Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-12-2024 22:28
Behavioral task
behavioral1
Sample
544ba5a2f797db1cc789edd052ed251d29b692f19b85ec0d97fd2047411ffdbc.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
544ba5a2f797db1cc789edd052ed251d29b692f19b85ec0d97fd2047411ffdbc.exe
-
Size
335KB
-
MD5
882320eab3b10774600369841adc47f5
-
SHA1
5d4e8913529b8f2bb1c732d6632daf502b3f1867
-
SHA256
544ba5a2f797db1cc789edd052ed251d29b692f19b85ec0d97fd2047411ffdbc
-
SHA512
0f5914751aa1b19904cd6892387c2f67b7c5b0087b2f4410b42c3d24d48dbb74326db1b10e6329a5bdc73eac8f585b6391d43e7fec70e71b5f21ac20e7da52a7
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeR1:R4wFHoSHYHUrAwfMp3CDR1
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/2720-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2888-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2804-24-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2804-23-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2632-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1048-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2924-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2148-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2500-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2952-121-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2308-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2936-136-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2936-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/876-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1296-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2176-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1352-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2212-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1732-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/616-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2524-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2728-274-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1592-290-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2720-297-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1984-320-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1920-331-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/400-374-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2976-385-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2976-386-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3028-392-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2944-399-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/3016-401-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1892-430-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2104-446-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2324-457-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2524-529-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1968-631-0x0000000000270000-0x0000000000297000-memory.dmp family_blackmoon behavioral1/memory/2572-633-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2964-644-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1896-3580-0x00000000772E0000-0x00000000773FF000-memory.dmp family_blackmoon behavioral1/memory/1896-6819-0x00000000772E0000-0x00000000773FF000-memory.dmp family_blackmoon behavioral1/memory/1896-9798-0x00000000772E0000-0x00000000773FF000-memory.dmp family_blackmoon behavioral1/memory/1896-17750-0x00000000772E0000-0x00000000773FF000-memory.dmp family_blackmoon behavioral1/memory/1896-26618-0x00000000772E0000-0x00000000773FF000-memory.dmp family_blackmoon behavioral1/memory/1896-27182-0x00000000772E0000-0x00000000773FF000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2720 fxlrffr.exe 2804 vpjjp.exe 3020 frffllr.exe 2632 1bnthh.exe 2604 7vvpv.exe 2368 3xxllfx.exe 380 3tbnbh.exe 1048 1nbbtb.exe 2924 1rrxfff.exe 2148 tthhnt.exe 2500 pdppv.exe 2540 fxxrxlx.exe 2568 hhtbht.exe 2952 vpdpp.exe 2308 1lfrxxf.exe 2936 nhbbhh.exe 2284 7rlffxf.exe 2188 hbbhhn.exe 876 dvjjj.exe 1296 9pvvd.exe 2176 hnnbnn.exe 2496 bnbbbh.exe 2212 7rlrxrf.exe 768 bnhhbb.exe 1608 dvjpv.exe 1352 rfllrlr.exe 1528 3vjjp.exe 1732 1dvjp.exe 616 hthhnn.exe 2464 7vpdp.exe 1736 lfrflrx.exe 2524 9ntnnn.exe 1600 ppjpd.exe 2728 5lflrfr.exe 1428 thbbhh.exe 2824 3bhntb.exe 1592 dvdjv.exe 2720 ffrrffl.exe 2732 rlflxxr.exe 2612 hhhhnb.exe 2752 jdpdp.exe 1244 jdddd.exe 1984 9lrlxfr.exe 1920 thttbh.exe 592 btntnt.exe 380 pjjjp.exe 792 llffrxl.exe 556 7hhttt.exe 2980 hbbbhn.exe 2108 jdjjj.exe 1860 3rlrxxf.exe 400 9hbnnb.exe 2628 nhtbhn.exe 2976 ddvjv.exe 3028 7lfrxxx.exe 2944 9htnnn.exe 3016 vjpvp.exe 2936 5djjj.exe 2780 xrffllr.exe 2740 nnhhbt.exe 1892 pjppp.exe 552 rxfrlrf.exe 2252 rlrxxfl.exe 2104 hhhnbb.exe -
resource yara_rule behavioral1/memory/2888-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000b000000012029-7.dat upx behavioral1/memory/2720-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2888-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015dc3-15.dat upx behavioral1/files/0x0007000000015e25-25.dat upx behavioral1/memory/2804-23-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015f1b-32.dat upx behavioral1/memory/2632-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015f2a-40.dat upx behavioral1/memory/2368-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000162b8-48.dat upx behavioral1/files/0x000a000000016d46-58.dat upx behavioral1/memory/1048-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000019030-65.dat upx behavioral1/files/0x000600000001903d-73.dat upx behavioral1/memory/1048-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2924-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001920f-82.dat upx behavioral1/files/0x0005000000019228-90.dat upx behavioral1/memory/2148-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019234-99.dat upx behavioral1/memory/2500-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019241-106.dat upx behavioral1/files/0x000500000001925c-113.dat upx behavioral1/memory/2952-121-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019273-120.dat upx behavioral1/memory/2308-128-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000192f0-129.dat upx behavioral1/files/0x000500000001932a-137.dat upx behavioral1/memory/2936-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001933e-145.dat upx behavioral1/files/0x0034000000015d5c-153.dat upx behavioral1/files/0x0005000000019346-160.dat upx behavioral1/memory/876-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1296-169-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019384-168.dat upx behavioral1/memory/2176-177-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193a2-176.dat upx behavioral1/files/0x00050000000193af-185.dat upx behavioral1/files/0x00050000000193c9-192.dat upx behavioral1/memory/768-199-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x00050000000193f8-200.dat upx behavioral1/files/0x00050000000193fa-208.dat upx behavioral1/files/0x0005000000019408-216.dat upx behavioral1/memory/1352-218-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2212-214-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019494-225.dat upx behavioral1/memory/1732-232-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194a7-233.dat upx behavioral1/memory/616-240-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194b4-241.dat upx behavioral1/files/0x00050000000194d4-248.dat upx behavioral1/memory/2524-256-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194da-257.dat upx behavioral1/memory/2524-263-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2728-274-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1592-290-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2720-297-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1984-320-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1920-331-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/400-374-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2976-386-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3028-392-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7thnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllxlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xflxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrrlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlfffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xlxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2888 wrote to memory of 2720 2888 544ba5a2f797db1cc789edd052ed251d29b692f19b85ec0d97fd2047411ffdbc.exe 30 PID 2888 wrote to memory of 2720 2888 544ba5a2f797db1cc789edd052ed251d29b692f19b85ec0d97fd2047411ffdbc.exe 30 PID 2888 wrote to memory of 2720 2888 544ba5a2f797db1cc789edd052ed251d29b692f19b85ec0d97fd2047411ffdbc.exe 30 PID 2888 wrote to memory of 2720 2888 544ba5a2f797db1cc789edd052ed251d29b692f19b85ec0d97fd2047411ffdbc.exe 30 PID 2720 wrote to memory of 2804 2720 fxlrffr.exe 31 PID 2720 wrote to memory of 2804 2720 fxlrffr.exe 31 PID 2720 wrote to memory of 2804 2720 fxlrffr.exe 31 PID 2720 wrote to memory of 2804 2720 fxlrffr.exe 31 PID 2804 wrote to memory of 3020 2804 vpjjp.exe 32 PID 2804 wrote to memory of 3020 2804 vpjjp.exe 32 PID 2804 wrote to memory of 3020 2804 vpjjp.exe 32 PID 2804 wrote to memory of 3020 2804 vpjjp.exe 32 PID 3020 wrote to memory of 2632 3020 frffllr.exe 33 PID 3020 wrote to memory of 2632 3020 frffllr.exe 33 PID 3020 wrote to memory of 2632 3020 frffllr.exe 33 PID 3020 wrote to memory of 2632 3020 frffllr.exe 33 PID 2632 wrote to memory of 2604 2632 1bnthh.exe 34 PID 2632 wrote to memory of 2604 2632 1bnthh.exe 34 PID 2632 wrote to memory of 2604 2632 1bnthh.exe 34 PID 2632 wrote to memory of 2604 2632 1bnthh.exe 34 PID 2604 wrote to memory of 2368 2604 7vvpv.exe 35 PID 2604 wrote to memory of 2368 2604 7vvpv.exe 35 PID 2604 wrote to memory of 2368 2604 7vvpv.exe 35 PID 2604 wrote to memory of 2368 2604 7vvpv.exe 35 PID 2368 wrote to memory of 380 2368 3xxllfx.exe 36 PID 2368 wrote to memory of 380 2368 3xxllfx.exe 36 PID 2368 wrote to memory of 380 2368 3xxllfx.exe 36 PID 2368 wrote to memory of 380 2368 3xxllfx.exe 36 PID 380 wrote to memory of 1048 380 3tbnbh.exe 37 PID 380 wrote to memory of 1048 380 3tbnbh.exe 37 PID 380 wrote to memory of 1048 380 3tbnbh.exe 37 PID 380 wrote to memory of 1048 380 3tbnbh.exe 37 PID 1048 wrote to memory of 2924 1048 1nbbtb.exe 38 PID 1048 wrote to memory of 2924 1048 1nbbtb.exe 38 PID 1048 wrote to memory of 2924 1048 1nbbtb.exe 38 PID 1048 wrote to memory of 2924 1048 1nbbtb.exe 38 PID 2924 wrote to memory of 2148 2924 1rrxfff.exe 39 PID 2924 wrote to memory of 2148 2924 1rrxfff.exe 39 PID 2924 wrote to memory of 2148 2924 1rrxfff.exe 39 PID 2924 wrote to memory of 2148 2924 1rrxfff.exe 39 PID 2148 wrote to memory of 2500 2148 tthhnt.exe 40 PID 2148 wrote to memory of 2500 2148 tthhnt.exe 40 PID 2148 wrote to memory of 2500 2148 tthhnt.exe 40 PID 2148 wrote to memory of 2500 2148 tthhnt.exe 40 PID 2500 wrote to memory of 2540 2500 pdppv.exe 41 PID 2500 wrote to memory of 2540 2500 pdppv.exe 41 PID 2500 wrote to memory of 2540 2500 pdppv.exe 41 PID 2500 wrote to memory of 2540 2500 pdppv.exe 41 PID 2540 wrote to memory of 2568 2540 fxxrxlx.exe 42 PID 2540 wrote to memory of 2568 2540 fxxrxlx.exe 42 PID 2540 wrote to memory of 2568 2540 fxxrxlx.exe 42 PID 2540 wrote to memory of 2568 2540 fxxrxlx.exe 42 PID 2568 wrote to memory of 2952 2568 hhtbht.exe 43 PID 2568 wrote to memory of 2952 2568 hhtbht.exe 43 PID 2568 wrote to memory of 2952 2568 hhtbht.exe 43 PID 2568 wrote to memory of 2952 2568 hhtbht.exe 43 PID 2952 wrote to memory of 2308 2952 vpdpp.exe 44 PID 2952 wrote to memory of 2308 2952 vpdpp.exe 44 PID 2952 wrote to memory of 2308 2952 vpdpp.exe 44 PID 2952 wrote to memory of 2308 2952 vpdpp.exe 44 PID 2308 wrote to memory of 2936 2308 1lfrxxf.exe 45 PID 2308 wrote to memory of 2936 2308 1lfrxxf.exe 45 PID 2308 wrote to memory of 2936 2308 1lfrxxf.exe 45 PID 2308 wrote to memory of 2936 2308 1lfrxxf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\544ba5a2f797db1cc789edd052ed251d29b692f19b85ec0d97fd2047411ffdbc.exe"C:\Users\Admin\AppData\Local\Temp\544ba5a2f797db1cc789edd052ed251d29b692f19b85ec0d97fd2047411ffdbc.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\fxlrffr.exec:\fxlrffr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\vpjjp.exec:\vpjjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\frffllr.exec:\frffllr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\1bnthh.exec:\1bnthh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\7vvpv.exec:\7vvpv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\3xxllfx.exec:\3xxllfx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\3tbnbh.exec:\3tbnbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
\??\c:\1nbbtb.exec:\1nbbtb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\1rrxfff.exec:\1rrxfff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\tthhnt.exec:\tthhnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\pdppv.exec:\pdppv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\fxxrxlx.exec:\fxxrxlx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\hhtbht.exec:\hhtbht.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\vpdpp.exec:\vpdpp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\1lfrxxf.exec:\1lfrxxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\nhbbhh.exec:\nhbbhh.exe17⤵
- Executes dropped EXE
PID:2936 -
\??\c:\7rlffxf.exec:\7rlffxf.exe18⤵
- Executes dropped EXE
PID:2284 -
\??\c:\hbbhhn.exec:\hbbhhn.exe19⤵
- Executes dropped EXE
PID:2188 -
\??\c:\dvjjj.exec:\dvjjj.exe20⤵
- Executes dropped EXE
PID:876 -
\??\c:\9pvvd.exec:\9pvvd.exe21⤵
- Executes dropped EXE
PID:1296 -
\??\c:\hnnbnn.exec:\hnnbnn.exe22⤵
- Executes dropped EXE
PID:2176 -
\??\c:\bnbbbh.exec:\bnbbbh.exe23⤵
- Executes dropped EXE
PID:2496 -
\??\c:\7rlrxrf.exec:\7rlrxrf.exe24⤵
- Executes dropped EXE
PID:2212 -
\??\c:\bnhhbb.exec:\bnhhbb.exe25⤵
- Executes dropped EXE
PID:768 -
\??\c:\dvjpv.exec:\dvjpv.exe26⤵
- Executes dropped EXE
PID:1608 -
\??\c:\rfllrlr.exec:\rfllrlr.exe27⤵
- Executes dropped EXE
PID:1352 -
\??\c:\3vjjp.exec:\3vjjp.exe28⤵
- Executes dropped EXE
PID:1528 -
\??\c:\1dvjp.exec:\1dvjp.exe29⤵
- Executes dropped EXE
PID:1732 -
\??\c:\hthhnn.exec:\hthhnn.exe30⤵
- Executes dropped EXE
PID:616 -
\??\c:\7vpdp.exec:\7vpdp.exe31⤵
- Executes dropped EXE
PID:2464 -
\??\c:\lfrflrx.exec:\lfrflrx.exe32⤵
- Executes dropped EXE
PID:1736 -
\??\c:\9ntnnn.exec:\9ntnnn.exe33⤵
- Executes dropped EXE
PID:2524 -
\??\c:\ppjpd.exec:\ppjpd.exe34⤵
- Executes dropped EXE
PID:1600 -
\??\c:\5lflrfr.exec:\5lflrfr.exe35⤵
- Executes dropped EXE
PID:2728 -
\??\c:\thbbhh.exec:\thbbhh.exe36⤵
- Executes dropped EXE
PID:1428 -
\??\c:\3bhntb.exec:\3bhntb.exe37⤵
- Executes dropped EXE
PID:2824 -
\??\c:\dvdjv.exec:\dvdjv.exe38⤵
- Executes dropped EXE
PID:1592 -
\??\c:\ffrrffl.exec:\ffrrffl.exe39⤵
- Executes dropped EXE
PID:2720 -
\??\c:\rlflxxr.exec:\rlflxxr.exe40⤵
- Executes dropped EXE
PID:2732 -
\??\c:\hhhhnb.exec:\hhhhnb.exe41⤵
- Executes dropped EXE
PID:2612 -
\??\c:\jdpdp.exec:\jdpdp.exe42⤵
- Executes dropped EXE
PID:2752 -
\??\c:\jdddd.exec:\jdddd.exe43⤵
- Executes dropped EXE
PID:1244 -
\??\c:\9lrlxfr.exec:\9lrlxfr.exe44⤵
- Executes dropped EXE
PID:1984 -
\??\c:\thttbh.exec:\thttbh.exe45⤵
- Executes dropped EXE
PID:1920 -
\??\c:\btntnt.exec:\btntnt.exe46⤵
- Executes dropped EXE
PID:592 -
\??\c:\pjjjp.exec:\pjjjp.exe47⤵
- Executes dropped EXE
PID:380 -
\??\c:\llffrxl.exec:\llffrxl.exe48⤵
- Executes dropped EXE
PID:792 -
\??\c:\7hhttt.exec:\7hhttt.exe49⤵
- Executes dropped EXE
PID:556 -
\??\c:\hbbbhn.exec:\hbbbhn.exe50⤵
- Executes dropped EXE
PID:2980 -
\??\c:\jdjjj.exec:\jdjjj.exe51⤵
- Executes dropped EXE
PID:2108 -
\??\c:\3rlrxxf.exec:\3rlrxxf.exe52⤵
- Executes dropped EXE
PID:1860 -
\??\c:\9hbnnb.exec:\9hbnnb.exe53⤵
- Executes dropped EXE
PID:400 -
\??\c:\nhtbhn.exec:\nhtbhn.exe54⤵
- Executes dropped EXE
PID:2628 -
\??\c:\ddvjv.exec:\ddvjv.exe55⤵
- Executes dropped EXE
PID:2976 -
\??\c:\7lfrxxx.exec:\7lfrxxx.exe56⤵
- Executes dropped EXE
PID:3028 -
\??\c:\9htnnn.exec:\9htnnn.exe57⤵
- Executes dropped EXE
PID:2944 -
\??\c:\vjpvp.exec:\vjpvp.exe58⤵
- Executes dropped EXE
PID:3016 -
\??\c:\5djjj.exec:\5djjj.exe59⤵
- Executes dropped EXE
PID:2936 -
\??\c:\xrffllr.exec:\xrffllr.exe60⤵
- Executes dropped EXE
PID:2780 -
\??\c:\nnhhbt.exec:\nnhhbt.exe61⤵
- Executes dropped EXE
PID:2740 -
\??\c:\pjppp.exec:\pjppp.exe62⤵
- Executes dropped EXE
PID:1892 -
\??\c:\rxfrlrf.exec:\rxfrlrf.exe63⤵
- Executes dropped EXE
PID:552 -
\??\c:\rlrxxfl.exec:\rlrxxfl.exe64⤵
- Executes dropped EXE
PID:2252 -
\??\c:\hhhnbb.exec:\hhhnbb.exe65⤵
- Executes dropped EXE
PID:2104 -
\??\c:\jdddp.exec:\jdddp.exe66⤵PID:2004
-
\??\c:\lfrxffr.exec:\lfrxffr.exe67⤵PID:2496
-
\??\c:\tnbhbh.exec:\tnbhbh.exe68⤵PID:2324
-
\??\c:\5nttbb.exec:\5nttbb.exe69⤵PID:2216
-
\??\c:\vpppj.exec:\vpppj.exe70⤵PID:2204
-
\??\c:\flfxflr.exec:\flfxflr.exe71⤵
- System Location Discovery: System Language Discovery
PID:1816 -
\??\c:\rlxxxrr.exec:\rlxxxrr.exe72⤵PID:1536
-
\??\c:\bntttt.exec:\bntttt.exe73⤵PID:1704
-
\??\c:\pjvvv.exec:\pjvvv.exe74⤵PID:912
-
\??\c:\dvddd.exec:\dvddd.exe75⤵PID:1992
-
\??\c:\xxrxlrf.exec:\xxrxlrf.exe76⤵PID:2120
-
\??\c:\nnbnbn.exec:\nnbnbn.exe77⤵PID:2460
-
\??\c:\nbhhnn.exec:\nbhhnn.exe78⤵PID:2800
-
\??\c:\1djjv.exec:\1djjv.exe79⤵PID:1744
-
\??\c:\llxxfrx.exec:\llxxfrx.exe80⤵PID:2524
-
\??\c:\9htthh.exec:\9htthh.exe81⤵PID:896
-
\??\c:\3tbhnt.exec:\3tbhnt.exe82⤵PID:2476
-
\??\c:\pjddd.exec:\pjddd.exe83⤵PID:2816
-
\??\c:\3xrxxff.exec:\3xrxxff.exe84⤵PID:2248
-
\??\c:\tnnthn.exec:\tnnthn.exe85⤵PID:1592
-
\??\c:\dvjpd.exec:\dvjpd.exe86⤵PID:2856
-
\??\c:\vvddd.exec:\vvddd.exe87⤵PID:2732
-
\??\c:\xrxxflr.exec:\xrxxflr.exe88⤵PID:2488
-
\??\c:\xxrrflx.exec:\xxrrflx.exe89⤵PID:3004
-
\??\c:\nhhhbh.exec:\nhhhbh.exe90⤵PID:2636
-
\??\c:\dvjdj.exec:\dvjdj.exe91⤵PID:2664
-
\??\c:\ppjjv.exec:\ppjjv.exe92⤵PID:2256
-
\??\c:\rflflfl.exec:\rflflfl.exe93⤵PID:2560
-
\??\c:\3nnbtn.exec:\3nnbtn.exe94⤵PID:796
-
\??\c:\htbbhh.exec:\htbbhh.exe95⤵PID:380
-
\??\c:\dvvdv.exec:\dvvdv.exe96⤵PID:1672
-
\??\c:\lrrfxrr.exec:\lrrfxrr.exe97⤵PID:2404
-
\??\c:\fxlfffl.exec:\fxlfffl.exe98⤵PID:2140
-
\??\c:\bntntt.exec:\bntntt.exe99⤵PID:1968
-
\??\c:\pdpjd.exec:\pdpjd.exe100⤵PID:2572
-
\??\c:\ppjjj.exec:\ppjjj.exe101⤵PID:2964
-
\??\c:\9rfxffx.exec:\9rfxffx.exe102⤵PID:2912
-
\??\c:\hbnbnn.exec:\hbnbnn.exe103⤵PID:3008
-
\??\c:\pdpvv.exec:\pdpvv.exe104⤵PID:2952
-
\??\c:\vjvdv.exec:\vjvdv.exe105⤵PID:2872
-
\??\c:\llrxrxl.exec:\llrxrxl.exe106⤵PID:2352
-
\??\c:\xlrxxxx.exec:\xlrxxxx.exe107⤵PID:2936
-
\??\c:\9ntbhb.exec:\9ntbhb.exe108⤵PID:1156
-
\??\c:\3vvvv.exec:\3vvvv.exe109⤵PID:1132
-
\??\c:\jvppv.exec:\jvppv.exe110⤵PID:1612
-
\??\c:\ffllflf.exec:\ffllflf.exe111⤵PID:2424
-
\??\c:\htthhb.exec:\htthhb.exe112⤵PID:2052
-
\??\c:\pdvdj.exec:\pdvdj.exe113⤵PID:2176
-
\??\c:\7pppj.exec:\7pppj.exe114⤵PID:2060
-
\??\c:\3rlfxxx.exec:\3rlfxxx.exe115⤵PID:1988
-
\??\c:\hntntt.exec:\hntntt.exe116⤵PID:1940
-
\??\c:\3pdjd.exec:\3pdjd.exe117⤵PID:1476
-
\??\c:\jjvvv.exec:\jjvvv.exe118⤵PID:1608
-
\??\c:\5frxrxx.exec:\5frxrxx.exe119⤵PID:2144
-
\??\c:\nhtbbb.exec:\nhtbbb.exe120⤵PID:1392
-
\??\c:\1hbbbb.exec:\1hbbbb.exe121⤵PID:928
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-