exe94⤵PID:2892
-
\??\c:\866628.exec:\866628.exe95⤵PID:2864
-
\??\c:\048482.exec:\048482.exe96⤵PID:1136
-
\??\c:\6486800.exec:\6486800.exe97⤵PID:1092
-
\??\c:\dvjjp.exec:\dvjjp.exe98⤵PID:2924
-
\??\c:\bhnbbt.exec:\bhnbbt.exe99⤵PID:1940
-
\??\c:\hhbbtb.exec:\hhbbtb.exe100⤵PID:1876
-
\??\c:\vvppd.exec:\vvppd.exe101⤵PID:1788
-
\??\c:\btntbh.exec:\btntbh.exe102⤵PID:2560
-
\??\c:\1hnnnh.exec:\1hnnnh.exe103⤵PID:1972
-
\??\c:\vpjjv.exec:\vpjjv.exe104⤵PID:612
-
\??\c:\xxrxlrf.exec:\xxrxlrf.exe105⤵PID:2872
-
\??\c:\ffrrllr.exec:\ffrrllr.exe106⤵PID:956
-
\??\c:\vvpvd.exec:\vvpvd.exe107⤵PID:1300
-
\??\c:\820024.exec:\820024.exe108⤵PID:2524
-
\??\c:\dvvvj.exec:\dvvvj.exe109⤵PID:1568
-
\??\c:\ffxlrxl.exec:\ffxlrxl.exe110⤵PID:1772
-
\??\c:\88062.exec:\88062.exe111⤵PID:2252
-
\??\c:\080666.exec:\080666.exe112⤵PID:852
-
\??\c:\dvjpp.exec:\dvjpp.exe113⤵PID:2072
-
\??\c:\82062.exec:\82062.exe114⤵PID:552
-
\??\c:\3bnbht.exec:\3bnbht.exe115⤵PID:1252
-
\??\c:\2022828.exec:\2022828.exe116⤵PID:2160
-
\??\c:\60468.exec:\60468.exe117⤵PID:1908
-
\??\c:\202288.exec:\202288.exe118⤵PID:2500
-
\??\c:\k48822.exec:\k48822.exe119⤵PID:2124
-
\??\c:\3hbhnh.exec:\3hbhnh.exe120⤵PID:1716
-
\??\c:\i288884.exec:\i288884.exe121⤵PID:1472
-
\??\c:\42662.exec:\42662.exe122⤵PID:2432
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-