Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-12-2024 09:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f8b22c39030b32d8b1d1f9acebf40ea2a28de2b698d7a8a42a9f26253ce337e4.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
f8b22c39030b32d8b1d1f9acebf40ea2a28de2b698d7a8a42a9f26253ce337e4.exe
-
Size
453KB
-
MD5
754089979729cc9c5832818547315a06
-
SHA1
7e234f66e8c0ff49ea0ff5c2aad5ec2b963756b0
-
SHA256
f8b22c39030b32d8b1d1f9acebf40ea2a28de2b698d7a8a42a9f26253ce337e4
-
SHA512
ef310ffeee73e80a1afee43bc121128cf43c2e0008e6d2b8a0b01451c3b1c8da53b11e4236e7029332e7fcca02aa8f4e61cf29eab62a1876f605abb51a9c8573
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeG:q7Tc2NYHUrAwfMp3CDG
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 47 IoCs
resource yara_rule behavioral1/memory/796-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2004-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2304-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2352-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2016-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-90-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2600-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2152-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2532-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2532-128-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1936-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2268-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2268-165-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2988-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2948-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1568-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1104-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/304-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1668-256-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2208-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2460-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/872-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1016-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2020-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/316-337-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1728-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-431-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/3024-430-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1632-450-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1840-462-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1788-465-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1840-464-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/692-539-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-682-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1568-807-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/636-845-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2220-867-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2460-879-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-952-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2644-965-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2136-1092-0x0000000001C80000-0x0000000001CAA000-memory.dmp family_blackmoon behavioral1/memory/2004-1188-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2004 ffxrxxl.exe 856 3nhnbb.exe 2304 jjdjv.exe 2396 rrlxlrf.exe 2920 nttbtb.exe 2016 vppdp.exe 2352 fxffflx.exe 2712 tthhth.exe 2640 nnhtnt.exe 2364 1ffflrl.exe 2504 7tnnbh.exe 2600 9fflrxf.exe 2532 jjvjv.exe 2152 rlfrflx.exe 1752 hhtnbb.exe 1636 vdvpd.exe 2268 3bthnb.exe 1936 lfrlllx.exe 1804 lrrxflf.exe 2588 ntnthh.exe 2988 llflxfl.exe 2948 3tntbh.exe 2808 xxlxllx.exe 1568 xfxlxlf.exe 1104 lrfffrf.exe 304 djjvj.exe 1668 flflflf.exe 3016 ppjpd.exe 1684 rrfrxfx.exe 2208 1dvjv.exe 592 vdjpd.exe 2460 ffxrrxl.exe 872 dvpdj.exe 1016 htthnt.exe 2004 tnhhtb.exe 1224 5vjdv.exe 2020 1lxxflx.exe 316 xfxlrrx.exe 1728 hhhthn.exe 2928 vddjv.exe 2756 ffxrllx.exe 2912 xrfllrf.exe 2724 tnbbnt.exe 2708 jjvjj.exe 2684 jpjpd.exe 2872 llxfxll.exe 2168 bhbnbn.exe 2424 3btbbh.exe 2508 7dvdj.exe 2484 7ffrxlx.exe 2524 xrlrxxl.exe 3024 tnhnnt.exe 2428 vvpvd.exe 2388 xrxrrlr.exe 1692 rrlfflf.exe 1632 bnnttt.exe 1840 jdpvv.exe 1788 vjpjj.exe 2796 fxxlxff.exe 1804 hbhtht.exe 1932 jppdd.exe 2116 dpppv.exe 2988 frxffff.exe 2076 9nntbn.exe -
resource yara_rule behavioral1/memory/796-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-109-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2600-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-163-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2988-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1568-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-220-0x00000000002C0000-0x00000000002EA000-memory.dmp upx behavioral1/memory/1104-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/304-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/304-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1668-256-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2208-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/872-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1016-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/316-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-431-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/3024-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1788-465-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1840-464-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/692-539-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-570-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1592-608-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-675-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-682-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/636-838-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-864-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-879-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1596-901-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2400-926-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-939-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-965-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-1002-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-1079-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1288-1111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-1118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-1156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-1244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-1281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1848-1288-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5flxxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nbbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9fxxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rlrlxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 796 wrote to memory of 2004 796 f8b22c39030b32d8b1d1f9acebf40ea2a28de2b698d7a8a42a9f26253ce337e4.exe 28 PID 796 wrote to memory of 2004 796 f8b22c39030b32d8b1d1f9acebf40ea2a28de2b698d7a8a42a9f26253ce337e4.exe 28 PID 796 wrote to memory of 2004 796 f8b22c39030b32d8b1d1f9acebf40ea2a28de2b698d7a8a42a9f26253ce337e4.exe 28 PID 796 wrote to memory of 2004 796 f8b22c39030b32d8b1d1f9acebf40ea2a28de2b698d7a8a42a9f26253ce337e4.exe 28 PID 2004 wrote to memory of 856 2004 ffxrxxl.exe 29 PID 2004 wrote to memory of 856 2004 ffxrxxl.exe 29 PID 2004 wrote to memory of 856 2004 ffxrxxl.exe 29 PID 2004 wrote to memory of 856 2004 ffxrxxl.exe 29 PID 856 wrote to memory of 2304 856 3nhnbb.exe 30 PID 856 wrote to memory of 2304 856 3nhnbb.exe 30 PID 856 wrote to memory of 2304 856 3nhnbb.exe 30 PID 856 wrote to memory of 2304 856 3nhnbb.exe 30 PID 2304 wrote to memory of 2396 2304 jjdjv.exe 31 PID 2304 wrote to memory of 2396 2304 jjdjv.exe 31 PID 2304 wrote to memory of 2396 2304 jjdjv.exe 31 PID 2304 wrote to memory of 2396 2304 jjdjv.exe 31 PID 2396 wrote to memory of 2920 2396 rrlxlrf.exe 32 PID 2396 wrote to memory of 2920 2396 rrlxlrf.exe 32 PID 2396 wrote to memory of 2920 2396 rrlxlrf.exe 32 PID 2396 wrote to memory of 2920 2396 rrlxlrf.exe 32 PID 2920 wrote to memory of 2016 2920 nttbtb.exe 33 PID 2920 wrote to memory of 2016 2920 nttbtb.exe 33 PID 2920 wrote to memory of 2016 2920 nttbtb.exe 33 PID 2920 wrote to memory of 2016 2920 nttbtb.exe 33 PID 2016 wrote to memory of 2352 2016 vppdp.exe 34 PID 2016 wrote to memory of 2352 2016 vppdp.exe 34 PID 2016 wrote to memory of 2352 2016 vppdp.exe 34 PID 2016 wrote to memory of 2352 2016 vppdp.exe 34 PID 2352 wrote to memory of 2712 2352 fxffflx.exe 35 PID 2352 wrote to memory of 2712 2352 fxffflx.exe 35 PID 2352 wrote to memory of 2712 2352 fxffflx.exe 35 PID 2352 wrote to memory of 2712 2352 fxffflx.exe 35 PID 2712 wrote to memory of 2640 2712 tthhth.exe 36 PID 2712 wrote to memory of 2640 2712 tthhth.exe 36 PID 2712 wrote to memory of 2640 2712 tthhth.exe 36 PID 2712 wrote to memory of 2640 2712 tthhth.exe 36 PID 2640 wrote to memory of 2364 2640 nnhtnt.exe 37 PID 2640 wrote to memory of 2364 2640 nnhtnt.exe 37 PID 2640 wrote to memory of 2364 2640 nnhtnt.exe 37 PID 2640 wrote to memory of 2364 2640 nnhtnt.exe 37 PID 2364 wrote to memory of 2504 2364 1ffflrl.exe 38 PID 2364 wrote to memory of 2504 2364 1ffflrl.exe 38 PID 2364 wrote to memory of 2504 2364 1ffflrl.exe 38 PID 2364 wrote to memory of 2504 2364 1ffflrl.exe 38 PID 2504 wrote to memory of 2600 2504 7tnnbh.exe 39 PID 2504 wrote to memory of 2600 2504 7tnnbh.exe 39 PID 2504 wrote to memory of 2600 2504 7tnnbh.exe 39 PID 2504 wrote to memory of 2600 2504 7tnnbh.exe 39 PID 2600 wrote to memory of 2532 2600 9fflrxf.exe 40 PID 2600 wrote to memory of 2532 2600 9fflrxf.exe 40 PID 2600 wrote to memory of 2532 2600 9fflrxf.exe 40 PID 2600 wrote to memory of 2532 2600 9fflrxf.exe 40 PID 2532 wrote to memory of 2152 2532 jjvjv.exe 41 PID 2532 wrote to memory of 2152 2532 jjvjv.exe 41 PID 2532 wrote to memory of 2152 2532 jjvjv.exe 41 PID 2532 wrote to memory of 2152 2532 jjvjv.exe 41 PID 2152 wrote to memory of 1752 2152 rlfrflx.exe 42 PID 2152 wrote to memory of 1752 2152 rlfrflx.exe 42 PID 2152 wrote to memory of 1752 2152 rlfrflx.exe 42 PID 2152 wrote to memory of 1752 2152 rlfrflx.exe 42 PID 1752 wrote to memory of 1636 1752 hhtnbb.exe 43 PID 1752 wrote to memory of 1636 1752 hhtnbb.exe 43 PID 1752 wrote to memory of 1636 1752 hhtnbb.exe 43 PID 1752 wrote to memory of 1636 1752 hhtnbb.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\f8b22c39030b32d8b1d1f9acebf40ea2a28de2b698d7a8a42a9f26253ce337e4.exe"C:\Users\Admin\AppData\Local\Temp\f8b22c39030b32d8b1d1f9acebf40ea2a28de2b698d7a8a42a9f26253ce337e4.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:796 -
\??\c:\ffxrxxl.exec:\ffxrxxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\3nhnbb.exec:\3nhnbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
\??\c:\jjdjv.exec:\jjdjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\rrlxlrf.exec:\rrlxlrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\nttbtb.exec:\nttbtb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\vppdp.exec:\vppdp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\fxffflx.exec:\fxffflx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\tthhth.exec:\tthhth.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\nnhtnt.exec:\nnhtnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\1ffflrl.exec:\1ffflrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\7tnnbh.exec:\7tnnbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\9fflrxf.exec:\9fflrxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\jjvjv.exec:\jjvjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\rlfrflx.exec:\rlfrflx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\hhtnbb.exec:\hhtnbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
\??\c:\vdvpd.exec:\vdvpd.exe17⤵
- Executes dropped EXE
PID:1636 -
\??\c:\3bthnb.exec:\3bthnb.exe18⤵
- Executes dropped EXE
PID:2268 -
\??\c:\lfrlllx.exec:\lfrlllx.exe19⤵
- Executes dropped EXE
PID:1936 -
\??\c:\lrrxflf.exec:\lrrxflf.exe20⤵
- Executes dropped EXE
PID:1804 -
\??\c:\ntnthh.exec:\ntnthh.exe21⤵
- Executes dropped EXE
PID:2588 -
\??\c:\llflxfl.exec:\llflxfl.exe22⤵
- Executes dropped EXE
PID:2988 -
\??\c:\3tntbh.exec:\3tntbh.exe23⤵
- Executes dropped EXE
PID:2948 -
\??\c:\xxlxllx.exec:\xxlxllx.exe24⤵
- Executes dropped EXE
PID:2808 -
\??\c:\xfxlxlf.exec:\xfxlxlf.exe25⤵
- Executes dropped EXE
PID:1568 -
\??\c:\lrfffrf.exec:\lrfffrf.exe26⤵
- Executes dropped EXE
PID:1104 -
\??\c:\djjvj.exec:\djjvj.exe27⤵
- Executes dropped EXE
PID:304 -
\??\c:\flflflf.exec:\flflflf.exe28⤵
- Executes dropped EXE
PID:1668 -
\??\c:\ppjpd.exec:\ppjpd.exe29⤵
- Executes dropped EXE
PID:3016 -
\??\c:\rrfrxfx.exec:\rrfrxfx.exe30⤵
- Executes dropped EXE
PID:1684 -
\??\c:\1dvjv.exec:\1dvjv.exe31⤵
- Executes dropped EXE
PID:2208 -
\??\c:\vdjpd.exec:\vdjpd.exe32⤵
- Executes dropped EXE
PID:592 -
\??\c:\ffxrrxl.exec:\ffxrrxl.exe33⤵
- Executes dropped EXE
PID:2460 -
\??\c:\dvpdj.exec:\dvpdj.exe34⤵
- Executes dropped EXE
PID:872 -
\??\c:\htthnt.exec:\htthnt.exe35⤵
- Executes dropped EXE
PID:1016 -
\??\c:\tnhhtb.exec:\tnhhtb.exe36⤵
- Executes dropped EXE
PID:2004 -
\??\c:\5vjdv.exec:\5vjdv.exe37⤵
- Executes dropped EXE
PID:1224 -
\??\c:\1lxxflx.exec:\1lxxflx.exe38⤵
- Executes dropped EXE
PID:2020 -
\??\c:\xfxlrrx.exec:\xfxlrrx.exe39⤵
- Executes dropped EXE
PID:316 -
\??\c:\hhhthn.exec:\hhhthn.exe40⤵
- Executes dropped EXE
PID:1728 -
\??\c:\vddjv.exec:\vddjv.exe41⤵
- Executes dropped EXE
PID:2928 -
\??\c:\ffxrllx.exec:\ffxrllx.exe42⤵
- Executes dropped EXE
PID:2756 -
\??\c:\xrfllrf.exec:\xrfllrf.exe43⤵
- Executes dropped EXE
PID:2912 -
\??\c:\tnbbnt.exec:\tnbbnt.exe44⤵
- Executes dropped EXE
PID:2724 -
\??\c:\jjvjj.exec:\jjvjj.exe45⤵
- Executes dropped EXE
PID:2708 -
\??\c:\jpjpd.exec:\jpjpd.exe46⤵
- Executes dropped EXE
PID:2684 -
\??\c:\llxfxll.exec:\llxfxll.exe47⤵
- Executes dropped EXE
PID:2872 -
\??\c:\bhbnbn.exec:\bhbnbn.exe48⤵
- Executes dropped EXE
PID:2168 -
\??\c:\3btbbh.exec:\3btbbh.exe49⤵
- Executes dropped EXE
PID:2424 -
\??\c:\7dvdj.exec:\7dvdj.exe50⤵
- Executes dropped EXE
PID:2508 -
\??\c:\7ffrxlx.exec:\7ffrxlx.exe51⤵
- Executes dropped EXE
PID:2484 -
\??\c:\xrlrxxl.exec:\xrlrxxl.exe52⤵
- Executes dropped EXE
PID:2524 -
\??\c:\tnhnnt.exec:\tnhnnt.exe53⤵
- Executes dropped EXE
PID:3024 -
\??\c:\vvpvd.exec:\vvpvd.exe54⤵
- Executes dropped EXE
PID:2428 -
\??\c:\xrxrrlr.exec:\xrxrrlr.exe55⤵
- Executes dropped EXE
PID:2388 -
\??\c:\rrlfflf.exec:\rrlfflf.exe56⤵
- Executes dropped EXE
PID:1692 -
\??\c:\bnnttt.exec:\bnnttt.exe57⤵
- Executes dropped EXE
PID:1632 -
\??\c:\jdpvv.exec:\jdpvv.exe58⤵
- Executes dropped EXE
PID:1840 -
\??\c:\vjpjj.exec:\vjpjj.exe59⤵
- Executes dropped EXE
PID:1788 -
\??\c:\fxxlxff.exec:\fxxlxff.exe60⤵
- Executes dropped EXE
PID:2796 -
\??\c:\hbhtht.exec:\hbhtht.exe61⤵
- Executes dropped EXE
PID:1804 -
\??\c:\jppdd.exec:\jppdd.exe62⤵
- Executes dropped EXE
PID:1932 -
\??\c:\dpppv.exec:\dpppv.exe63⤵
- Executes dropped EXE
PID:2116 -
\??\c:\frxffff.exec:\frxffff.exe64⤵
- Executes dropped EXE
PID:2988 -
\??\c:\9nntbn.exec:\9nntbn.exe65⤵
- Executes dropped EXE
PID:2076 -
\??\c:\bbtbtb.exec:\bbtbtb.exe66⤵PID:288
-
\??\c:\jvvjd.exec:\jvvjd.exe67⤵PID:2808
-
\??\c:\7fxlllr.exec:\7fxlllr.exe68⤵PID:1140
-
\??\c:\5rflxfl.exec:\5rflxfl.exe69⤵PID:1976
-
\??\c:\nhhhtb.exec:\nhhhtb.exe70⤵PID:692
-
\??\c:\jpjpv.exec:\jpjpv.exe71⤵PID:1324
-
\??\c:\lfrxrrf.exec:\lfrxrrf.exe72⤵PID:308
-
\??\c:\frlrfxx.exec:\frlrfxx.exe73⤵PID:876
-
\??\c:\hbbbhn.exec:\hbbbhn.exe74⤵PID:2160
-
\??\c:\1dpvv.exec:\1dpvv.exe75⤵
- System Location Discovery: System Language Discovery
PID:1684 -
\??\c:\3jvpp.exec:\3jvpp.exe76⤵PID:2208
-
\??\c:\9fxxxfl.exec:\9fxxxfl.exe77⤵PID:1532
-
\??\c:\ththhn.exec:\ththhn.exe78⤵PID:2460
-
\??\c:\bthhhh.exec:\bthhhh.exe79⤵PID:2264
-
\??\c:\pvpvd.exec:\pvpvd.exe80⤵PID:1628
-
\??\c:\7rxfllr.exec:\7rxfllr.exe81⤵PID:1624
-
\??\c:\9lfrllf.exec:\9lfrllf.exe82⤵PID:1592
-
\??\c:\tntttb.exec:\tntttb.exe83⤵PID:1704
-
\??\c:\jpddd.exec:\jpddd.exe84⤵PID:1616
-
\??\c:\jpdpp.exec:\jpdpp.exe85⤵PID:2448
-
\??\c:\fxxfrxl.exec:\fxxfrxl.exe86⤵PID:2400
-
\??\c:\tthnbh.exec:\tthnbh.exe87⤵PID:3044
-
\??\c:\djdjv.exec:\djdjv.exe88⤵PID:2016
-
\??\c:\3dppp.exec:\3dppp.exe89⤵PID:2756
-
\??\c:\ffflxfl.exec:\ffflxfl.exe90⤵PID:2744
-
\??\c:\fxffxxf.exec:\fxffxxf.exe91⤵PID:2616
-
\??\c:\btnthh.exec:\btnthh.exe92⤵PID:2416
-
\??\c:\3vdvv.exec:\3vdvv.exe93⤵PID:2752
-
\??\c:\vddpv.exec:\vddpv.exe94⤵PID:2676
-
\??\c:\rrxfrrx.exec:\rrxfrrx.exe95⤵PID:2812
-
\??\c:\htbttn.exec:\htbttn.exe96⤵PID:2828
-
\??\c:\dvddd.exec:\dvddd.exe97⤵PID:2476
-
\??\c:\pvjpp.exec:\pvjpp.exe98⤵
- System Location Discovery: System Language Discovery
PID:2392 -
\??\c:\rllrfll.exec:\rllrfll.exe99⤵PID:2532
-
\??\c:\tthbnt.exec:\tthbnt.exe100⤵PID:2152
-
\??\c:\hbtthn.exec:\hbtthn.exe101⤵PID:1720
-
\??\c:\pjdpv.exec:\pjdpv.exe102⤵PID:1752
-
\??\c:\1lrffll.exec:\1lrffll.exe103⤵PID:1688
-
\??\c:\xffxlrf.exec:\xffxlrf.exe104⤵PID:1856
-
\??\c:\ntntht.exec:\ntntht.exe105⤵PID:1656
-
\??\c:\ppjpv.exec:\ppjpv.exe106⤵PID:1936
-
\??\c:\5vppv.exec:\5vppv.exe107⤵PID:2952
-
\??\c:\llfrflx.exec:\llfrflx.exe108⤵PID:2836
-
\??\c:\nhtbnt.exec:\nhtbnt.exe109⤵PID:2332
-
\??\c:\bhnnnn.exec:\bhnnnn.exe110⤵PID:2956
-
\??\c:\5pppv.exec:\5pppv.exe111⤵PID:3008
-
\??\c:\9xrrxfl.exec:\9xrrxfl.exe112⤵PID:2084
-
\??\c:\llffrxx.exec:\llffrxx.exe113⤵PID:1568
-
\??\c:\thbbbh.exec:\thbbbh.exe114⤵PID:1768
-
\??\c:\dvjpv.exec:\dvjpv.exe115⤵PID:948
-
\??\c:\1xlrflx.exec:\1xlrflx.exe116⤵PID:2468
-
\??\c:\xxlfrrf.exec:\xxlfrrf.exe117⤵PID:284
-
\??\c:\nhbhbh.exec:\nhbhbh.exe118⤵PID:844
-
\??\c:\5vvdj.exec:\5vvdj.exe119⤵PID:636
-
\??\c:\lrlxlxx.exec:\lrlxlxx.exe120⤵PID:876
-
\??\c:\fffrxxl.exec:\fffrxxl.exe121⤵PID:2160
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-