Analysis
-
max time kernel
120s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-12-2024 05:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
be410aada27e63554328e36251666e7d790f0fb87e401c4ae3665f7719a645ccN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
be410aada27e63554328e36251666e7d790f0fb87e401c4ae3665f7719a645ccN.exe
-
Size
454KB
-
MD5
570488473f20a445405fa858c6155240
-
SHA1
ed815118be42f659324e311a38cdafce2cb49c35
-
SHA256
be410aada27e63554328e36251666e7d790f0fb87e401c4ae3665f7719a645cc
-
SHA512
2b8913b339ad126b21d6c57b7b7c188e3709e9191110b06588855c90ec721a3feb444f8ae13e1f26e67a43e9b4f30c8fce0325107fa99277d75930686a6bfa34
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeW:q7Tc2NYHUrAwfMp3CDW
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2644-0-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2120-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-86-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2732-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2440-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2284-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1480-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/380-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/592-162-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2404-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2460-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/408-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2496-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1816-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1928-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3040-295-0x0000000077A10000-0x0000000077B2F000-memory.dmp family_blackmoon behavioral1/memory/2020-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2276-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2160-384-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1676-411-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1684-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1680-432-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1932-439-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1040-446-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1348-502-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/1692-583-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2180-720-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1444-733-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1864-777-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2548-891-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/484-952-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2876-1227-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2640-1256-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2120 hhtthh.exe 2816 1jdvd.exe 2780 pjvpv.exe 2712 9rxrrlr.exe 2688 1vjjv.exe 2560 5lxxflr.exe 800 5dppp.exe 3020 rflrrll.exe 2976 nhtbbb.exe 2360 pjvvd.exe 2732 xlxfllr.exe 828 3pdjp.exe 2440 fxllrrx.exe 2284 bthhhh.exe 1480 vpvvj.exe 380 jdppv.exe 592 lrxlfrl.exe 2404 hbnhhh.exe 2460 7jpjj.exe 2332 thnnnh.exe 408 vjpjp.exe 2116 3lxfllr.exe 956 thnhnh.exe 2448 rlrrxfl.exe 2496 tthntb.exe 1516 1vjpp.exe 1816 1rlllll.exe 2000 7dppd.exe 992 btbhtb.exe 1748 7lxlllr.exe 1928 rrflrrf.exe 3040 vjdjv.exe 2812 jvjpv.exe 2708 pdpjj.exe 2684 xlxfllr.exe 2584 7bnnnn.exe 2872 pdjdp.exe 2664 vjvpp.exe 1204 xxllrrx.exe 2628 bthntt.exe 2020 djdjj.exe 1096 pjvjp.exe 2276 rlrrrxx.exe 2396 7ttttn.exe 2160 3ntbhn.exe 804 vjvvv.exe 2732 xlflrrf.exe 1628 ttnntn.exe 1676 thttbb.exe 1684 jvjpv.exe 2856 1xrlrrr.exe 1680 btbhhh.exe 1932 9dpvv.exe 1040 xfrxlrf.exe 3064 rrffrrf.exe 2192 thtbhh.exe 2084 jdvvd.exe 1508 vpdjv.exe 1984 fxllllr.exe 1712 bnbbhn.exe 2152 ddvdp.exe 840 rffxrxf.exe 1348 hhtttt.exe 2448 bthbnn.exe -
resource yara_rule behavioral1/memory/2644-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1480-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/380-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1480-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/380-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/592-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/408-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1516-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1816-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1928-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-295-0x0000000077A10000-0x0000000077B2F000-memory.dmp upx behavioral1/memory/2020-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1676-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1676-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1040-446-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-533-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-583-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-632-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-720-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1444-733-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-810-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/484-946-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/484-952-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2180-999-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-1025-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-1123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1312-1148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-1155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-1162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-1187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-1200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-1227-0x00000000002C0000-0x00000000002EA000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tnttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffxfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ttntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrflrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5thhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tntbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3thbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llflxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2644 wrote to memory of 2120 2644 be410aada27e63554328e36251666e7d790f0fb87e401c4ae3665f7719a645ccN.exe 30 PID 2644 wrote to memory of 2120 2644 be410aada27e63554328e36251666e7d790f0fb87e401c4ae3665f7719a645ccN.exe 30 PID 2644 wrote to memory of 2120 2644 be410aada27e63554328e36251666e7d790f0fb87e401c4ae3665f7719a645ccN.exe 30 PID 2644 wrote to memory of 2120 2644 be410aada27e63554328e36251666e7d790f0fb87e401c4ae3665f7719a645ccN.exe 30 PID 2120 wrote to memory of 2816 2120 hhtthh.exe 31 PID 2120 wrote to memory of 2816 2120 hhtthh.exe 31 PID 2120 wrote to memory of 2816 2120 hhtthh.exe 31 PID 2120 wrote to memory of 2816 2120 hhtthh.exe 31 PID 2816 wrote to memory of 2780 2816 1jdvd.exe 32 PID 2816 wrote to memory of 2780 2816 1jdvd.exe 32 PID 2816 wrote to memory of 2780 2816 1jdvd.exe 32 PID 2816 wrote to memory of 2780 2816 1jdvd.exe 32 PID 2780 wrote to memory of 2712 2780 pjvpv.exe 33 PID 2780 wrote to memory of 2712 2780 pjvpv.exe 33 PID 2780 wrote to memory of 2712 2780 pjvpv.exe 33 PID 2780 wrote to memory of 2712 2780 pjvpv.exe 33 PID 2712 wrote to memory of 2688 2712 9rxrrlr.exe 34 PID 2712 wrote to memory of 2688 2712 9rxrrlr.exe 34 PID 2712 wrote to memory of 2688 2712 9rxrrlr.exe 34 PID 2712 wrote to memory of 2688 2712 9rxrrlr.exe 34 PID 2688 wrote to memory of 2560 2688 1vjjv.exe 35 PID 2688 wrote to memory of 2560 2688 1vjjv.exe 35 PID 2688 wrote to memory of 2560 2688 1vjjv.exe 35 PID 2688 wrote to memory of 2560 2688 1vjjv.exe 35 PID 2560 wrote to memory of 800 2560 5lxxflr.exe 36 PID 2560 wrote to memory of 800 2560 5lxxflr.exe 36 PID 2560 wrote to memory of 800 2560 5lxxflr.exe 36 PID 2560 wrote to memory of 800 2560 5lxxflr.exe 36 PID 800 wrote to memory of 3020 800 5dppp.exe 37 PID 800 wrote to memory of 3020 800 5dppp.exe 37 PID 800 wrote to memory of 3020 800 5dppp.exe 37 PID 800 wrote to memory of 3020 800 5dppp.exe 37 PID 3020 wrote to memory of 2976 3020 rflrrll.exe 38 PID 3020 wrote to memory of 2976 3020 rflrrll.exe 38 PID 3020 wrote to memory of 2976 3020 rflrrll.exe 38 PID 3020 wrote to memory of 2976 3020 rflrrll.exe 38 PID 2976 wrote to memory of 2360 2976 nhtbbb.exe 39 PID 2976 wrote to memory of 2360 2976 nhtbbb.exe 39 PID 2976 wrote to memory of 2360 2976 nhtbbb.exe 39 PID 2976 wrote to memory of 2360 2976 nhtbbb.exe 39 PID 2360 wrote to memory of 2732 2360 pjvvd.exe 40 PID 2360 wrote to memory of 2732 2360 pjvvd.exe 40 PID 2360 wrote to memory of 2732 2360 pjvvd.exe 40 PID 2360 wrote to memory of 2732 2360 pjvvd.exe 40 PID 2732 wrote to memory of 828 2732 xlxfllr.exe 41 PID 2732 wrote to memory of 828 2732 xlxfllr.exe 41 PID 2732 wrote to memory of 828 2732 xlxfllr.exe 41 PID 2732 wrote to memory of 828 2732 xlxfllr.exe 41 PID 828 wrote to memory of 2440 828 3pdjp.exe 42 PID 828 wrote to memory of 2440 828 3pdjp.exe 42 PID 828 wrote to memory of 2440 828 3pdjp.exe 42 PID 828 wrote to memory of 2440 828 3pdjp.exe 42 PID 2440 wrote to memory of 2284 2440 fxllrrx.exe 43 PID 2440 wrote to memory of 2284 2440 fxllrrx.exe 43 PID 2440 wrote to memory of 2284 2440 fxllrrx.exe 43 PID 2440 wrote to memory of 2284 2440 fxllrrx.exe 43 PID 2284 wrote to memory of 1480 2284 bthhhh.exe 44 PID 2284 wrote to memory of 1480 2284 bthhhh.exe 44 PID 2284 wrote to memory of 1480 2284 bthhhh.exe 44 PID 2284 wrote to memory of 1480 2284 bthhhh.exe 44 PID 1480 wrote to memory of 380 1480 vpvvj.exe 45 PID 1480 wrote to memory of 380 1480 vpvvj.exe 45 PID 1480 wrote to memory of 380 1480 vpvvj.exe 45 PID 1480 wrote to memory of 380 1480 vpvvj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\be410aada27e63554328e36251666e7d790f0fb87e401c4ae3665f7719a645ccN.exe"C:\Users\Admin\AppData\Local\Temp\be410aada27e63554328e36251666e7d790f0fb87e401c4ae3665f7719a645ccN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\hhtthh.exec:\hhtthh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\1jdvd.exec:\1jdvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\pjvpv.exec:\pjvpv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\9rxrrlr.exec:\9rxrrlr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\1vjjv.exec:\1vjjv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\5lxxflr.exec:\5lxxflr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\5dppp.exec:\5dppp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:800 -
\??\c:\rflrrll.exec:\rflrrll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\nhtbbb.exec:\nhtbbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\pjvvd.exec:\pjvvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\xlxfllr.exec:\xlxfllr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\3pdjp.exec:\3pdjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:828 -
\??\c:\fxllrrx.exec:\fxllrrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\bthhhh.exec:\bthhhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\vpvvj.exec:\vpvvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
\??\c:\jdppv.exec:\jdppv.exe17⤵
- Executes dropped EXE
PID:380 -
\??\c:\lrxlfrl.exec:\lrxlfrl.exe18⤵
- Executes dropped EXE
PID:592 -
\??\c:\hbnhhh.exec:\hbnhhh.exe19⤵
- Executes dropped EXE
PID:2404 -
\??\c:\7jpjj.exec:\7jpjj.exe20⤵
- Executes dropped EXE
PID:2460 -
\??\c:\thnnnh.exec:\thnnnh.exe21⤵
- Executes dropped EXE
PID:2332 -
\??\c:\vjpjp.exec:\vjpjp.exe22⤵
- Executes dropped EXE
PID:408 -
\??\c:\3lxfllr.exec:\3lxfllr.exe23⤵
- Executes dropped EXE
PID:2116 -
\??\c:\thnhnh.exec:\thnhnh.exe24⤵
- Executes dropped EXE
PID:956 -
\??\c:\rlrrxfl.exec:\rlrrxfl.exe25⤵
- Executes dropped EXE
PID:2448 -
\??\c:\tthntb.exec:\tthntb.exe26⤵
- Executes dropped EXE
PID:2496 -
\??\c:\1vjpp.exec:\1vjpp.exe27⤵
- Executes dropped EXE
PID:1516 -
\??\c:\1rlllll.exec:\1rlllll.exe28⤵
- Executes dropped EXE
PID:1816 -
\??\c:\7dppd.exec:\7dppd.exe29⤵
- Executes dropped EXE
PID:2000 -
\??\c:\btbhtb.exec:\btbhtb.exe30⤵
- Executes dropped EXE
PID:992 -
\??\c:\7lxlllr.exec:\7lxlllr.exe31⤵
- Executes dropped EXE
PID:1748 -
\??\c:\rrflrrf.exec:\rrflrrf.exe32⤵
- Executes dropped EXE
PID:1928 -
\??\c:\vjdjv.exec:\vjdjv.exe33⤵
- Executes dropped EXE
PID:3040 -
\??\c:\ddpvv.exec:\ddpvv.exe34⤵PID:1692
-
\??\c:\jvjpv.exec:\jvjpv.exe35⤵
- Executes dropped EXE
PID:2812 -
\??\c:\pdpjj.exec:\pdpjj.exe36⤵
- Executes dropped EXE
PID:2708 -
\??\c:\xlxfllr.exec:\xlxfllr.exe37⤵
- Executes dropped EXE
PID:2684 -
\??\c:\7bnnnn.exec:\7bnnnn.exe38⤵
- Executes dropped EXE
PID:2584 -
\??\c:\pdjdp.exec:\pdjdp.exe39⤵
- Executes dropped EXE
PID:2872 -
\??\c:\vjvpp.exec:\vjvpp.exe40⤵
- Executes dropped EXE
PID:2664 -
\??\c:\xxllrrx.exec:\xxllrrx.exe41⤵
- Executes dropped EXE
PID:1204 -
\??\c:\bthntt.exec:\bthntt.exe42⤵
- Executes dropped EXE
PID:2628 -
\??\c:\djdjj.exec:\djdjj.exe43⤵
- Executes dropped EXE
PID:2020 -
\??\c:\pjvjp.exec:\pjvjp.exe44⤵
- Executes dropped EXE
PID:1096 -
\??\c:\rlrrrxx.exec:\rlrrrxx.exe45⤵
- Executes dropped EXE
PID:2276 -
\??\c:\7ttttn.exec:\7ttttn.exe46⤵
- Executes dropped EXE
PID:2396 -
\??\c:\3ntbhn.exec:\3ntbhn.exe47⤵
- Executes dropped EXE
PID:2160 -
\??\c:\vjvvv.exec:\vjvvv.exe48⤵
- Executes dropped EXE
PID:804 -
\??\c:\xlflrrf.exec:\xlflrrf.exe49⤵
- Executes dropped EXE
PID:2732 -
\??\c:\ttnntn.exec:\ttnntn.exe50⤵
- Executes dropped EXE
PID:1628 -
\??\c:\thttbb.exec:\thttbb.exe51⤵
- Executes dropped EXE
PID:1676 -
\??\c:\jvjpv.exec:\jvjpv.exe52⤵
- Executes dropped EXE
PID:1684 -
\??\c:\1xrlrrr.exec:\1xrlrrr.exe53⤵
- Executes dropped EXE
PID:2856 -
\??\c:\btbhhh.exec:\btbhhh.exe54⤵
- Executes dropped EXE
PID:1680 -
\??\c:\9dpvv.exec:\9dpvv.exe55⤵
- Executes dropped EXE
PID:1932 -
\??\c:\xfrxlrf.exec:\xfrxlrf.exe56⤵
- Executes dropped EXE
PID:1040 -
\??\c:\rrffrrf.exec:\rrffrrf.exe57⤵
- Executes dropped EXE
PID:3064 -
\??\c:\thtbhh.exec:\thtbhh.exe58⤵
- Executes dropped EXE
PID:2192 -
\??\c:\jdvvd.exec:\jdvvd.exe59⤵
- Executes dropped EXE
PID:2084 -
\??\c:\vpdjv.exec:\vpdjv.exe60⤵
- Executes dropped EXE
PID:1508 -
\??\c:\fxllllr.exec:\fxllllr.exe61⤵
- Executes dropped EXE
PID:1984 -
\??\c:\bnbbhn.exec:\bnbbhn.exe62⤵
- Executes dropped EXE
PID:1712 -
\??\c:\ddvdp.exec:\ddvdp.exe63⤵
- Executes dropped EXE
PID:2152 -
\??\c:\rffxrxf.exec:\rffxrxf.exe64⤵
- Executes dropped EXE
PID:840 -
\??\c:\hhtttt.exec:\hhtttt.exe65⤵
- Executes dropped EXE
PID:1348 -
\??\c:\bthbnn.exec:\bthbnn.exe66⤵
- Executes dropped EXE
PID:2448 -
\??\c:\dvpvp.exec:\dvpvp.exe67⤵PID:908
-
\??\c:\frxrrrr.exec:\frxrrrr.exe68⤵PID:3028
-
\??\c:\bnhhnn.exec:\bnhhnn.exe69⤵PID:1784
-
\??\c:\3vdvd.exec:\3vdvd.exe70⤵PID:688
-
\??\c:\jdvdd.exec:\jdvdd.exe71⤵PID:2944
-
\??\c:\llfrxxf.exec:\llfrxxf.exe72⤵PID:2324
-
\??\c:\thtbbb.exec:\thtbbb.exe73⤵PID:1320
-
\??\c:\7bnhnh.exec:\7bnhnh.exe74⤵PID:2464
-
\??\c:\7vppp.exec:\7vppp.exe75⤵PID:3048
-
\??\c:\1lrlffx.exec:\1lrlffx.exe76⤵PID:1584
-
\??\c:\fxllrlr.exec:\fxllrlr.exe77⤵PID:1592
-
\??\c:\hthhtt.exec:\hthhtt.exe78⤵PID:1692
-
\??\c:\jdvpv.exec:\jdvpv.exe79⤵PID:2824
-
\??\c:\1lxflrx.exec:\1lxflrx.exe80⤵PID:2744
-
\??\c:\1flxxxr.exec:\1flxxxr.exe81⤵PID:2576
-
\??\c:\hhbhnn.exec:\hhbhnn.exe82⤵PID:2712
-
\??\c:\pjvdp.exec:\pjvdp.exe83⤵PID:2748
-
\??\c:\5rrrlll.exec:\5rrrlll.exe84⤵PID:2716
-
\??\c:\fxlffxf.exec:\fxlffxf.exe85⤵PID:2564
-
\??\c:\tnhnnn.exec:\tnhnnn.exe86⤵PID:1280
-
\??\c:\dvdjp.exec:\dvdjp.exe87⤵PID:1660
-
\??\c:\dpjdd.exec:\dpjdd.exe88⤵PID:2648
-
\??\c:\7rllrlx.exec:\7rllrlx.exe89⤵PID:3016
-
\??\c:\hnhhhh.exec:\hnhhhh.exe90⤵PID:1664
-
\??\c:\pdpvj.exec:\pdpvj.exe91⤵PID:1648
-
\??\c:\1xxxrrr.exec:\1xxxrrr.exe92⤵PID:804
-
\??\c:\xrlrxxl.exec:\xrlrxxl.exe93⤵PID:2732
-
\??\c:\bntbhh.exec:\bntbhh.exe94⤵PID:984
-
\??\c:\1jddd.exec:\1jddd.exe95⤵PID:1700
-
\??\c:\pdjdd.exec:\pdjdd.exe96⤵PID:1688
-
\??\c:\xlxlrlx.exec:\xlxlrlx.exe97⤵PID:2848
-
\??\c:\3htttb.exec:\3htttb.exe98⤵PID:2004
-
\??\c:\1thhhh.exec:\1thhhh.exe99⤵PID:380
-
\??\c:\pjvdd.exec:\pjvdd.exe100⤵PID:3060
-
\??\c:\lfxrfxf.exec:\lfxrfxf.exe101⤵PID:2180
-
\??\c:\7lfxlrr.exec:\7lfxlrr.exe102⤵PID:1444
-
\??\c:\ttntbb.exec:\ttntbb.exe103⤵PID:2444
-
\??\c:\dpvpp.exec:\dpvpp.exe104⤵PID:2332
-
\??\c:\pjppp.exec:\pjppp.exe105⤵PID:2108
-
\??\c:\rflfllx.exec:\rflfllx.exe106⤵PID:1044
-
\??\c:\hhbbnn.exec:\hhbbnn.exe107⤵PID:1372
-
\??\c:\jvdvv.exec:\jvdvv.exe108⤵PID:1868
-
\??\c:\dpjpv.exec:\dpjpv.exe109⤵PID:1864
-
\??\c:\lrlrxfl.exec:\lrlrxfl.exe110⤵PID:2200
-
\??\c:\ttnbnt.exec:\ttnbnt.exe111⤵PID:848
-
\??\c:\dpvvj.exec:\dpvvj.exe112⤵PID:1048
-
\??\c:\5dpjd.exec:\5dpjd.exe113⤵PID:280
-
\??\c:\rffxfxl.exec:\rffxfxl.exe114⤵
- System Location Discovery: System Language Discovery
PID:2072 -
\??\c:\9nnntn.exec:\9nnntn.exe115⤵PID:2000
-
\??\c:\7tntbt.exec:\7tntbt.exe116⤵
- System Location Discovery: System Language Discovery
PID:2452 -
\??\c:\dddjv.exec:\dddjv.exe117⤵PID:1948
-
\??\c:\3frrlrr.exec:\3frrlrr.exe118⤵PID:2124
-
\??\c:\lffrflx.exec:\lffrflx.exe119⤵PID:2260
-
\??\c:\bttbbb.exec:\bttbbb.exe120⤵PID:2804
-
\??\c:\1jvvd.exec:\1jvvd.exe121⤵PID:2820
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-