Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21-12-2024 07:08
Behavioral task
behavioral1
Sample
feb136ebc403a38eb21e035658dbad992557621509ee3d7fc0ba399d1f6556df.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
feb136ebc403a38eb21e035658dbad992557621509ee3d7fc0ba399d1f6556df.exe
-
Size
333KB
-
MD5
a4af0b16db027f3bf8fdaa886eb41f4f
-
SHA1
1394a4df374c88044c7fcd297e8b1341d90eec68
-
SHA256
feb136ebc403a38eb21e035658dbad992557621509ee3d7fc0ba399d1f6556df
-
SHA512
de18ab3836384fca5496836c2d49fd57353e79f5ee71ea2f87916fba1eb22e2f16bcf15fea628070dc77497d64077b238cc96d2c0d12c668b6e1dca762443234
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeTX:R4wFHoSHYHUrAwfMp3CDj
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/2688-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2936-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2780-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2824-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2912-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1608-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3040-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2592-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2812-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2896-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2588-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/536-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1620-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1920-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2848-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1660-147-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1824-154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2952-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2176-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1604-200-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1856-223-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1708-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2300-245-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2156-271-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1528-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/300-342-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2864-348-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1656-379-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/316-429-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1992-524-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3032-620-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2836-649-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2260-811-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1400-844-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2592-855-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2960-942-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2500-964-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/684-993-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2992-7539-0x00000000770A0000-0x00000000771BF000-memory.dmp family_blackmoon behavioral1/memory/2992-8044-0x00000000771C0000-0x00000000772BA000-memory.dmp family_blackmoon behavioral1/memory/2992-9801-0x00000000770A0000-0x00000000771BF000-memory.dmp family_blackmoon behavioral1/memory/2992-15157-0x00000000770A0000-0x00000000771BF000-memory.dmp family_blackmoon behavioral1/memory/2992-25505-0x00000000770A0000-0x00000000771BF000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2780 fxrxlxf.exe 2936 nnhnbh.exe 2824 lxlxfxf.exe 2912 5ttbhn.exe 1608 1vjpv.exe 2580 3ntthh.exe 3040 ddvdj.exe 2592 7hbtnt.exe 2812 bhhntb.exe 2896 xrflxfr.exe 2588 tnthnh.exe 536 9jjpv.exe 1620 rrrxfll.exe 564 tnnthh.exe 1920 pjdjp.exe 2848 fxflxfr.exe 1660 9tntht.exe 1824 pdjjv.exe 2952 xrrfxfr.exe 2220 pjjpd.exe 1760 vdpdj.exe 1868 5bnthb.exe 2176 5vdvd.exe 1604 rllrflx.exe 2512 9tbtbh.exe 1772 dvpvv.exe 1856 7rlrxrr.exe 628 pdpvd.exe 1708 5pvvv.exe 2300 5frlfll.exe 2156 1tnhhb.exe 3060 flxxxrx.exe 988 nbhhnn.exe 1704 jdjpd.exe 2704 7jpvj.exe 2784 xllflxr.exe 1528 bnbhhb.exe 2788 tnhnbn.exe 2932 1vjvv.exe 2728 lxlxrrr.exe 2684 1htttt.exe 2596 nhbthb.exe 2544 jvvpp.exe 1608 rlrxfxx.exe 2612 rxfflxf.exe 3020 thntbt.exe 300 pvvpj.exe 2864 9vdvp.exe 2868 5fxlfxr.exe 3004 nnttbb.exe 1936 vdjdv.exe 580 jdjjj.exe 1188 rxlxrll.exe 1656 tntbhn.exe 1416 pjvdd.exe 1208 rflrxff.exe 1408 frrllff.exe 2536 9bnnnn.exe 548 bnbbbb.exe 832 3jvvv.exe 316 xllxfff.exe 1356 3xxfffl.exe 1484 thtttn.exe 2356 pvvpp.exe -
resource yara_rule behavioral1/memory/2688-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000120cd-7.dat upx behavioral1/memory/2688-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2936-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000186ee-18.dat upx behavioral1/memory/2780-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2824-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000186fd-26.dat upx behavioral1/files/0x000700000001873d-33.dat upx behavioral1/files/0x000600000001878f-42.dat upx behavioral1/memory/2912-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1608-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000187a5-49.dat upx behavioral1/files/0x0007000000019023-57.dat upx behavioral1/memory/3040-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000800000001925e-65.dat upx behavioral1/memory/2592-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000019261-75.dat upx behavioral1/memory/2592-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2812-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019609-82.dat upx behavioral1/files/0x000500000001960b-91.dat upx behavioral1/memory/2896-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2588-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001960d-98.dat upx behavioral1/files/0x000500000001960f-107.dat upx behavioral1/memory/536-106-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1620-115-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019611-114.dat upx behavioral1/files/0x0005000000019613-122.dat upx behavioral1/files/0x0005000000019615-132.dat upx behavioral1/memory/1920-131-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2848-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019617-139.dat upx behavioral1/memory/1660-147-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019619-148.dat upx behavioral1/files/0x000500000001961b-155.dat upx behavioral1/memory/1824-154-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2952-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0034000000018683-162.dat upx behavioral1/files/0x000500000001961d-170.dat upx behavioral1/files/0x000500000001961f-177.dat upx behavioral1/files/0x0005000000019621-184.dat upx behavioral1/files/0x0005000000019622-194.dat upx behavioral1/memory/1604-193-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2176-192-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019623-202.dat upx behavioral1/memory/1604-200-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019625-208.dat upx behavioral1/files/0x0005000000019667-215.dat upx behavioral1/files/0x00050000000196af-222.dat upx behavioral1/memory/1856-223-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000196b1-230.dat upx behavioral1/memory/1708-237-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001977d-238.dat upx behavioral1/files/0x00050000000197f8-246.dat upx behavioral1/memory/2300-245-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019838-253.dat upx behavioral1/memory/2704-272-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2156-271-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1528-283-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1528-289-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/300-342-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2864-348-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lxrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nttnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9flrrfx.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2688 wrote to memory of 2780 2688 feb136ebc403a38eb21e035658dbad992557621509ee3d7fc0ba399d1f6556df.exe 30 PID 2688 wrote to memory of 2780 2688 feb136ebc403a38eb21e035658dbad992557621509ee3d7fc0ba399d1f6556df.exe 30 PID 2688 wrote to memory of 2780 2688 feb136ebc403a38eb21e035658dbad992557621509ee3d7fc0ba399d1f6556df.exe 30 PID 2688 wrote to memory of 2780 2688 feb136ebc403a38eb21e035658dbad992557621509ee3d7fc0ba399d1f6556df.exe 30 PID 2780 wrote to memory of 2936 2780 fxrxlxf.exe 31 PID 2780 wrote to memory of 2936 2780 fxrxlxf.exe 31 PID 2780 wrote to memory of 2936 2780 fxrxlxf.exe 31 PID 2780 wrote to memory of 2936 2780 fxrxlxf.exe 31 PID 2936 wrote to memory of 2824 2936 nnhnbh.exe 32 PID 2936 wrote to memory of 2824 2936 nnhnbh.exe 32 PID 2936 wrote to memory of 2824 2936 nnhnbh.exe 32 PID 2936 wrote to memory of 2824 2936 nnhnbh.exe 32 PID 2824 wrote to memory of 2912 2824 lxlxfxf.exe 33 PID 2824 wrote to memory of 2912 2824 lxlxfxf.exe 33 PID 2824 wrote to memory of 2912 2824 lxlxfxf.exe 33 PID 2824 wrote to memory of 2912 2824 lxlxfxf.exe 33 PID 2912 wrote to memory of 1608 2912 5ttbhn.exe 34 PID 2912 wrote to memory of 1608 2912 5ttbhn.exe 34 PID 2912 wrote to memory of 1608 2912 5ttbhn.exe 34 PID 2912 wrote to memory of 1608 2912 5ttbhn.exe 34 PID 1608 wrote to memory of 2580 1608 1vjpv.exe 35 PID 1608 wrote to memory of 2580 1608 1vjpv.exe 35 PID 1608 wrote to memory of 2580 1608 1vjpv.exe 35 PID 1608 wrote to memory of 2580 1608 1vjpv.exe 35 PID 2580 wrote to memory of 3040 2580 3ntthh.exe 36 PID 2580 wrote to memory of 3040 2580 3ntthh.exe 36 PID 2580 wrote to memory of 3040 2580 3ntthh.exe 36 PID 2580 wrote to memory of 3040 2580 3ntthh.exe 36 PID 3040 wrote to memory of 2592 3040 ddvdj.exe 37 PID 3040 wrote to memory of 2592 3040 ddvdj.exe 37 PID 3040 wrote to memory of 2592 3040 ddvdj.exe 37 PID 3040 wrote to memory of 2592 3040 ddvdj.exe 37 PID 2592 wrote to memory of 2812 2592 7hbtnt.exe 38 PID 2592 wrote to memory of 2812 2592 7hbtnt.exe 38 PID 2592 wrote to memory of 2812 2592 7hbtnt.exe 38 PID 2592 wrote to memory of 2812 2592 7hbtnt.exe 38 PID 2812 wrote to memory of 2896 2812 bhhntb.exe 39 PID 2812 wrote to memory of 2896 2812 bhhntb.exe 39 PID 2812 wrote to memory of 2896 2812 bhhntb.exe 39 PID 2812 wrote to memory of 2896 2812 bhhntb.exe 39 PID 2896 wrote to memory of 2588 2896 xrflxfr.exe 40 PID 2896 wrote to memory of 2588 2896 xrflxfr.exe 40 PID 2896 wrote to memory of 2588 2896 xrflxfr.exe 40 PID 2896 wrote to memory of 2588 2896 xrflxfr.exe 40 PID 2588 wrote to memory of 536 2588 tnthnh.exe 41 PID 2588 wrote to memory of 536 2588 tnthnh.exe 41 PID 2588 wrote to memory of 536 2588 tnthnh.exe 41 PID 2588 wrote to memory of 536 2588 tnthnh.exe 41 PID 536 wrote to memory of 1620 536 9jjpv.exe 42 PID 536 wrote to memory of 1620 536 9jjpv.exe 42 PID 536 wrote to memory of 1620 536 9jjpv.exe 42 PID 536 wrote to memory of 1620 536 9jjpv.exe 42 PID 1620 wrote to memory of 564 1620 rrrxfll.exe 43 PID 1620 wrote to memory of 564 1620 rrrxfll.exe 43 PID 1620 wrote to memory of 564 1620 rrrxfll.exe 43 PID 1620 wrote to memory of 564 1620 rrrxfll.exe 43 PID 564 wrote to memory of 1920 564 tnnthh.exe 44 PID 564 wrote to memory of 1920 564 tnnthh.exe 44 PID 564 wrote to memory of 1920 564 tnnthh.exe 44 PID 564 wrote to memory of 1920 564 tnnthh.exe 44 PID 1920 wrote to memory of 2848 1920 pjdjp.exe 45 PID 1920 wrote to memory of 2848 1920 pjdjp.exe 45 PID 1920 wrote to memory of 2848 1920 pjdjp.exe 45 PID 1920 wrote to memory of 2848 1920 pjdjp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\feb136ebc403a38eb21e035658dbad992557621509ee3d7fc0ba399d1f6556df.exe"C:\Users\Admin\AppData\Local\Temp\feb136ebc403a38eb21e035658dbad992557621509ee3d7fc0ba399d1f6556df.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\fxrxlxf.exec:\fxrxlxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\nnhnbh.exec:\nnhnbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\lxlxfxf.exec:\lxlxfxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\5ttbhn.exec:\5ttbhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\1vjpv.exec:\1vjpv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\3ntthh.exec:\3ntthh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\ddvdj.exec:\ddvdj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\7hbtnt.exec:\7hbtnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\bhhntb.exec:\bhhntb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\xrflxfr.exec:\xrflxfr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\tnthnh.exec:\tnthnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\9jjpv.exec:\9jjpv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\rrrxfll.exec:\rrrxfll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\tnnthh.exec:\tnnthh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:564 -
\??\c:\pjdjp.exec:\pjdjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\fxflxfr.exec:\fxflxfr.exe17⤵
- Executes dropped EXE
PID:2848 -
\??\c:\9tntht.exec:\9tntht.exe18⤵
- Executes dropped EXE
PID:1660 -
\??\c:\pdjjv.exec:\pdjjv.exe19⤵
- Executes dropped EXE
PID:1824 -
\??\c:\xrrfxfr.exec:\xrrfxfr.exe20⤵
- Executes dropped EXE
PID:2952 -
\??\c:\pjjpd.exec:\pjjpd.exe21⤵
- Executes dropped EXE
PID:2220 -
\??\c:\vdpdj.exec:\vdpdj.exe22⤵
- Executes dropped EXE
PID:1760 -
\??\c:\5bnthb.exec:\5bnthb.exe23⤵
- Executes dropped EXE
PID:1868 -
\??\c:\5vdvd.exec:\5vdvd.exe24⤵
- Executes dropped EXE
PID:2176 -
\??\c:\rllrflx.exec:\rllrflx.exe25⤵
- Executes dropped EXE
PID:1604 -
\??\c:\9tbtbh.exec:\9tbtbh.exe26⤵
- Executes dropped EXE
PID:2512 -
\??\c:\dvpvv.exec:\dvpvv.exe27⤵
- Executes dropped EXE
PID:1772 -
\??\c:\7rlrxrr.exec:\7rlrxrr.exe28⤵
- Executes dropped EXE
PID:1856 -
\??\c:\pdpvd.exec:\pdpvd.exe29⤵
- Executes dropped EXE
PID:628 -
\??\c:\5pvvv.exec:\5pvvv.exe30⤵
- Executes dropped EXE
PID:1708 -
\??\c:\5frlfll.exec:\5frlfll.exe31⤵
- Executes dropped EXE
PID:2300 -
\??\c:\1tnhhb.exec:\1tnhhb.exe32⤵
- Executes dropped EXE
PID:2156 -
\??\c:\flxxxrx.exec:\flxxxrx.exe33⤵
- Executes dropped EXE
PID:3060 -
\??\c:\nbhhnn.exec:\nbhhnn.exe34⤵
- Executes dropped EXE
PID:988 -
\??\c:\jdjpd.exec:\jdjpd.exe35⤵
- Executes dropped EXE
PID:1704 -
\??\c:\7jpvj.exec:\7jpvj.exe36⤵
- Executes dropped EXE
PID:2704 -
\??\c:\xllflxr.exec:\xllflxr.exe37⤵
- Executes dropped EXE
PID:2784 -
\??\c:\bnbhhb.exec:\bnbhhb.exe38⤵
- Executes dropped EXE
PID:1528 -
\??\c:\tnhnbn.exec:\tnhnbn.exe39⤵
- Executes dropped EXE
PID:2788 -
\??\c:\1vjvv.exec:\1vjvv.exe40⤵
- Executes dropped EXE
PID:2932 -
\??\c:\lxlxrrr.exec:\lxlxrrr.exe41⤵
- Executes dropped EXE
PID:2728 -
\??\c:\1htttt.exec:\1htttt.exe42⤵
- Executes dropped EXE
PID:2684 -
\??\c:\nhbthb.exec:\nhbthb.exe43⤵
- Executes dropped EXE
PID:2596 -
\??\c:\jvvpp.exec:\jvvpp.exe44⤵
- Executes dropped EXE
PID:2544 -
\??\c:\rlrxfxx.exec:\rlrxfxx.exe45⤵
- Executes dropped EXE
PID:1608 -
\??\c:\rxfflxf.exec:\rxfflxf.exe46⤵
- Executes dropped EXE
PID:2612 -
\??\c:\thntbt.exec:\thntbt.exe47⤵
- Executes dropped EXE
PID:3020 -
\??\c:\pvvpj.exec:\pvvpj.exe48⤵
- Executes dropped EXE
PID:300 -
\??\c:\9vdvp.exec:\9vdvp.exe49⤵
- Executes dropped EXE
PID:2864 -
\??\c:\5fxlfxr.exec:\5fxlfxr.exe50⤵
- Executes dropped EXE
PID:2868 -
\??\c:\nnttbb.exec:\nnttbb.exe51⤵
- Executes dropped EXE
PID:3004 -
\??\c:\vdjdv.exec:\vdjdv.exe52⤵
- Executes dropped EXE
PID:1936 -
\??\c:\jdjjj.exec:\jdjjj.exe53⤵
- Executes dropped EXE
PID:580 -
\??\c:\rxlxrll.exec:\rxlxrll.exe54⤵
- Executes dropped EXE
PID:1188 -
\??\c:\tntbhn.exec:\tntbhn.exe55⤵
- Executes dropped EXE
PID:1656 -
\??\c:\pjvdd.exec:\pjvdd.exe56⤵
- Executes dropped EXE
PID:1416 -
\??\c:\rflrxff.exec:\rflrxff.exe57⤵
- Executes dropped EXE
PID:1208 -
\??\c:\frrllff.exec:\frrllff.exe58⤵
- Executes dropped EXE
PID:1408 -
\??\c:\9bnnnn.exec:\9bnnnn.exe59⤵
- Executes dropped EXE
PID:2536 -
\??\c:\bnbbbb.exec:\bnbbbb.exe60⤵
- Executes dropped EXE
PID:548 -
\??\c:\3jvvv.exec:\3jvvv.exe61⤵
- Executes dropped EXE
PID:832 -
\??\c:\xllxfff.exec:\xllxfff.exe62⤵
- Executes dropped EXE
PID:316 -
\??\c:\3xxfffl.exec:\3xxfffl.exe63⤵
- Executes dropped EXE
PID:1356 -
\??\c:\thtttn.exec:\thtttn.exe64⤵
- Executes dropped EXE
PID:1484 -
\??\c:\pvvpp.exec:\pvvpp.exe65⤵
- Executes dropped EXE
PID:2356 -
\??\c:\vjdjj.exec:\vjdjj.exe66⤵PID:2132
-
\??\c:\3rrfflx.exec:\3rrfflx.exe67⤵PID:1760
-
\??\c:\hthnnn.exec:\hthnnn.exe68⤵PID:1728
-
\??\c:\ddvpv.exec:\ddvpv.exe69⤵PID:1624
-
\??\c:\3vddj.exec:\3vddj.exe70⤵PID:2456
-
\??\c:\3xlllfl.exec:\3xlllfl.exe71⤵PID:948
-
\??\c:\fxrfrxf.exec:\fxrfrxf.exe72⤵PID:688
-
\??\c:\nhtbnn.exec:\nhtbnn.exe73⤵PID:1184
-
\??\c:\jvjpv.exec:\jvjpv.exe74⤵PID:2388
-
\??\c:\5vjjp.exec:\5vjjp.exe75⤵PID:1856
-
\??\c:\lxlrrrr.exec:\lxlrrrr.exe76⤵PID:1352
-
\??\c:\7bbbbb.exec:\7bbbbb.exe77⤵PID:344
-
\??\c:\3dppv.exec:\3dppv.exe78⤵PID:2916
-
\??\c:\7dpjv.exec:\7dpjv.exe79⤵PID:1836
-
\??\c:\lxfflll.exec:\lxfflll.exe80⤵PID:1008
-
\??\c:\frxxffl.exec:\frxxffl.exe81⤵PID:892
-
\??\c:\bthnnb.exec:\bthnnb.exe82⤵PID:1992
-
\??\c:\7vpdd.exec:\7vpdd.exe83⤵PID:3000
-
\??\c:\9rffxxl.exec:\9rffxxl.exe84⤵PID:2792
-
\??\c:\9rlfxxf.exec:\9rlfxxf.exe85⤵PID:2948
-
\??\c:\nnbntt.exec:\nnbntt.exe86⤵PID:2700
-
\??\c:\ththbt.exec:\ththbt.exe87⤵PID:2752
-
\??\c:\dpdjd.exec:\dpdjd.exe88⤵PID:2708
-
\??\c:\7rrxffl.exec:\7rrxffl.exe89⤵PID:2824
-
\??\c:\9lfrxxf.exec:\9lfrxxf.exe90⤵PID:2740
-
\??\c:\5bbtbh.exec:\5bbtbh.exe91⤵PID:2804
-
\??\c:\1ttbbb.exec:\1ttbbb.exe92⤵PID:1224
-
\??\c:\jvdjj.exec:\jvdjj.exe93⤵PID:2560
-
\??\c:\7frrlff.exec:\7frrlff.exe94⤵PID:1044
-
\??\c:\bbntbh.exec:\bbntbh.exe95⤵PID:2600
-
\??\c:\hbhntb.exec:\hbhntb.exe96⤵PID:3032
-
\??\c:\ddvjj.exec:\ddvjj.exe97⤵PID:2884
-
\??\c:\vpvdp.exec:\vpvdp.exe98⤵PID:2844
-
\??\c:\lfrrrrx.exec:\lfrrrrx.exe99⤵PID:2868
-
\??\c:\hbnttb.exec:\hbnttb.exe100⤵PID:2268
-
\??\c:\7jdjd.exec:\7jdjd.exe101⤵PID:1988
-
\??\c:\ffrxfrf.exec:\ffrxfrf.exe102⤵PID:536
-
\??\c:\bnhhtt.exec:\bnhhtt.exe103⤵PID:772
-
\??\c:\hbnbbh.exec:\hbnbbh.exe104⤵PID:1416
-
\??\c:\vjppv.exec:\vjppv.exe105⤵PID:2836
-
\??\c:\rlffrlx.exec:\rlffrlx.exe106⤵PID:1572
-
\??\c:\fxflrrl.exec:\fxflrrl.exe107⤵PID:1444
-
\??\c:\tnbntb.exec:\tnbntb.exe108⤵PID:1660
-
\??\c:\pjvvd.exec:\pjvvd.exe109⤵PID:2956
-
\??\c:\pdvpj.exec:\pdvpj.exe110⤵PID:2960
-
\??\c:\9lxllfl.exec:\9lxllfl.exe111⤵PID:1768
-
\??\c:\tththt.exec:\tththt.exe112⤵PID:2220
-
\??\c:\9bhhhh.exec:\9bhhhh.exe113⤵PID:2352
-
\??\c:\vpdjp.exec:\vpdjp.exe114⤵PID:2500
-
\??\c:\rxflflr.exec:\rxflflr.exe115⤵PID:1100
-
\??\c:\rlxxffr.exec:\rlxxffr.exe116⤵PID:1732
-
\??\c:\tnhttb.exec:\tnhttb.exe117⤵PID:1064
-
\??\c:\nhhbnt.exec:\nhhbnt.exe118⤵PID:836
-
\??\c:\3jpdj.exec:\3jpdj.exe119⤵PID:744
-
\??\c:\frllrrf.exec:\frllrrf.exe120⤵PID:1956
-
\??\c:\5rxfrrx.exec:\5rxfrrx.exe121⤵PID:1464
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-