Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-12-2024 22:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4f6e7c0f8a510edbdd662d290ef1818c85b4f45c84786b8b2b1adfeec8a0874c.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
4f6e7c0f8a510edbdd662d290ef1818c85b4f45c84786b8b2b1adfeec8a0874c.exe
-
Size
453KB
-
MD5
4ec3247ccb526f9aecdc2d4a627a3ddf
-
SHA1
a4137a09d5e726f68a82d4a0bda6fc26824af3cd
-
SHA256
4f6e7c0f8a510edbdd662d290ef1818c85b4f45c84786b8b2b1adfeec8a0874c
-
SHA512
bd98e819d0142c9a7087ff29f1e85045c59ef132bfaefb55c161e914447a824cb3a5464ccaad02832077d844bbe4fc99c1a166db9df628ab59e17bee48424f16
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeE:q7Tc2NYHUrAwfMp3CDE
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/2812-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1640-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1740-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1860-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/628-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1192-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1448-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1104-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-147-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2752-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1932-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1352-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/348-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1352-187-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/764-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3060-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/532-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/628-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2180-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1872-413-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-462-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1652-508-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1648-515-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-601-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-620-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1216-776-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2264-835-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2232-1018-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2232-1039-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/3000-1144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2680 nbnthn.exe 2832 xrrrxxl.exe 1640 9lflxfr.exe 2700 nhhhtb.exe 2648 pjdjv.exe 1740 ddvpd.exe 1860 djpjv.exe 628 pjdjd.exe 3004 lrllxxl.exe 2180 llrrrxf.exe 1192 xrffrrf.exe 1448 3vvdp.exe 1104 lfxfrrl.exe 2596 xxrlxfr.exe 2752 lffrflr.exe 1708 pjdjv.exe 1932 fxrrfxl.exe 348 ddpvd.exe 1352 rfrlrff.exe 2932 3tthnn.exe 1764 1vpvd.exe 764 xxxflrl.exe 2356 ppjpv.exe 1696 7rlrxfr.exe 1636 vpdpd.exe 912 ffrffrl.exe 2476 ppvdj.exe 2328 fxlrrrf.exe 1952 nhtbhn.exe 1920 jdvdp.exe 2676 rrlrlrl.exe 2812 pjdpp.exe 2196 3xfxllx.exe 2124 ppjjv.exe 3060 jdvdp.exe 2664 fllrffr.exe 796 1hhhtb.exe 3016 dddjv.exe 2988 rrrlrrf.exe 532 tnhntt.exe 992 tnhhnt.exe 1048 3pdpv.exe 2884 fxxrxxf.exe 628 hhtntt.exe 2424 vvvjp.exe 2516 5lrrrrx.exe 2180 bhbbhn.exe 2436 nbnntn.exe 1108 dvddd.exe 1872 lrfxxrl.exe 1104 hnntbh.exe 1612 vvvvd.exe 2428 9xlrflf.exe 1712 5tttbt.exe 2484 bbtbnn.exe 2508 1vvpv.exe 2512 ffxxllx.exe 2056 nhhnbh.exe 2932 3dvdj.exe 2144 fxllxxx.exe 324 ttthtb.exe 2452 3httbh.exe 1540 jjdjd.exe 1652 lffrxfr.exe -
resource yara_rule behavioral1/memory/2812-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1640-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1860-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/628-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1192-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1448-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1104-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1448-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1104-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-147-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2752-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/348-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1352-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/348-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/764-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/532-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/628-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1104-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1872-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-508-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-515-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-601-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-651-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1420-677-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-716-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-730-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1216-769-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1216-776-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-835-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/996-849-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-907-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1092-1056-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-1144-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrfrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlllrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfllxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flllllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rffrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hhntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlffrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2812 wrote to memory of 2680 2812 4f6e7c0f8a510edbdd662d290ef1818c85b4f45c84786b8b2b1adfeec8a0874c.exe 30 PID 2812 wrote to memory of 2680 2812 4f6e7c0f8a510edbdd662d290ef1818c85b4f45c84786b8b2b1adfeec8a0874c.exe 30 PID 2812 wrote to memory of 2680 2812 4f6e7c0f8a510edbdd662d290ef1818c85b4f45c84786b8b2b1adfeec8a0874c.exe 30 PID 2812 wrote to memory of 2680 2812 4f6e7c0f8a510edbdd662d290ef1818c85b4f45c84786b8b2b1adfeec8a0874c.exe 30 PID 2680 wrote to memory of 2832 2680 nbnthn.exe 31 PID 2680 wrote to memory of 2832 2680 nbnthn.exe 31 PID 2680 wrote to memory of 2832 2680 nbnthn.exe 31 PID 2680 wrote to memory of 2832 2680 nbnthn.exe 31 PID 2832 wrote to memory of 1640 2832 xrrrxxl.exe 32 PID 2832 wrote to memory of 1640 2832 xrrrxxl.exe 32 PID 2832 wrote to memory of 1640 2832 xrrrxxl.exe 32 PID 2832 wrote to memory of 1640 2832 xrrrxxl.exe 32 PID 1640 wrote to memory of 2700 1640 9lflxfr.exe 33 PID 1640 wrote to memory of 2700 1640 9lflxfr.exe 33 PID 1640 wrote to memory of 2700 1640 9lflxfr.exe 33 PID 1640 wrote to memory of 2700 1640 9lflxfr.exe 33 PID 2700 wrote to memory of 2648 2700 nhhhtb.exe 34 PID 2700 wrote to memory of 2648 2700 nhhhtb.exe 34 PID 2700 wrote to memory of 2648 2700 nhhhtb.exe 34 PID 2700 wrote to memory of 2648 2700 nhhhtb.exe 34 PID 2648 wrote to memory of 1740 2648 pjdjv.exe 35 PID 2648 wrote to memory of 1740 2648 pjdjv.exe 35 PID 2648 wrote to memory of 1740 2648 pjdjv.exe 35 PID 2648 wrote to memory of 1740 2648 pjdjv.exe 35 PID 1740 wrote to memory of 1860 1740 ddvpd.exe 36 PID 1740 wrote to memory of 1860 1740 ddvpd.exe 36 PID 1740 wrote to memory of 1860 1740 ddvpd.exe 36 PID 1740 wrote to memory of 1860 1740 ddvpd.exe 36 PID 1860 wrote to memory of 628 1860 djpjv.exe 37 PID 1860 wrote to memory of 628 1860 djpjv.exe 37 PID 1860 wrote to memory of 628 1860 djpjv.exe 37 PID 1860 wrote to memory of 628 1860 djpjv.exe 37 PID 628 wrote to memory of 3004 628 pjdjd.exe 38 PID 628 wrote to memory of 3004 628 pjdjd.exe 38 PID 628 wrote to memory of 3004 628 pjdjd.exe 38 PID 628 wrote to memory of 3004 628 pjdjd.exe 38 PID 3004 wrote to memory of 2180 3004 lrllxxl.exe 39 PID 3004 wrote to memory of 2180 3004 lrllxxl.exe 39 PID 3004 wrote to memory of 2180 3004 lrllxxl.exe 39 PID 3004 wrote to memory of 2180 3004 lrllxxl.exe 39 PID 2180 wrote to memory of 1192 2180 llrrrxf.exe 40 PID 2180 wrote to memory of 1192 2180 llrrrxf.exe 40 PID 2180 wrote to memory of 1192 2180 llrrrxf.exe 40 PID 2180 wrote to memory of 1192 2180 llrrrxf.exe 40 PID 1192 wrote to memory of 1448 1192 xrffrrf.exe 41 PID 1192 wrote to memory of 1448 1192 xrffrrf.exe 41 PID 1192 wrote to memory of 1448 1192 xrffrrf.exe 41 PID 1192 wrote to memory of 1448 1192 xrffrrf.exe 41 PID 1448 wrote to memory of 1104 1448 3vvdp.exe 42 PID 1448 wrote to memory of 1104 1448 3vvdp.exe 42 PID 1448 wrote to memory of 1104 1448 3vvdp.exe 42 PID 1448 wrote to memory of 1104 1448 3vvdp.exe 42 PID 1104 wrote to memory of 2596 1104 lfxfrrl.exe 43 PID 1104 wrote to memory of 2596 1104 lfxfrrl.exe 43 PID 1104 wrote to memory of 2596 1104 lfxfrrl.exe 43 PID 1104 wrote to memory of 2596 1104 lfxfrrl.exe 43 PID 2596 wrote to memory of 2752 2596 xxrlxfr.exe 44 PID 2596 wrote to memory of 2752 2596 xxrlxfr.exe 44 PID 2596 wrote to memory of 2752 2596 xxrlxfr.exe 44 PID 2596 wrote to memory of 2752 2596 xxrlxfr.exe 44 PID 2752 wrote to memory of 1708 2752 lffrflr.exe 45 PID 2752 wrote to memory of 1708 2752 lffrflr.exe 45 PID 2752 wrote to memory of 1708 2752 lffrflr.exe 45 PID 2752 wrote to memory of 1708 2752 lffrflr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f6e7c0f8a510edbdd662d290ef1818c85b4f45c84786b8b2b1adfeec8a0874c.exe"C:\Users\Admin\AppData\Local\Temp\4f6e7c0f8a510edbdd662d290ef1818c85b4f45c84786b8b2b1adfeec8a0874c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\nbnthn.exec:\nbnthn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\xrrrxxl.exec:\xrrrxxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\9lflxfr.exec:\9lflxfr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\nhhhtb.exec:\nhhhtb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\pjdjv.exec:\pjdjv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\ddvpd.exec:\ddvpd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\djpjv.exec:\djpjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\pjdjd.exec:\pjdjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
\??\c:\lrllxxl.exec:\lrllxxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\llrrrxf.exec:\llrrrxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\xrffrrf.exec:\xrffrrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
\??\c:\3vvdp.exec:\3vvdp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\lfxfrrl.exec:\lfxfrrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
\??\c:\xxrlxfr.exec:\xxrlxfr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\lffrflr.exec:\lffrflr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\pjdjv.exec:\pjdjv.exe17⤵
- Executes dropped EXE
PID:1708 -
\??\c:\fxrrfxl.exec:\fxrrfxl.exe18⤵
- Executes dropped EXE
PID:1932 -
\??\c:\ddpvd.exec:\ddpvd.exe19⤵
- Executes dropped EXE
PID:348 -
\??\c:\rfrlrff.exec:\rfrlrff.exe20⤵
- Executes dropped EXE
PID:1352 -
\??\c:\3tthnn.exec:\3tthnn.exe21⤵
- Executes dropped EXE
PID:2932 -
\??\c:\1vpvd.exec:\1vpvd.exe22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1764 -
\??\c:\xxxflrl.exec:\xxxflrl.exe23⤵
- Executes dropped EXE
PID:764 -
\??\c:\ppjpv.exec:\ppjpv.exe24⤵
- Executes dropped EXE
PID:2356 -
\??\c:\7rlrxfr.exec:\7rlrxfr.exe25⤵
- Executes dropped EXE
PID:1696 -
\??\c:\vpdpd.exec:\vpdpd.exe26⤵
- Executes dropped EXE
PID:1636 -
\??\c:\ffrffrl.exec:\ffrffrl.exe27⤵
- Executes dropped EXE
PID:912 -
\??\c:\ppvdj.exec:\ppvdj.exe28⤵
- Executes dropped EXE
PID:2476 -
\??\c:\fxlrrrf.exec:\fxlrrrf.exe29⤵
- Executes dropped EXE
PID:2328 -
\??\c:\nhtbhn.exec:\nhtbhn.exe30⤵
- Executes dropped EXE
PID:1952 -
\??\c:\jdvdp.exec:\jdvdp.exe31⤵
- Executes dropped EXE
PID:1920 -
\??\c:\rrlrlrl.exec:\rrlrlrl.exe32⤵
- Executes dropped EXE
PID:2676 -
\??\c:\pjdpp.exec:\pjdpp.exe33⤵
- Executes dropped EXE
PID:2812 -
\??\c:\3xfxllx.exec:\3xfxllx.exe34⤵
- Executes dropped EXE
PID:2196 -
\??\c:\ppjjv.exec:\ppjjv.exe35⤵
- Executes dropped EXE
PID:2124 -
\??\c:\jdvdp.exec:\jdvdp.exe36⤵
- Executes dropped EXE
PID:3060 -
\??\c:\fllrffr.exec:\fllrffr.exe37⤵
- Executes dropped EXE
PID:2664 -
\??\c:\1hhhtb.exec:\1hhhtb.exe38⤵
- Executes dropped EXE
PID:796 -
\??\c:\dddjv.exec:\dddjv.exe39⤵
- Executes dropped EXE
PID:3016 -
\??\c:\rrrlrrf.exec:\rrrlrrf.exe40⤵
- Executes dropped EXE
PID:2988 -
\??\c:\tnhntt.exec:\tnhntt.exe41⤵
- Executes dropped EXE
PID:532 -
\??\c:\tnhhnt.exec:\tnhhnt.exe42⤵
- Executes dropped EXE
PID:992 -
\??\c:\3pdpv.exec:\3pdpv.exe43⤵
- Executes dropped EXE
PID:1048 -
\??\c:\fxxrxxf.exec:\fxxrxxf.exe44⤵
- Executes dropped EXE
PID:2884 -
\??\c:\hhtntt.exec:\hhtntt.exe45⤵
- Executes dropped EXE
PID:628 -
\??\c:\vvvjp.exec:\vvvjp.exe46⤵
- Executes dropped EXE
PID:2424 -
\??\c:\5lrrrrx.exec:\5lrrrrx.exe47⤵
- Executes dropped EXE
PID:2516 -
\??\c:\bhbbhn.exec:\bhbbhn.exe48⤵
- Executes dropped EXE
PID:2180 -
\??\c:\nbnntn.exec:\nbnntn.exe49⤵
- Executes dropped EXE
PID:2436 -
\??\c:\dvddd.exec:\dvddd.exe50⤵
- Executes dropped EXE
PID:1108 -
\??\c:\lrfxxrl.exec:\lrfxxrl.exe51⤵
- Executes dropped EXE
PID:1872 -
\??\c:\hnntbh.exec:\hnntbh.exe52⤵
- Executes dropped EXE
PID:1104 -
\??\c:\vvvvd.exec:\vvvvd.exe53⤵
- Executes dropped EXE
PID:1612 -
\??\c:\9xlrflf.exec:\9xlrflf.exe54⤵
- Executes dropped EXE
PID:2428 -
\??\c:\5tttbt.exec:\5tttbt.exe55⤵
- Executes dropped EXE
PID:1712 -
\??\c:\bbtbnn.exec:\bbtbnn.exe56⤵
- Executes dropped EXE
PID:2484 -
\??\c:\1vvpv.exec:\1vvpv.exe57⤵
- Executes dropped EXE
PID:2508 -
\??\c:\ffxxllx.exec:\ffxxllx.exe58⤵
- Executes dropped EXE
PID:2512 -
\??\c:\nhhnbh.exec:\nhhnbh.exe59⤵
- Executes dropped EXE
PID:2056 -
\??\c:\3dvdj.exec:\3dvdj.exe60⤵
- Executes dropped EXE
PID:2932 -
\??\c:\fxllxxx.exec:\fxllxxx.exe61⤵
- Executes dropped EXE
PID:2144 -
\??\c:\ttthtb.exec:\ttthtb.exe62⤵
- Executes dropped EXE
PID:324 -
\??\c:\3httbh.exec:\3httbh.exe63⤵
- Executes dropped EXE
PID:2452 -
\??\c:\jjdjd.exec:\jjdjd.exe64⤵
- Executes dropped EXE
PID:1540 -
\??\c:\lffrxfr.exec:\lffrxfr.exe65⤵
- Executes dropped EXE
PID:1652 -
\??\c:\thnbnn.exec:\thnbnn.exe66⤵PID:1648
-
\??\c:\tnbbhh.exec:\tnbbhh.exe67⤵PID:2348
-
\??\c:\vdpjp.exec:\vdpjp.exe68⤵PID:1460
-
\??\c:\ffrxlrf.exec:\ffrxlrf.exe69⤵PID:1584
-
\??\c:\tnnnbt.exec:\tnnnbt.exe70⤵PID:2328
-
\??\c:\ntnthb.exec:\ntnthb.exe71⤵PID:3024
-
\??\c:\jdjdv.exec:\jdjdv.exe72⤵PID:1428
-
\??\c:\lxxlffr.exec:\lxxlffr.exe73⤵PID:2912
-
\??\c:\tnbntt.exec:\tnbntt.exe74⤵PID:2820
-
\??\c:\3pppd.exec:\3pppd.exe75⤵PID:1632
-
\??\c:\1jpdd.exec:\1jpdd.exe76⤵PID:2680
-
\??\c:\xxxxffr.exec:\xxxxffr.exe77⤵PID:2564
-
\??\c:\btntbh.exec:\btntbh.exe78⤵PID:2532
-
\??\c:\jdpvv.exec:\jdpvv.exe79⤵PID:2552
-
\??\c:\lfrxlxl.exec:\lfrxlxl.exe80⤵PID:2984
-
\??\c:\xxrrxxr.exec:\xxrrxxr.exe81⤵PID:796
-
\??\c:\hbbbnt.exec:\hbbbnt.exe82⤵PID:2504
-
\??\c:\pdjjp.exec:\pdjjp.exe83⤵PID:2996
-
\??\c:\vpppv.exec:\vpppv.exe84⤵PID:1896
-
\??\c:\fxrflrf.exec:\fxrflrf.exe85⤵PID:1860
-
\??\c:\bnnbbh.exec:\bnnbbh.exe86⤵PID:2968
-
\??\c:\pvpvp.exec:\pvpvp.exe87⤵PID:2884
-
\??\c:\7vpdv.exec:\7vpdv.exe88⤵PID:2568
-
\??\c:\fflrlxr.exec:\fflrlxr.exe89⤵PID:2220
-
\??\c:\5tnntb.exec:\5tnntb.exe90⤵PID:2316
-
\??\c:\vpvpp.exec:\vpvpp.exe91⤵PID:1544
-
\??\c:\3frrflr.exec:\3frrflr.exe92⤵PID:2436
-
\??\c:\lfxfrxr.exec:\lfxfrxr.exe93⤵PID:1420
-
\??\c:\nhbthn.exec:\nhbthn.exe94⤵PID:2416
-
\??\c:\ppjvv.exec:\ppjvv.exe95⤵PID:2028
-
\??\c:\rlrfrrx.exec:\rlrfrrx.exe96⤵PID:620
-
\??\c:\hbnnnb.exec:\hbnnnb.exe97⤵PID:2132
-
\??\c:\hhhntt.exec:\hhhntt.exe98⤵PID:1708
-
\??\c:\vppvp.exec:\vppvp.exe99⤵PID:2208
-
\??\c:\lfflrrl.exec:\lfflrrl.exe100⤵PID:2224
-
\??\c:\hbtbnn.exec:\hbtbnn.exe101⤵PID:2288
-
\??\c:\vdvdv.exec:\vdvdv.exe102⤵PID:2624
-
\??\c:\rlfrxlr.exec:\rlfrxlr.exe103⤵PID:2116
-
\??\c:\bbtbnb.exec:\bbtbnb.exe104⤵PID:1264
-
\??\c:\hhhnhh.exec:\hhhnhh.exe105⤵PID:916
-
\??\c:\1ppvj.exec:\1ppvj.exe106⤵PID:444
-
\??\c:\lrxlrfr.exec:\lrxlrfr.exe107⤵PID:1216
-
\??\c:\ttthtb.exec:\ttthtb.exe108⤵PID:2272
-
\??\c:\vppdj.exec:\vppdj.exe109⤵PID:1092
-
\??\c:\3jjdj.exec:\3jjdj.exe110⤵PID:912
-
\??\c:\rrrxfxl.exec:\rrrxfxl.exe111⤵PID:2352
-
\??\c:\tnhtbt.exec:\tnhtbt.exe112⤵PID:3008
-
\??\c:\jjvdj.exec:\jjvdj.exe113⤵PID:2900
-
\??\c:\llffllr.exec:\llffllr.exe114⤵PID:1992
-
\??\c:\bbthtb.exec:\bbthtb.exe115⤵PID:880
-
\??\c:\dvpjv.exec:\dvpjv.exe116⤵PID:996
-
\??\c:\9dppv.exec:\9dppv.exe117⤵PID:2264
-
\??\c:\llfxlxr.exec:\llfxlxr.exe118⤵PID:2812
-
\??\c:\bnnbtb.exec:\bnnbtb.exe119⤵PID:1524
-
\??\c:\7ddjv.exec:\7ddjv.exe120⤵PID:2124
-
\??\c:\7vjjp.exec:\7vjjp.exe121⤵PID:3060
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-