Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
22-12-2024 22:33
Behavioral task
behavioral1
Sample
544ba5a2f797db1cc789edd052ed251d29b692f19b85ec0d97fd2047411ffdbc.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
150 seconds
General
-
Target
544ba5a2f797db1cc789edd052ed251d29b692f19b85ec0d97fd2047411ffdbc.exe
-
Size
335KB
-
MD5
882320eab3b10774600369841adc47f5
-
SHA1
5d4e8913529b8f2bb1c732d6632daf502b3f1867
-
SHA256
544ba5a2f797db1cc789edd052ed251d29b692f19b85ec0d97fd2047411ffdbc
-
SHA512
0f5914751aa1b19904cd6892387c2f67b7c5b0087b2f4410b42c3d24d48dbb74326db1b10e6329a5bdc73eac8f585b6391d43e7fec70e71b5f21ac20e7da52a7
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeR1:R4wFHoSHYHUrAwfMp3CDR1
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 60 IoCs
resource yara_rule behavioral1/memory/1740-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1988-23-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2188-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2196-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2780-48-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2780-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2764-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2784-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2704-82-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/2704-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2764-90-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2548-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3000-100-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/3000-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2484-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3000-125-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1728-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2840-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1584-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2576-182-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/744-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2236-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2140-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2348-231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1020-239-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/3036-248-0x00000000002D0000-0x00000000002F7000-memory.dmp family_blackmoon behavioral1/memory/3036-247-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2964-256-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1444-265-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2480-295-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2824-343-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2548-367-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/468-375-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2508-423-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2364-445-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1652-503-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1992-509-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/636-521-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2308-533-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2120-539-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1600-542-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1600-547-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2152-553-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1296-559-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2572-596-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2828-607-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1112-654-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2300-675-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1512-678-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1448-687-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2224-708-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/2796-796-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2820-854-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2728-860-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1960-919-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2932-7478-0x0000000077900000-0x0000000077A1F000-memory.dmp family_blackmoon behavioral1/memory/2932-16800-0x0000000077900000-0x0000000077A1F000-memory.dmp family_blackmoon behavioral1/memory/2932-19544-0x0000000077900000-0x0000000077A1F000-memory.dmp family_blackmoon behavioral1/memory/2932-21198-0x0000000077900000-0x0000000077A1F000-memory.dmp family_blackmoon behavioral1/memory/2932-22302-0x0000000077900000-0x0000000077A1F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2108 3nthht.exe 1988 vpdvj.exe 2188 nnttbh.exe 2196 ffrrlrx.exe 2780 nttbnb.exe 2924 fxlxfrx.exe 2764 tnnnbb.exe 2784 dvjdj.exe 2704 nntntn.exe 2548 3jdvd.exe 3000 lfrxllx.exe 2484 1ppvd.exe 568 ffrxfrr.exe 1728 rrllfrf.exe 2840 vpjpj.exe 2380 nhbbhn.exe 1584 7flrrrx.exe 1448 3nthhn.exe 536 1pjjp.exe 2364 3lrrxxl.exe 2576 vvdjv.exe 2172 xxlxlrx.exe 744 7hbtht.exe 2236 vjvvd.exe 1020 5thbht.exe 2140 ppddj.exe 2348 tbnnth.exe 1996 jjvdv.exe 3036 bnhnhh.exe 2964 pvddj.exe 1444 nnbntb.exe 856 3nnhhb.exe 2960 9xllxrf.exe 2488 nhnbht.exe 1696 tttbnt.exe 1296 1jjpv.exe 2480 lfrfffr.exe 1168 fxrflfr.exe 2892 7hnnbn.exe 2660 jpppp.exe 2776 1jdpv.exe 2688 7xllrrr.exe 2760 3htntb.exe 2692 3thnhh.exe 2824 dddjj.exe 2732 xfllrxf.exe 2644 tnbbhb.exe 2600 bhbnnh.exe 2548 jpvdj.exe 3012 fxrxflr.exe 468 fffffll.exe 2860 hhhbnn.exe 1800 vvjjj.exe 1440 lllflll.exe 1760 3rxllrx.exe 2360 tnnntt.exe 2852 9pvdp.exe 2380 flrxxfl.exe 2508 flrxlrf.exe 288 9btbnb.exe 1856 jjpjv.exe 2888 ffrxrxl.exe 2364 7rrrxfl.exe 2576 hhntbb.exe -
resource yara_rule behavioral1/memory/1740-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1740-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000e00000001418b-7.dat upx behavioral1/files/0x0008000000015d0e-14.dat upx behavioral1/memory/1988-21-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/1988-23-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015d2f-22.dat upx behavioral1/files/0x0007000000015e05-32.dat upx behavioral1/memory/2188-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2196-39-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0007000000015e16-40.dat upx behavioral1/memory/2196-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2780-48-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2780-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015e5b-49.dat upx behavioral1/files/0x0009000000015eff-57.dat upx behavioral1/files/0x0005000000018710-66.dat upx behavioral1/memory/2764-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018718-73.dat upx behavioral1/memory/2784-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018766-83.dat upx behavioral1/memory/2704-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018780-91.dat upx behavioral1/memory/2548-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018b62-101.dat upx behavioral1/memory/3000-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018b68-109.dat upx behavioral1/memory/2484-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018bf3-118.dat upx behavioral1/memory/1728-127-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019223-126.dat upx behavioral1/files/0x0009000000015ce8-136.dat upx behavioral1/memory/2840-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019230-144.dat upx behavioral1/memory/1584-151-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019240-153.dat upx behavioral1/files/0x0005000000019246-160.dat upx behavioral1/files/0x000500000001926b-168.dat upx behavioral1/files/0x000500000001930d-175.dat upx behavioral1/files/0x000500000001932d-183.dat upx behavioral1/memory/2576-182-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/744-193-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001933b-191.dat upx behavioral1/files/0x0005000000019374-198.dat upx behavioral1/files/0x000500000001939b-206.dat upx behavioral1/memory/2236-205-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193b3-214.dat upx behavioral1/memory/2140-221-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193b5-222.dat upx behavioral1/memory/1996-232-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2348-231-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193e8-230.dat upx behavioral1/files/0x00050000000193f7-240.dat upx behavioral1/files/0x000500000001949e-249.dat upx behavioral1/memory/3036-247-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2964-256-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194c4-257.dat upx behavioral1/memory/1444-265-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194cd-266.dat upx behavioral1/memory/1696-289-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2480-295-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2892-311-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2824-343-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2824-344-0x0000000000430000-0x0000000000457000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxffllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrffll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflrfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrxxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlrrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1740 wrote to memory of 2108 1740 544ba5a2f797db1cc789edd052ed251d29b692f19b85ec0d97fd2047411ffdbc.exe 31 PID 1740 wrote to memory of 2108 1740 544ba5a2f797db1cc789edd052ed251d29b692f19b85ec0d97fd2047411ffdbc.exe 31 PID 1740 wrote to memory of 2108 1740 544ba5a2f797db1cc789edd052ed251d29b692f19b85ec0d97fd2047411ffdbc.exe 31 PID 1740 wrote to memory of 2108 1740 544ba5a2f797db1cc789edd052ed251d29b692f19b85ec0d97fd2047411ffdbc.exe 31 PID 2108 wrote to memory of 1988 2108 3nthht.exe 32 PID 2108 wrote to memory of 1988 2108 3nthht.exe 32 PID 2108 wrote to memory of 1988 2108 3nthht.exe 32 PID 2108 wrote to memory of 1988 2108 3nthht.exe 32 PID 1988 wrote to memory of 2188 1988 vpdvj.exe 33 PID 1988 wrote to memory of 2188 1988 vpdvj.exe 33 PID 1988 wrote to memory of 2188 1988 vpdvj.exe 33 PID 1988 wrote to memory of 2188 1988 vpdvj.exe 33 PID 2188 wrote to memory of 2196 2188 nnttbh.exe 34 PID 2188 wrote to memory of 2196 2188 nnttbh.exe 34 PID 2188 wrote to memory of 2196 2188 nnttbh.exe 34 PID 2188 wrote to memory of 2196 2188 nnttbh.exe 34 PID 2196 wrote to memory of 2780 2196 ffrrlrx.exe 35 PID 2196 wrote to memory of 2780 2196 ffrrlrx.exe 35 PID 2196 wrote to memory of 2780 2196 ffrrlrx.exe 35 PID 2196 wrote to memory of 2780 2196 ffrrlrx.exe 35 PID 2780 wrote to memory of 2924 2780 nttbnb.exe 36 PID 2780 wrote to memory of 2924 2780 nttbnb.exe 36 PID 2780 wrote to memory of 2924 2780 nttbnb.exe 36 PID 2780 wrote to memory of 2924 2780 nttbnb.exe 36 PID 2924 wrote to memory of 2764 2924 fxlxfrx.exe 37 PID 2924 wrote to memory of 2764 2924 fxlxfrx.exe 37 PID 2924 wrote to memory of 2764 2924 fxlxfrx.exe 37 PID 2924 wrote to memory of 2764 2924 fxlxfrx.exe 37 PID 2764 wrote to memory of 2784 2764 tnnnbb.exe 38 PID 2764 wrote to memory of 2784 2764 tnnnbb.exe 38 PID 2764 wrote to memory of 2784 2764 tnnnbb.exe 38 PID 2764 wrote to memory of 2784 2764 tnnnbb.exe 38 PID 2784 wrote to memory of 2704 2784 dvjdj.exe 39 PID 2784 wrote to memory of 2704 2784 dvjdj.exe 39 PID 2784 wrote to memory of 2704 2784 dvjdj.exe 39 PID 2784 wrote to memory of 2704 2784 dvjdj.exe 39 PID 2704 wrote to memory of 2548 2704 nntntn.exe 40 PID 2704 wrote to memory of 2548 2704 nntntn.exe 40 PID 2704 wrote to memory of 2548 2704 nntntn.exe 40 PID 2704 wrote to memory of 2548 2704 nntntn.exe 40 PID 2548 wrote to memory of 3000 2548 3jdvd.exe 41 PID 2548 wrote to memory of 3000 2548 3jdvd.exe 41 PID 2548 wrote to memory of 3000 2548 3jdvd.exe 41 PID 2548 wrote to memory of 3000 2548 3jdvd.exe 41 PID 3000 wrote to memory of 2484 3000 lfrxllx.exe 42 PID 3000 wrote to memory of 2484 3000 lfrxllx.exe 42 PID 3000 wrote to memory of 2484 3000 lfrxllx.exe 42 PID 3000 wrote to memory of 2484 3000 lfrxllx.exe 42 PID 2484 wrote to memory of 568 2484 1ppvd.exe 43 PID 2484 wrote to memory of 568 2484 1ppvd.exe 43 PID 2484 wrote to memory of 568 2484 1ppvd.exe 43 PID 2484 wrote to memory of 568 2484 1ppvd.exe 43 PID 568 wrote to memory of 1728 568 ffrxfrr.exe 44 PID 568 wrote to memory of 1728 568 ffrxfrr.exe 44 PID 568 wrote to memory of 1728 568 ffrxfrr.exe 44 PID 568 wrote to memory of 1728 568 ffrxfrr.exe 44 PID 1728 wrote to memory of 2840 1728 rrllfrf.exe 45 PID 1728 wrote to memory of 2840 1728 rrllfrf.exe 45 PID 1728 wrote to memory of 2840 1728 rrllfrf.exe 45 PID 1728 wrote to memory of 2840 1728 rrllfrf.exe 45 PID 2840 wrote to memory of 2380 2840 vpjpj.exe 46 PID 2840 wrote to memory of 2380 2840 vpjpj.exe 46 PID 2840 wrote to memory of 2380 2840 vpjpj.exe 46 PID 2840 wrote to memory of 2380 2840 vpjpj.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\544ba5a2f797db1cc789edd052ed251d29b692f19b85ec0d97fd2047411ffdbc.exe"C:\Users\Admin\AppData\Local\Temp\544ba5a2f797db1cc789edd052ed251d29b692f19b85ec0d97fd2047411ffdbc.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\3nthht.exec:\3nthht.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\vpdvj.exec:\vpdvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\nnttbh.exec:\nnttbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\ffrrlrx.exec:\ffrrlrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\nttbnb.exec:\nttbnb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\fxlxfrx.exec:\fxlxfrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\tnnnbb.exec:\tnnnbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\dvjdj.exec:\dvjdj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\nntntn.exec:\nntntn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\3jdvd.exec:\3jdvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\lfrxllx.exec:\lfrxllx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\1ppvd.exec:\1ppvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\ffrxfrr.exec:\ffrxfrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:568 -
\??\c:\rrllfrf.exec:\rrllfrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\vpjpj.exec:\vpjpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\nhbbhn.exec:\nhbbhn.exe17⤵
- Executes dropped EXE
PID:2380 -
\??\c:\7flrrrx.exec:\7flrrrx.exe18⤵
- Executes dropped EXE
PID:1584 -
\??\c:\3nthhn.exec:\3nthhn.exe19⤵
- Executes dropped EXE
PID:1448 -
\??\c:\1pjjp.exec:\1pjjp.exe20⤵
- Executes dropped EXE
PID:536 -
\??\c:\3lrrxxl.exec:\3lrrxxl.exe21⤵
- Executes dropped EXE
PID:2364 -
\??\c:\vvdjv.exec:\vvdjv.exe22⤵
- Executes dropped EXE
PID:2576 -
\??\c:\xxlxlrx.exec:\xxlxlrx.exe23⤵
- Executes dropped EXE
PID:2172 -
\??\c:\7hbtht.exec:\7hbtht.exe24⤵
- Executes dropped EXE
PID:744 -
\??\c:\vjvvd.exec:\vjvvd.exe25⤵
- Executes dropped EXE
PID:2236 -
\??\c:\5thbht.exec:\5thbht.exe26⤵
- Executes dropped EXE
PID:1020 -
\??\c:\ppddj.exec:\ppddj.exe27⤵
- Executes dropped EXE
PID:2140 -
\??\c:\tbnnth.exec:\tbnnth.exe28⤵
- Executes dropped EXE
PID:2348 -
\??\c:\jjvdv.exec:\jjvdv.exe29⤵
- Executes dropped EXE
PID:1996 -
\??\c:\bnhnhh.exec:\bnhnhh.exe30⤵
- Executes dropped EXE
PID:3036 -
\??\c:\pvddj.exec:\pvddj.exe31⤵
- Executes dropped EXE
PID:2964 -
\??\c:\nnbntb.exec:\nnbntb.exe32⤵
- Executes dropped EXE
PID:1444 -
\??\c:\3nnhhb.exec:\3nnhhb.exe33⤵
- Executes dropped EXE
PID:856 -
\??\c:\9xllxrf.exec:\9xllxrf.exe34⤵
- Executes dropped EXE
PID:2960 -
\??\c:\nhnbht.exec:\nhnbht.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2488 -
\??\c:\tttbnt.exec:\tttbnt.exe36⤵
- Executes dropped EXE
PID:1696 -
\??\c:\1jjpv.exec:\1jjpv.exe37⤵
- Executes dropped EXE
PID:1296 -
\??\c:\lfrfffr.exec:\lfrfffr.exe38⤵
- Executes dropped EXE
PID:2480 -
\??\c:\fxrflfr.exec:\fxrflfr.exe39⤵
- Executes dropped EXE
PID:1168 -
\??\c:\7hnnbn.exec:\7hnnbn.exe40⤵
- Executes dropped EXE
PID:2892 -
\??\c:\jpppp.exec:\jpppp.exe41⤵
- Executes dropped EXE
PID:2660 -
\??\c:\1jdpv.exec:\1jdpv.exe42⤵
- Executes dropped EXE
PID:2776 -
\??\c:\7xllrrr.exec:\7xllrrr.exe43⤵
- Executes dropped EXE
PID:2688 -
\??\c:\3htntb.exec:\3htntb.exe44⤵
- Executes dropped EXE
PID:2760 -
\??\c:\3thnhh.exec:\3thnhh.exe45⤵
- Executes dropped EXE
PID:2692 -
\??\c:\dddjj.exec:\dddjj.exe46⤵
- Executes dropped EXE
PID:2824 -
\??\c:\xfllrxf.exec:\xfllrxf.exe47⤵
- Executes dropped EXE
PID:2732 -
\??\c:\tnbbhb.exec:\tnbbhb.exe48⤵
- Executes dropped EXE
PID:2644 -
\??\c:\bhbnnh.exec:\bhbnnh.exe49⤵
- Executes dropped EXE
PID:2600 -
\??\c:\jpvdj.exec:\jpvdj.exe50⤵
- Executes dropped EXE
PID:2548 -
\??\c:\fxrxflr.exec:\fxrxflr.exe51⤵
- Executes dropped EXE
PID:3012 -
\??\c:\fffffll.exec:\fffffll.exe52⤵
- Executes dropped EXE
PID:468 -
\??\c:\hhhbnn.exec:\hhhbnn.exe53⤵
- Executes dropped EXE
PID:2860 -
\??\c:\vvjjj.exec:\vvjjj.exe54⤵
- Executes dropped EXE
PID:1800 -
\??\c:\lllflll.exec:\lllflll.exe55⤵
- Executes dropped EXE
PID:1440 -
\??\c:\3rxllrx.exec:\3rxllrx.exe56⤵
- Executes dropped EXE
PID:1760 -
\??\c:\tnnntt.exec:\tnnntt.exe57⤵
- Executes dropped EXE
PID:2360 -
\??\c:\9pvdp.exec:\9pvdp.exe58⤵
- Executes dropped EXE
PID:2852 -
\??\c:\flrxxfl.exec:\flrxxfl.exe59⤵
- Executes dropped EXE
PID:2380 -
\??\c:\flrxlrf.exec:\flrxlrf.exe60⤵
- Executes dropped EXE
PID:2508 -
\??\c:\9btbnb.exec:\9btbnb.exe61⤵
- Executes dropped EXE
PID:288 -
\??\c:\jjpjv.exec:\jjpjv.exe62⤵
- Executes dropped EXE
PID:1856 -
\??\c:\ffrxrxl.exec:\ffrxrxl.exe63⤵
- Executes dropped EXE
PID:2888 -
\??\c:\7rrrxfl.exec:\7rrrxfl.exe64⤵
- Executes dropped EXE
PID:2364 -
\??\c:\hhntbb.exec:\hhntbb.exe65⤵
- Executes dropped EXE
PID:2576 -
\??\c:\ddppv.exec:\ddppv.exe66⤵PID:2940
-
\??\c:\jjvvj.exec:\jjvvj.exe67⤵PID:824
-
\??\c:\1lfxffl.exec:\1lfxffl.exe68⤵PID:640
-
\??\c:\frfxfrr.exec:\frfxfrr.exe69⤵PID:988
-
\??\c:\tthbnn.exec:\tthbnn.exe70⤵PID:2028
-
\??\c:\vpdjj.exec:\vpdjj.exe71⤵PID:1536
-
\??\c:\7dpjj.exec:\7dpjj.exe72⤵PID:2140
-
\??\c:\xflrffl.exec:\xflrffl.exe73⤵PID:2252
-
\??\c:\hbbbtt.exec:\hbbbtt.exe74⤵PID:292
-
\??\c:\bbhntt.exec:\bbhntt.exe75⤵PID:1652
-
\??\c:\vvvdd.exec:\vvvdd.exe76⤵PID:1992
-
\??\c:\rrrrflr.exec:\rrrrflr.exe77⤵PID:1492
-
\??\c:\thtbnn.exec:\thtbnn.exe78⤵PID:636
-
\??\c:\bbttnh.exec:\bbttnh.exe79⤵PID:1444
-
\??\c:\5vppv.exec:\5vppv.exe80⤵PID:2308
-
\??\c:\xrflxfl.exec:\xrflxfl.exe81⤵PID:2120
-
\??\c:\xrxfrxx.exec:\xrxfrxx.exe82⤵PID:1600
-
\??\c:\ntbbhh.exec:\ntbbhh.exe83⤵PID:2152
-
\??\c:\1jpjp.exec:\1jpjp.exe84⤵PID:1296
-
\??\c:\rfxflll.exec:\rfxflll.exe85⤵PID:2128
-
\??\c:\xxflrrx.exec:\xxflrrx.exe86⤵PID:2412
-
\??\c:\hnhntt.exec:\hnhntt.exe87⤵PID:2752
-
\??\c:\pvvdp.exec:\pvvdp.exe88⤵PID:2636
-
\??\c:\3pvdd.exec:\3pvdd.exe89⤵PID:2544
-
\??\c:\9frxxxx.exec:\9frxxxx.exe90⤵PID:2916
-
\??\c:\ntnhtt.exec:\ntnhtt.exe91⤵PID:2572
-
\??\c:\3htbhn.exec:\3htbhn.exe92⤵PID:2692
-
\??\c:\9pddd.exec:\9pddd.exe93⤵PID:2828
-
\??\c:\9pvpv.exec:\9pvpv.exe94⤵PID:2696
-
\??\c:\ffxffff.exec:\ffxffff.exe95⤵PID:2540
-
\??\c:\nttntb.exec:\nttntb.exe96⤵PID:2580
-
\??\c:\ppvjp.exec:\ppvjp.exe97⤵PID:2204
-
\??\c:\pdpvv.exec:\pdpvv.exe98⤵PID:676
-
\??\c:\xffllrx.exec:\xffllrx.exe99⤵PID:2484
-
\??\c:\llrxflr.exec:\llrxflr.exe100⤵
- System Location Discovery: System Language Discovery
PID:2292 -
\??\c:\nnbhth.exec:\nnbhth.exe101⤵PID:2872
-
\??\c:\nbttbb.exec:\nbttbb.exe102⤵PID:1112
-
\??\c:\ddpvj.exec:\ddpvj.exe103⤵PID:1960
-
\??\c:\rrxffff.exec:\rrxffff.exe104⤵PID:2836
-
\??\c:\5rrxffr.exec:\5rrxffr.exe105⤵PID:1884
-
\??\c:\nhbbtt.exec:\nhbbtt.exe106⤵PID:2300
-
\??\c:\jjddp.exec:\jjddp.exe107⤵PID:1512
-
\??\c:\7vjpp.exec:\7vjpp.exe108⤵PID:1448
-
\??\c:\ffxxfrr.exec:\ffxxfrr.exe109⤵PID:536
-
\??\c:\nthbbb.exec:\nthbbb.exe110⤵PID:3004
-
\??\c:\bhhbhh.exec:\bhhbhh.exe111⤵PID:2632
-
\??\c:\pjjpp.exec:\pjjpp.exe112⤵PID:2224
-
\??\c:\xrxflll.exec:\xrxflll.exe113⤵PID:1820
-
\??\c:\fllllrr.exec:\fllllrr.exe114⤵PID:1804
-
\??\c:\ntbbnb.exec:\ntbbnb.exe115⤵PID:2040
-
\??\c:\7dpvp.exec:\7dpvp.exe116⤵PID:2200
-
\??\c:\7jddp.exec:\7jddp.exe117⤵PID:1876
-
\??\c:\7frlxxl.exec:\7frlxxl.exe118⤵PID:2028
-
\??\c:\lrfxxff.exec:\lrfxxff.exe119⤵PID:2596
-
\??\c:\nnbbbh.exec:\nnbbbh.exe120⤵PID:1548
-
\??\c:\3vdpj.exec:\3vdpj.exe121⤵PID:2220
-
\??\c:\dddvv.exec:\dddvv.exe122⤵PID:3028
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-