Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-12-2024 01:48
Behavioral task
behavioral1
Sample
de9056406ea61d63475af2721e749fb6580a0aacb903d0af985c796c903d7d64N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
de9056406ea61d63475af2721e749fb6580a0aacb903d0af985c796c903d7d64N.exe
-
Size
97KB
-
MD5
7fc11f9a393772d995dd1d8a098a8a70
-
SHA1
0c2b96bc569ea28cb27c6b5c4c429549d5dd470e
-
SHA256
de9056406ea61d63475af2721e749fb6580a0aacb903d0af985c796c903d7d64
-
SHA512
821a02b820aee1a0ef6442126f4d3e6918c24e1437b5e09efc671cafdbf49c94e986c2009816cd938f6bc16935f1b840d27c4ca3428f557e1f26674c2bdc26b2
-
SSDEEP
3072:8hOmTsF93UYfwC6GIout0fmCiiiXA6mzgRp:8cm4FmowdHoSgWrXUgP
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/1620-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2088-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2092-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2548-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2700-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2736-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2884-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3028-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2724-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2960-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2672-99-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2672-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/928-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2012-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1628-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2572-140-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2676-149-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2372-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1624-173-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2968-182-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1276-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/880-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/844-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/556-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2312-284-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1604-293-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2056-292-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2392-304-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2812-341-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2740-347-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1272-383-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1672-425-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1672-423-0x0000000000260000-0x0000000000287000-memory.dmp family_blackmoon behavioral1/memory/800-453-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1136-633-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2796-695-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2352-812-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3028-849-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2772-860-0x00000000002D0000-0x00000000002F7000-memory.dmp family_blackmoon behavioral1/memory/1996-1167-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/888-1287-0x0000000077680000-0x000000007779F000-memory.dmp family_blackmoon behavioral1/memory/888-2259-0x0000000077680000-0x000000007779F000-memory.dmp family_blackmoon behavioral1/memory/888-15033-0x0000000077680000-0x000000007779F000-memory.dmp family_blackmoon behavioral1/memory/888-23113-0x0000000077680000-0x000000007779F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2088 rfllxfr.exe 2092 3htnnn.exe 2548 3nhhhn.exe 2700 dvvvj.exe 2736 fxlrxlx.exe 2884 1nbhnt.exe 3028 pjvvv.exe 2724 lfxflrx.exe 2960 hbnbnb.exe 828 hhntht.exe 2672 7dppp.exe 928 3lxfrrr.exe 2012 frffllx.exe 1628 tnhttb.exe 2956 vpvdp.exe 2572 lfllxfr.exe 2676 xlxxllf.exe 2372 ttnbht.exe 788 5hnntt.exe 1624 5rflrrf.exe 2968 lrlfxlr.exe 2696 3nhtbb.exe 2208 bthttn.exe 2456 jdppv.exe 880 frlxfxx.exe 1276 frflfxf.exe 844 nhhnbn.exe 556 jdjdj.exe 1480 pjpjp.exe 2204 tttbhb.exe 1700 3hthtb.exe 1844 dvjjv.exe 872 xrllrxx.exe 2492 xlrrffr.exe 2312 9nhntt.exe 888 1hbnnh.exe 1604 5vppv.exe 2392 1ntbnb.exe 1376 1btbbb.exe 2908 vpdjp.exe 2844 frxfffl.exe 2756 frxxfxf.exe 2712 nbnnnn.exe 2740 tnbnnn.exe 2812 9vjvv.exe 2632 5vdpd.exe 2772 5dvdp.exe 2620 lfxlrxr.exe 1984 nhbntb.exe 2344 bnbbht.exe 2144 pdpdj.exe 344 vpjdp.exe 1272 dpdvv.exe 1868 lfxfxlx.exe 1628 9hhttb.exe 1268 nbnnnh.exe 1856 dpdvj.exe 1684 3dvjp.exe 2156 rfxrrlx.exe 2936 5xlrrrf.exe 1672 7tntbt.exe 1980 hthntt.exe 1624 jvjjp.exe 2952 7vjjp.exe -
resource yara_rule behavioral1/memory/1620-1-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000120f9-6.dat upx behavioral1/memory/2088-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1620-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016399-18.dat upx behavioral1/memory/2088-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2092-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2548-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000164de-26.dat upx behavioral1/files/0x0008000000016689-33.dat upx behavioral1/files/0x0007000000016b86-41.dat upx behavioral1/memory/2700-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2736-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016c89-49.dat upx behavioral1/files/0x0007000000016ca0-58.dat upx behavioral1/memory/2884-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2724-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000016cab-68.dat upx behavioral1/memory/3028-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016cf0-75.dat upx behavioral1/memory/2724-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017570-82.dat upx behavioral1/memory/2960-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000175f1-90.dat upx behavioral1/memory/2672-101-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000175f7-102.dat upx behavioral1/files/0x000d000000018683-109.dat upx behavioral1/memory/928-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2012-117-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018697-116.dat upx behavioral1/files/0x0005000000018706-125.dat upx behavioral1/memory/1628-124-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001870c-132.dat upx behavioral1/memory/2572-133-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001871c-141.dat upx behavioral1/memory/2572-140-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018745-148.dat upx behavioral1/memory/2372-150-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2676-149-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018be7-158.dat upx behavioral1/memory/2372-157-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018d7b-165.dat upx behavioral1/memory/1624-166-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018d83-174.dat upx behavioral1/memory/1624-173-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018fdf-181.dat upx behavioral1/memory/2696-183-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2968-182-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000019056-190.dat upx behavioral1/files/0x0005000000019203-197.dat upx behavioral1/memory/2456-198-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019237-205.dat upx behavioral1/files/0x000500000001924f-214.dat upx behavioral1/memory/1276-215-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/880-212-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019261-221.dat upx behavioral1/memory/556-231-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019274-230.dat upx behavioral1/memory/844-228-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001927a-239.dat upx behavioral1/memory/556-237-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019299-245.dat upx behavioral1/files/0x00080000000160da-253.dat upx behavioral1/memory/1700-254-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxfflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbntbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxflrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrllrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1620 wrote to memory of 2088 1620 de9056406ea61d63475af2721e749fb6580a0aacb903d0af985c796c903d7d64N.exe 30 PID 1620 wrote to memory of 2088 1620 de9056406ea61d63475af2721e749fb6580a0aacb903d0af985c796c903d7d64N.exe 30 PID 1620 wrote to memory of 2088 1620 de9056406ea61d63475af2721e749fb6580a0aacb903d0af985c796c903d7d64N.exe 30 PID 1620 wrote to memory of 2088 1620 de9056406ea61d63475af2721e749fb6580a0aacb903d0af985c796c903d7d64N.exe 30 PID 2088 wrote to memory of 2092 2088 rfllxfr.exe 31 PID 2088 wrote to memory of 2092 2088 rfllxfr.exe 31 PID 2088 wrote to memory of 2092 2088 rfllxfr.exe 31 PID 2088 wrote to memory of 2092 2088 rfllxfr.exe 31 PID 2092 wrote to memory of 2548 2092 3htnnn.exe 32 PID 2092 wrote to memory of 2548 2092 3htnnn.exe 32 PID 2092 wrote to memory of 2548 2092 3htnnn.exe 32 PID 2092 wrote to memory of 2548 2092 3htnnn.exe 32 PID 2548 wrote to memory of 2700 2548 3nhhhn.exe 33 PID 2548 wrote to memory of 2700 2548 3nhhhn.exe 33 PID 2548 wrote to memory of 2700 2548 3nhhhn.exe 33 PID 2548 wrote to memory of 2700 2548 3nhhhn.exe 33 PID 2700 wrote to memory of 2736 2700 dvvvj.exe 34 PID 2700 wrote to memory of 2736 2700 dvvvj.exe 34 PID 2700 wrote to memory of 2736 2700 dvvvj.exe 34 PID 2700 wrote to memory of 2736 2700 dvvvj.exe 34 PID 2736 wrote to memory of 2884 2736 fxlrxlx.exe 35 PID 2736 wrote to memory of 2884 2736 fxlrxlx.exe 35 PID 2736 wrote to memory of 2884 2736 fxlrxlx.exe 35 PID 2736 wrote to memory of 2884 2736 fxlrxlx.exe 35 PID 2884 wrote to memory of 3028 2884 1nbhnt.exe 36 PID 2884 wrote to memory of 3028 2884 1nbhnt.exe 36 PID 2884 wrote to memory of 3028 2884 1nbhnt.exe 36 PID 2884 wrote to memory of 3028 2884 1nbhnt.exe 36 PID 3028 wrote to memory of 2724 3028 pjvvv.exe 37 PID 3028 wrote to memory of 2724 3028 pjvvv.exe 37 PID 3028 wrote to memory of 2724 3028 pjvvv.exe 37 PID 3028 wrote to memory of 2724 3028 pjvvv.exe 37 PID 2724 wrote to memory of 2960 2724 lfxflrx.exe 38 PID 2724 wrote to memory of 2960 2724 lfxflrx.exe 38 PID 2724 wrote to memory of 2960 2724 lfxflrx.exe 38 PID 2724 wrote to memory of 2960 2724 lfxflrx.exe 38 PID 2960 wrote to memory of 828 2960 hbnbnb.exe 39 PID 2960 wrote to memory of 828 2960 hbnbnb.exe 39 PID 2960 wrote to memory of 828 2960 hbnbnb.exe 39 PID 2960 wrote to memory of 828 2960 hbnbnb.exe 39 PID 828 wrote to memory of 2672 828 hhntht.exe 40 PID 828 wrote to memory of 2672 828 hhntht.exe 40 PID 828 wrote to memory of 2672 828 hhntht.exe 40 PID 828 wrote to memory of 2672 828 hhntht.exe 40 PID 2672 wrote to memory of 928 2672 7dppp.exe 41 PID 2672 wrote to memory of 928 2672 7dppp.exe 41 PID 2672 wrote to memory of 928 2672 7dppp.exe 41 PID 2672 wrote to memory of 928 2672 7dppp.exe 41 PID 928 wrote to memory of 2012 928 3lxfrrr.exe 42 PID 928 wrote to memory of 2012 928 3lxfrrr.exe 42 PID 928 wrote to memory of 2012 928 3lxfrrr.exe 42 PID 928 wrote to memory of 2012 928 3lxfrrr.exe 42 PID 2012 wrote to memory of 1628 2012 frffllx.exe 43 PID 2012 wrote to memory of 1628 2012 frffllx.exe 43 PID 2012 wrote to memory of 1628 2012 frffllx.exe 43 PID 2012 wrote to memory of 1628 2012 frffllx.exe 43 PID 1628 wrote to memory of 2956 1628 tnhttb.exe 44 PID 1628 wrote to memory of 2956 1628 tnhttb.exe 44 PID 1628 wrote to memory of 2956 1628 tnhttb.exe 44 PID 1628 wrote to memory of 2956 1628 tnhttb.exe 44 PID 2956 wrote to memory of 2572 2956 vpvdp.exe 45 PID 2956 wrote to memory of 2572 2956 vpvdp.exe 45 PID 2956 wrote to memory of 2572 2956 vpvdp.exe 45 PID 2956 wrote to memory of 2572 2956 vpvdp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\de9056406ea61d63475af2721e749fb6580a0aacb903d0af985c796c903d7d64N.exe"C:\Users\Admin\AppData\Local\Temp\de9056406ea61d63475af2721e749fb6580a0aacb903d0af985c796c903d7d64N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\rfllxfr.exec:\rfllxfr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\3htnnn.exec:\3htnnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\3nhhhn.exec:\3nhhhn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\dvvvj.exec:\dvvvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\fxlrxlx.exec:\fxlrxlx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\1nbhnt.exec:\1nbhnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\pjvvv.exec:\pjvvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\lfxflrx.exec:\lfxflrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\hbnbnb.exec:\hbnbnb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\hhntht.exec:\hhntht.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:828 -
\??\c:\7dppp.exec:\7dppp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\3lxfrrr.exec:\3lxfrrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:928 -
\??\c:\frffllx.exec:\frffllx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\tnhttb.exec:\tnhttb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\vpvdp.exec:\vpvdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\lfllxfr.exec:\lfllxfr.exe17⤵
- Executes dropped EXE
PID:2572 -
\??\c:\xlxxllf.exec:\xlxxllf.exe18⤵
- Executes dropped EXE
PID:2676 -
\??\c:\ttnbht.exec:\ttnbht.exe19⤵
- Executes dropped EXE
PID:2372 -
\??\c:\5hnntt.exec:\5hnntt.exe20⤵
- Executes dropped EXE
PID:788 -
\??\c:\5rflrrf.exec:\5rflrrf.exe21⤵
- Executes dropped EXE
PID:1624 -
\??\c:\lrlfxlr.exec:\lrlfxlr.exe22⤵
- Executes dropped EXE
PID:2968 -
\??\c:\3nhtbb.exec:\3nhtbb.exe23⤵
- Executes dropped EXE
PID:2696 -
\??\c:\bthttn.exec:\bthttn.exe24⤵
- Executes dropped EXE
PID:2208 -
\??\c:\jdppv.exec:\jdppv.exe25⤵
- Executes dropped EXE
PID:2456 -
\??\c:\frlxfxx.exec:\frlxfxx.exe26⤵
- Executes dropped EXE
PID:880 -
\??\c:\frflfxf.exec:\frflfxf.exe27⤵
- Executes dropped EXE
PID:1276 -
\??\c:\nhhnbn.exec:\nhhnbn.exe28⤵
- Executes dropped EXE
PID:844 -
\??\c:\jdjdj.exec:\jdjdj.exe29⤵
- Executes dropped EXE
PID:556 -
\??\c:\pjpjp.exec:\pjpjp.exe30⤵
- Executes dropped EXE
PID:1480 -
\??\c:\tttbhb.exec:\tttbhb.exe31⤵
- Executes dropped EXE
PID:2204 -
\??\c:\3hthtb.exec:\3hthtb.exe32⤵
- Executes dropped EXE
PID:1700 -
\??\c:\dvjjv.exec:\dvjjv.exe33⤵
- Executes dropped EXE
PID:1844 -
\??\c:\xrllrxx.exec:\xrllrxx.exe34⤵
- Executes dropped EXE
PID:872 -
\??\c:\xlrrffr.exec:\xlrrffr.exe35⤵
- Executes dropped EXE
PID:2492 -
\??\c:\9nhntt.exec:\9nhntt.exe36⤵
- Executes dropped EXE
PID:2312 -
\??\c:\1hbnnh.exec:\1hbnnh.exe37⤵
- Executes dropped EXE
PID:888 -
\??\c:\dpdjp.exec:\dpdjp.exe38⤵PID:2056
-
\??\c:\5vppv.exec:\5vppv.exe39⤵
- Executes dropped EXE
PID:1604 -
\??\c:\1ntbnb.exec:\1ntbnb.exe40⤵
- Executes dropped EXE
PID:2392 -
\??\c:\1btbbb.exec:\1btbbb.exe41⤵
- Executes dropped EXE
PID:1376 -
\??\c:\vpdjp.exec:\vpdjp.exe42⤵
- Executes dropped EXE
PID:2908 -
\??\c:\frxfffl.exec:\frxfffl.exe43⤵
- Executes dropped EXE
PID:2844 -
\??\c:\frxxfxf.exec:\frxxfxf.exe44⤵
- Executes dropped EXE
PID:2756 -
\??\c:\nbnnnn.exec:\nbnnnn.exe45⤵
- Executes dropped EXE
PID:2712 -
\??\c:\tnbnnn.exec:\tnbnnn.exe46⤵
- Executes dropped EXE
PID:2740 -
\??\c:\9vjvv.exec:\9vjvv.exe47⤵
- Executes dropped EXE
PID:2812 -
\??\c:\5vdpd.exec:\5vdpd.exe48⤵
- Executes dropped EXE
PID:2632 -
\??\c:\5dvdp.exec:\5dvdp.exe49⤵
- Executes dropped EXE
PID:2772 -
\??\c:\lfxlrxr.exec:\lfxlrxr.exe50⤵
- Executes dropped EXE
PID:2620 -
\??\c:\nhbntb.exec:\nhbntb.exe51⤵
- Executes dropped EXE
PID:1984 -
\??\c:\bnbbht.exec:\bnbbht.exe52⤵
- Executes dropped EXE
PID:2344 -
\??\c:\pdpdj.exec:\pdpdj.exe53⤵
- Executes dropped EXE
PID:2144 -
\??\c:\vpjdp.exec:\vpjdp.exe54⤵
- Executes dropped EXE
PID:344 -
\??\c:\dpdvv.exec:\dpdvv.exe55⤵
- Executes dropped EXE
PID:1272 -
\??\c:\lfxfxlx.exec:\lfxfxlx.exe56⤵
- Executes dropped EXE
PID:1868 -
\??\c:\9hhttb.exec:\9hhttb.exe57⤵
- Executes dropped EXE
PID:1628 -
\??\c:\nbnnnh.exec:\nbnnnh.exe58⤵
- Executes dropped EXE
PID:1268 -
\??\c:\dpdvj.exec:\dpdvj.exe59⤵
- Executes dropped EXE
PID:1856 -
\??\c:\3dvjp.exec:\3dvjp.exe60⤵
- Executes dropped EXE
PID:1684 -
\??\c:\rfxrrlx.exec:\rfxrrlx.exe61⤵
- Executes dropped EXE
PID:2156 -
\??\c:\5xlrrrf.exec:\5xlrrrf.exe62⤵
- Executes dropped EXE
PID:2936 -
\??\c:\7tntbt.exec:\7tntbt.exe63⤵
- Executes dropped EXE
PID:1672 -
\??\c:\hthntt.exec:\hthntt.exe64⤵
- Executes dropped EXE
PID:1980 -
\??\c:\jvjjp.exec:\jvjjp.exe65⤵
- Executes dropped EXE
PID:1624 -
\??\c:\7vjjp.exec:\7vjjp.exe66⤵
- Executes dropped EXE
PID:2952 -
\??\c:\lxrlllr.exec:\lxrlllr.exe67⤵PID:2192
-
\??\c:\rlrflrr.exec:\rlrflrr.exe68⤵PID:2220
-
\??\c:\lfrxffr.exec:\lfrxffr.exe69⤵PID:800
-
\??\c:\hbhntb.exec:\hbhntb.exe70⤵PID:340
-
\??\c:\jpvvj.exec:\jpvvj.exe71⤵PID:448
-
\??\c:\5jjdj.exec:\5jjdj.exe72⤵PID:1920
-
\??\c:\9pjpv.exec:\9pjpv.exe73⤵PID:1352
-
\??\c:\7xfxrll.exec:\7xfxrll.exe74⤵PID:1328
-
\??\c:\5lfllll.exec:\5lfllll.exe75⤵PID:1536
-
\??\c:\hhnntt.exec:\hhnntt.exe76⤵PID:3048
-
\??\c:\nhtbtb.exec:\nhtbtb.exe77⤵PID:1932
-
\??\c:\vjddj.exec:\vjddj.exe78⤵PID:2580
-
\??\c:\vjvpd.exec:\vjvpd.exe79⤵PID:572
-
\??\c:\lxxxxff.exec:\lxxxxff.exe80⤵PID:2384
-
\??\c:\lrfrlrr.exec:\lrfrlrr.exe81⤵PID:1028
-
\??\c:\tnhhtb.exec:\tnhhtb.exe82⤵PID:1676
-
\??\c:\7hbhtb.exec:\7hbhtb.exe83⤵PID:1488
-
\??\c:\9pdvv.exec:\9pdvv.exe84⤵PID:3060
-
\??\c:\9vpvj.exec:\9vpvj.exe85⤵PID:2328
-
\??\c:\rlxxfxf.exec:\rlxxfxf.exe86⤵PID:2116
-
\??\c:\llrfxlr.exec:\llrfxlr.exe87⤵PID:2540
-
\??\c:\htnhbn.exec:\htnhbn.exe88⤵PID:1600
-
\??\c:\5hbbnh.exec:\5hbbnh.exe89⤵PID:2460
-
\??\c:\dpdvv.exec:\dpdvv.exe90⤵PID:2148
-
\??\c:\vjdvd.exec:\vjdvd.exe91⤵PID:2700
-
\??\c:\9vjpv.exec:\9vjpv.exe92⤵PID:2880
-
\??\c:\xrrxffr.exec:\xrrxffr.exe93⤵PID:2760
-
\??\c:\frfffff.exec:\frfffff.exe94⤵PID:2756
-
\??\c:\9tnbhb.exec:\9tnbhb.exe95⤵PID:484
-
\??\c:\nhttht.exec:\nhttht.exe96⤵PID:2808
-
\??\c:\vjpvp.exec:\vjpvp.exe97⤵PID:2724
-
\??\c:\3jvvv.exec:\3jvvv.exe98⤵PID:2632
-
\??\c:\1fxxffx.exec:\1fxxffx.exe99⤵PID:2960
-
\??\c:\fxlxllr.exec:\fxlxllr.exe100⤵PID:2612
-
\??\c:\thttbh.exec:\thttbh.exe101⤵PID:1984
-
\??\c:\7nnnnt.exec:\7nnnnt.exe102⤵PID:2296
-
\??\c:\vvvdp.exec:\vvvdp.exe103⤵PID:2144
-
\??\c:\9jvvd.exec:\9jvvd.exe104⤵PID:1136
-
\??\c:\frfxxxf.exec:\frfxxxf.exe105⤵PID:1272
-
\??\c:\9lfflrf.exec:\9lfflrf.exe106⤵PID:1324
-
\??\c:\1tnntn.exec:\1tnntn.exe107⤵PID:1628
-
\??\c:\tntbhh.exec:\tntbhh.exe108⤵PID:1996
-
\??\c:\pdppj.exec:\pdppj.exe109⤵PID:1812
-
\??\c:\pdjjv.exec:\pdjjv.exe110⤵PID:1684
-
\??\c:\rlxlrxl.exec:\rlxlrxl.exe111⤵PID:2820
-
\??\c:\xxxxxxr.exec:\xxxxxxr.exe112⤵PID:2932
-
\??\c:\nbnnnh.exec:\nbnnnh.exe113⤵PID:788
-
\??\c:\3hhttb.exec:\3hhttb.exe114⤵PID:1764
-
\??\c:\jdjjd.exec:\jdjjd.exe115⤵PID:2796
-
\??\c:\pdvvd.exec:\pdvvd.exe116⤵PID:2440
-
\??\c:\xrfflrx.exec:\xrfflrx.exe117⤵PID:1420
-
\??\c:\lxlxxrx.exec:\lxlxxrx.exe118⤵PID:2324
-
\??\c:\tnbbhn.exec:\tnbbhn.exe119⤵PID:2456
-
\??\c:\nhbhnn.exec:\nhbhnn.exe120⤵PID:340
-
\??\c:\1ppjv.exec:\1ppjv.exe121⤵PID:3044
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-