Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
22-12-2024 19:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
08135e419a9611033b74b4cee56d374da783ae605dead077269a4e9465abbe67.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
08135e419a9611033b74b4cee56d374da783ae605dead077269a4e9465abbe67.exe
-
Size
455KB
-
MD5
c7f1f4b8ae83f4a1949435c9192845a0
-
SHA1
7fc551e6b21a57f222aa3f10d744ea20b0b9ebbf
-
SHA256
08135e419a9611033b74b4cee56d374da783ae605dead077269a4e9465abbe67
-
SHA512
0c22de0dac2048c13cd8f44f1c46f009a981b85c1ea34a55708be5e857a24679e8c1141c94c9cf5ae2d9142eea5e231d1c96dc83ddf5b5e2d164dd219799ca34
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeR4:q7Tc2NYHUrAwfMp3CDR4
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 47 IoCs
resource yara_rule behavioral1/memory/1968-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1684-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1256-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1932-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1932-22-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2436-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/536-101-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/536-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/536-99-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1828-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1748-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1472-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/872-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2492-229-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2492-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2248-265-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2892-287-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/300-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2284-404-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1656-443-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2096-482-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1332-521-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1524-528-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/836-535-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1688-580-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-641-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1756-825-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/1320-1151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-1200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-1299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/304-1375-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/304-3174-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1968 080462.exe 1932 20884.exe 1256 tbbnnt.exe 2436 268406.exe 2224 060844.exe 2896 pjdjp.exe 2684 4862806.exe 2864 dpdjj.exe 2704 pjddv.exe 536 q26486.exe 2748 a4842.exe 1828 lxffflr.exe 956 hbnntb.exe 2744 8262442.exe 3008 vpjvd.exe 880 0608064.exe 1748 ppddp.exe 2516 046640.exe 2116 6224622.exe 2588 266266.exe 1472 600246.exe 872 8246884.exe 2656 7bnbhn.exe 1364 i046864.exe 2492 6602086.exe 2564 ffrlrlx.exe 1772 c206442.exe 2892 g4428.exe 2248 0488684.exe 288 4868004.exe 1480 rrlrfrl.exe 2412 nnbhtn.exe 2600 hbnbnh.exe 2080 btnthh.exe 300 a0884.exe 1976 hbbntb.exe 1904 jddpd.exe 824 jjvjv.exe 2856 pvjdv.exe 2804 jddvv.exe 2884 3htnbn.exe 2872 64286.exe 2988 20284.exe 3068 6424664.exe 2336 rlrlxrf.exe 2700 484482.exe 2788 0806662.exe 2724 604424.exe 2284 vddvj.exe 920 xfxlfrf.exe 1924 jdvpv.exe 2944 xlxlrrx.exe 2776 604404.exe 3036 tnbhnn.exe 1656 44460.exe 2532 004028.exe 1856 680848.exe 2104 6080668.exe 540 2468824.exe 1788 3rlxxlr.exe 2096 9xrllrr.exe 1412 88000.exe 1912 rrlrrxl.exe 2320 42006.exe -
resource yara_rule behavioral1/memory/1968-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1256-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/536-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1828-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1472-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/872-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/300-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-404-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1924-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1412-483-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-482-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1332-514-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1332-521-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/836-535-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-580-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-703-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-728-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1756-825-0x00000000002A0000-0x00000000002CA000-memory.dmp upx behavioral1/memory/1288-840-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1976-877-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1428-884-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-941-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-954-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/680-1051-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1520-1076-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/836-1089-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1320-1151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-1225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-1250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-1332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-1361-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language i204040.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language k24466.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 486284.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42480.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 280686.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language q04066.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8262440.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllfxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60402.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e26244.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1684 wrote to memory of 1968 1684 08135e419a9611033b74b4cee56d374da783ae605dead077269a4e9465abbe67.exe 30 PID 1684 wrote to memory of 1968 1684 08135e419a9611033b74b4cee56d374da783ae605dead077269a4e9465abbe67.exe 30 PID 1684 wrote to memory of 1968 1684 08135e419a9611033b74b4cee56d374da783ae605dead077269a4e9465abbe67.exe 30 PID 1684 wrote to memory of 1968 1684 08135e419a9611033b74b4cee56d374da783ae605dead077269a4e9465abbe67.exe 30 PID 1968 wrote to memory of 1932 1968 080462.exe 31 PID 1968 wrote to memory of 1932 1968 080462.exe 31 PID 1968 wrote to memory of 1932 1968 080462.exe 31 PID 1968 wrote to memory of 1932 1968 080462.exe 31 PID 1932 wrote to memory of 1256 1932 20884.exe 32 PID 1932 wrote to memory of 1256 1932 20884.exe 32 PID 1932 wrote to memory of 1256 1932 20884.exe 32 PID 1932 wrote to memory of 1256 1932 20884.exe 32 PID 1256 wrote to memory of 2436 1256 tbbnnt.exe 33 PID 1256 wrote to memory of 2436 1256 tbbnnt.exe 33 PID 1256 wrote to memory of 2436 1256 tbbnnt.exe 33 PID 1256 wrote to memory of 2436 1256 tbbnnt.exe 33 PID 2436 wrote to memory of 2224 2436 268406.exe 34 PID 2436 wrote to memory of 2224 2436 268406.exe 34 PID 2436 wrote to memory of 2224 2436 268406.exe 34 PID 2436 wrote to memory of 2224 2436 268406.exe 34 PID 2224 wrote to memory of 2896 2224 060844.exe 35 PID 2224 wrote to memory of 2896 2224 060844.exe 35 PID 2224 wrote to memory of 2896 2224 060844.exe 35 PID 2224 wrote to memory of 2896 2224 060844.exe 35 PID 2896 wrote to memory of 2684 2896 pjdjp.exe 36 PID 2896 wrote to memory of 2684 2896 pjdjp.exe 36 PID 2896 wrote to memory of 2684 2896 pjdjp.exe 36 PID 2896 wrote to memory of 2684 2896 pjdjp.exe 36 PID 2684 wrote to memory of 2864 2684 4862806.exe 37 PID 2684 wrote to memory of 2864 2684 4862806.exe 37 PID 2684 wrote to memory of 2864 2684 4862806.exe 37 PID 2684 wrote to memory of 2864 2684 4862806.exe 37 PID 2864 wrote to memory of 2704 2864 dpdjj.exe 38 PID 2864 wrote to memory of 2704 2864 dpdjj.exe 38 PID 2864 wrote to memory of 2704 2864 dpdjj.exe 38 PID 2864 wrote to memory of 2704 2864 dpdjj.exe 38 PID 2704 wrote to memory of 536 2704 pjddv.exe 39 PID 2704 wrote to memory of 536 2704 pjddv.exe 39 PID 2704 wrote to memory of 536 2704 pjddv.exe 39 PID 2704 wrote to memory of 536 2704 pjddv.exe 39 PID 536 wrote to memory of 2748 536 q26486.exe 40 PID 536 wrote to memory of 2748 536 q26486.exe 40 PID 536 wrote to memory of 2748 536 q26486.exe 40 PID 536 wrote to memory of 2748 536 q26486.exe 40 PID 2748 wrote to memory of 1828 2748 a4842.exe 41 PID 2748 wrote to memory of 1828 2748 a4842.exe 41 PID 2748 wrote to memory of 1828 2748 a4842.exe 41 PID 2748 wrote to memory of 1828 2748 a4842.exe 41 PID 1828 wrote to memory of 956 1828 lxffflr.exe 42 PID 1828 wrote to memory of 956 1828 lxffflr.exe 42 PID 1828 wrote to memory of 956 1828 lxffflr.exe 42 PID 1828 wrote to memory of 956 1828 lxffflr.exe 42 PID 956 wrote to memory of 2744 956 hbnntb.exe 43 PID 956 wrote to memory of 2744 956 hbnntb.exe 43 PID 956 wrote to memory of 2744 956 hbnntb.exe 43 PID 956 wrote to memory of 2744 956 hbnntb.exe 43 PID 2744 wrote to memory of 3008 2744 8262442.exe 44 PID 2744 wrote to memory of 3008 2744 8262442.exe 44 PID 2744 wrote to memory of 3008 2744 8262442.exe 44 PID 2744 wrote to memory of 3008 2744 8262442.exe 44 PID 3008 wrote to memory of 880 3008 vpjvd.exe 45 PID 3008 wrote to memory of 880 3008 vpjvd.exe 45 PID 3008 wrote to memory of 880 3008 vpjvd.exe 45 PID 3008 wrote to memory of 880 3008 vpjvd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\08135e419a9611033b74b4cee56d374da783ae605dead077269a4e9465abbe67.exe"C:\Users\Admin\AppData\Local\Temp\08135e419a9611033b74b4cee56d374da783ae605dead077269a4e9465abbe67.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\080462.exec:\080462.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\20884.exec:\20884.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\tbbnnt.exec:\tbbnnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
\??\c:\268406.exec:\268406.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\060844.exec:\060844.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\pjdjp.exec:\pjdjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\4862806.exec:\4862806.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\dpdjj.exec:\dpdjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\pjddv.exec:\pjddv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\q26486.exec:\q26486.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\a4842.exec:\a4842.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\lxffflr.exec:\lxffflr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
\??\c:\hbnntb.exec:\hbnntb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:956 -
\??\c:\8262442.exec:\8262442.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\vpjvd.exec:\vpjvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\0608064.exec:\0608064.exe17⤵
- Executes dropped EXE
PID:880 -
\??\c:\ppddp.exec:\ppddp.exe18⤵
- Executes dropped EXE
PID:1748 -
\??\c:\046640.exec:\046640.exe19⤵
- Executes dropped EXE
PID:2516 -
\??\c:\6224622.exec:\6224622.exe20⤵
- Executes dropped EXE
PID:2116 -
\??\c:\266266.exec:\266266.exe21⤵
- Executes dropped EXE
PID:2588 -
\??\c:\600246.exec:\600246.exe22⤵
- Executes dropped EXE
PID:1472 -
\??\c:\8246884.exec:\8246884.exe23⤵
- Executes dropped EXE
PID:872 -
\??\c:\7bnbhn.exec:\7bnbhn.exe24⤵
- Executes dropped EXE
PID:2656 -
\??\c:\i046864.exec:\i046864.exe25⤵
- Executes dropped EXE
PID:1364 -
\??\c:\6602086.exec:\6602086.exe26⤵
- Executes dropped EXE
PID:2492 -
\??\c:\ffrlrlx.exec:\ffrlrlx.exe27⤵
- Executes dropped EXE
PID:2564 -
\??\c:\c206442.exec:\c206442.exe28⤵
- Executes dropped EXE
PID:1772 -
\??\c:\g4428.exec:\g4428.exe29⤵
- Executes dropped EXE
PID:2892 -
\??\c:\0488684.exec:\0488684.exe30⤵
- Executes dropped EXE
PID:2248 -
\??\c:\4868004.exec:\4868004.exe31⤵
- Executes dropped EXE
PID:288 -
\??\c:\rrlrfrl.exec:\rrlrfrl.exe32⤵
- Executes dropped EXE
PID:1480 -
\??\c:\nnbhtn.exec:\nnbhtn.exe33⤵
- Executes dropped EXE
PID:2412 -
\??\c:\hbnbnh.exec:\hbnbnh.exe34⤵
- Executes dropped EXE
PID:2600 -
\??\c:\btnthh.exec:\btnthh.exe35⤵
- Executes dropped EXE
PID:2080 -
\??\c:\a0884.exec:\a0884.exe36⤵
- Executes dropped EXE
PID:300 -
\??\c:\hbbntb.exec:\hbbntb.exe37⤵
- Executes dropped EXE
PID:1976 -
\??\c:\jddpd.exec:\jddpd.exe38⤵
- Executes dropped EXE
PID:1904 -
\??\c:\jjvjv.exec:\jjvjv.exe39⤵
- Executes dropped EXE
PID:824 -
\??\c:\pvjdv.exec:\pvjdv.exe40⤵
- Executes dropped EXE
PID:2856 -
\??\c:\jddvv.exec:\jddvv.exe41⤵
- Executes dropped EXE
PID:2804 -
\??\c:\3htnbn.exec:\3htnbn.exe42⤵
- Executes dropped EXE
PID:2884 -
\??\c:\64286.exec:\64286.exe43⤵
- Executes dropped EXE
PID:2872 -
\??\c:\20284.exec:\20284.exe44⤵
- Executes dropped EXE
PID:2988 -
\??\c:\6424664.exec:\6424664.exe45⤵
- Executes dropped EXE
PID:3068 -
\??\c:\rlrlxrf.exec:\rlrlxrf.exe46⤵
- Executes dropped EXE
PID:2336 -
\??\c:\484482.exec:\484482.exe47⤵
- Executes dropped EXE
PID:2700 -
\??\c:\0806662.exec:\0806662.exe48⤵
- Executes dropped EXE
PID:2788 -
\??\c:\604424.exec:\604424.exe49⤵
- Executes dropped EXE
PID:2724 -
\??\c:\vddvj.exec:\vddvj.exe50⤵
- Executes dropped EXE
PID:2284 -
\??\c:\xfxlfrf.exec:\xfxlfrf.exe51⤵
- Executes dropped EXE
PID:920 -
\??\c:\jdvpv.exec:\jdvpv.exe52⤵
- Executes dropped EXE
PID:1924 -
\??\c:\xlxlrrx.exec:\xlxlrrx.exe53⤵
- Executes dropped EXE
PID:2944 -
\??\c:\604404.exec:\604404.exe54⤵
- Executes dropped EXE
PID:2776 -
\??\c:\tnbhnn.exec:\tnbhnn.exe55⤵
- Executes dropped EXE
PID:3036 -
\??\c:\44460.exec:\44460.exe56⤵
- Executes dropped EXE
PID:1656 -
\??\c:\004028.exec:\004028.exe57⤵
- Executes dropped EXE
PID:2532 -
\??\c:\680848.exec:\680848.exe58⤵
- Executes dropped EXE
PID:1856 -
\??\c:\6080668.exec:\6080668.exe59⤵
- Executes dropped EXE
PID:2104 -
\??\c:\2468824.exec:\2468824.exe60⤵
- Executes dropped EXE
PID:540 -
\??\c:\3rlxxlr.exec:\3rlxxlr.exe61⤵
- Executes dropped EXE
PID:1788 -
\??\c:\9xrllrr.exec:\9xrllrr.exe62⤵
- Executes dropped EXE
PID:2096 -
\??\c:\88000.exec:\88000.exe63⤵
- Executes dropped EXE
PID:1412 -
\??\c:\rrlrrxl.exec:\rrlrrxl.exe64⤵
- Executes dropped EXE
PID:1912 -
\??\c:\42006.exec:\42006.exe65⤵
- Executes dropped EXE
PID:2320 -
\??\c:\268806.exec:\268806.exe66⤵PID:1348
-
\??\c:\8262440.exec:\8262440.exe67⤵
- System Location Discovery: System Language Discovery
PID:976 -
\??\c:\u462228.exec:\u462228.exe68⤵PID:1332
-
\??\c:\4008266.exec:\4008266.exe69⤵PID:1524
-
\??\c:\dvvdp.exec:\dvvdp.exe70⤵PID:836
-
\??\c:\htntbb.exec:\htntbb.exe71⤵PID:1756
-
\??\c:\dvjpv.exec:\dvjpv.exe72⤵PID:2160
-
\??\c:\m4228.exec:\m4228.exe73⤵PID:320
-
\??\c:\7pvdd.exec:\7pvdd.exe74⤵PID:1504
-
\??\c:\20286.exec:\20286.exe75⤵PID:2220
-
\??\c:\nhnnnn.exec:\nhnnnn.exe76⤵PID:2648
-
\??\c:\hbnttb.exec:\hbnttb.exe77⤵PID:1688
-
\??\c:\60844.exec:\60844.exe78⤵PID:2128
-
\??\c:\i688446.exec:\i688446.exe79⤵PID:2428
-
\??\c:\fxrrxfr.exec:\fxrrxfr.exe80⤵PID:1320
-
\??\c:\6800628.exec:\6800628.exe81⤵PID:1692
-
\??\c:\xrflrrr.exec:\xrflrrr.exe82⤵PID:2400
-
\??\c:\pdpvv.exec:\pdpvv.exe83⤵PID:1952
-
\??\c:\3fllrrr.exec:\3fllrrr.exe84⤵PID:2288
-
\??\c:\0444022.exec:\0444022.exe85⤵PID:2816
-
\??\c:\u248828.exec:\u248828.exe86⤵PID:2224
-
\??\c:\86846.exec:\86846.exe87⤵PID:2832
-
\??\c:\6406822.exec:\6406822.exe88⤵PID:2896
-
\??\c:\btbbbb.exec:\btbbbb.exe89⤵PID:2684
-
\??\c:\dvjpd.exec:\dvjpd.exe90⤵
- System Location Discovery: System Language Discovery
PID:2904 -
\??\c:\xxllrlx.exec:\xxllrlx.exe91⤵PID:2680
-
\??\c:\086288.exec:\086288.exe92⤵PID:2732
-
\??\c:\nnhnhh.exec:\nnhnhh.exe93⤵PID:2788
-
\??\c:\6062840.exec:\6062840.exe94⤵PID:2724
-
\??\c:\868440.exec:\868440.exe95⤵PID:2980
-
\??\c:\464400.exec:\464400.exe96⤵PID:2852
-
\??\c:\pjvvp.exec:\pjvvp.exe97⤵PID:1924
-
\??\c:\dpvdj.exec:\dpvdj.exe98⤵PID:2916
-
\??\c:\fxxxlfl.exec:\fxxxlfl.exe99⤵PID:1156
-
\??\c:\9hnhhb.exec:\9hnhhb.exe100⤵PID:484
-
\??\c:\42280.exec:\42280.exe101⤵PID:1656
-
\??\c:\o628884.exec:\o628884.exe102⤵PID:2524
-
\??\c:\86808.exec:\86808.exe103⤵PID:2496
-
\??\c:\jvjjj.exec:\jvjjj.exe104⤵PID:2528
-
\??\c:\pdpvd.exec:\pdpvd.exe105⤵PID:540
-
\??\c:\xrlrfxr.exec:\xrlrfxr.exe106⤵PID:2604
-
\??\c:\3pjpp.exec:\3pjpp.exe107⤵PID:408
-
\??\c:\o606846.exec:\o606846.exe108⤵PID:2232
-
\??\c:\200606.exec:\200606.exe109⤵PID:776
-
\??\c:\lxfxxrr.exec:\lxfxxrr.exe110⤵PID:1996
-
\??\c:\dvppj.exec:\dvppj.exe111⤵PID:2276
-
\??\c:\lxrxffr.exec:\lxrxffr.exe112⤵PID:604
-
\??\c:\rrrxffr.exec:\rrrxffr.exe113⤵PID:2040
-
\??\c:\86408.exec:\86408.exe114⤵PID:1536
-
\??\c:\42662.exec:\42662.exe115⤵PID:748
-
\??\c:\k20684.exec:\k20684.exe116⤵PID:1052
-
\??\c:\bbbhhh.exec:\bbbhhh.exe117⤵PID:1756
-
\??\c:\004680.exec:\004680.exe118⤵PID:2456
-
\??\c:\fxrlrxl.exec:\fxrlrxl.exe119⤵PID:288
-
\??\c:\0462064.exec:\0462064.exe120⤵PID:1288
-
\??\c:\bnhthh.exec:\bnhthh.exe121⤵PID:864
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-