Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-12-2024 20:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2004f7c71878aa601b35c543d3134e37839b536fb305162b2ebcf1c602c9dc25.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
2004f7c71878aa601b35c543d3134e37839b536fb305162b2ebcf1c602c9dc25.exe
-
Size
456KB
-
MD5
671231fc6158870f2a2d6cd41136fe6e
-
SHA1
3150012d1855c4e9ce9d3340f44688a5218b49df
-
SHA256
2004f7c71878aa601b35c543d3134e37839b536fb305162b2ebcf1c602c9dc25
-
SHA512
c7fde17396ad8b73a79adf7d576b4e11490642b2060955db211547eaf08d785a43c1b6c96bc397bbd506340c1f8d4665c17a635763c577837ffb90d04c54b81d
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRV:q7Tc2NYHUrAwfMp3CDRV
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2084-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1068-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-63-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1840-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2388-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/236-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/956-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1348-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1740-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1740-248-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2728-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1688-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-342-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2808-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-351-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1480-370-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1480-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-430-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/536-438-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2232-452-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2024-459-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1744-523-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2412-543-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2292-581-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/1572-589-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-660-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/716-709-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1800-755-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1868-796-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2772 tntbhh.exe 2876 nhbtbt.exe 2740 lfllxxf.exe 2556 fxrfrxl.exe 1068 3jddd.exe 2592 frflxfl.exe 3008 thbbhn.exe 1840 fxlxflx.exe 2572 hbtthh.exe 2388 pdjjv.exe 1812 bnhhtt.exe 1268 rlxxxxf.exe 236 bnbtbb.exe 2860 vpppd.exe 956 3xrxfff.exe 1796 dvvjv.exe 2900 rlflrlx.exe 3016 tnnttt.exe 3036 lfrxrxx.exe 2464 nhnbnn.exe 2136 vjddj.exe 1348 7lxxrrr.exe 1300 jpdpd.exe 2484 rfrrxlx.exe 1380 jppdp.exe 3012 lflrflx.exe 1740 7nbbnn.exe 320 dddvd.exe 2728 dvppv.exe 2052 jdppd.exe 1036 1hbhbn.exe 2184 jvjpj.exe 2812 ddvpd.exe 1688 5vjpp.exe 2672 xxrxrxl.exe 2724 nhtbhh.exe 2848 jjpdj.exe 2808 ffffrfl.exe 2544 hhthtt.exe 2552 bthtnn.exe 2240 xrfflrf.exe 1480 lxxfrrx.exe 2972 5nbttt.exe 2096 1dvdv.exe 2128 rlxrflx.exe 2388 bhhbbn.exe 2520 bththt.exe 1620 vvjpd.exe 1372 xflxrlr.exe 716 3nhthn.exe 2932 jjvvd.exe 536 rrllflx.exe 1400 nhnnnt.exe 2232 pjdjv.exe 2024 vpjpd.exe 3060 xfxfrrf.exe 1940 hbtbtt.exe 2916 9ppvj.exe 2464 3lxxrxl.exe 1596 hhbbnt.exe 2600 btbbbb.exe 912 dvvvd.exe 932 ffxfrxf.exe 2064 3bntbh.exe -
resource yara_rule behavioral1/memory/2084-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1068-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1840-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/236-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/956-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/956-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1348-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-278-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2184-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1480-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/536-438-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1940-466-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/932-504-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-523-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-530-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-543-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1572-582-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1572-589-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-596-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-660-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/716-702-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/716-709-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-716-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-755-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-810-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3frxffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrrlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfrflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nhthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlrfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2084 wrote to memory of 2772 2084 2004f7c71878aa601b35c543d3134e37839b536fb305162b2ebcf1c602c9dc25.exe 31 PID 2084 wrote to memory of 2772 2084 2004f7c71878aa601b35c543d3134e37839b536fb305162b2ebcf1c602c9dc25.exe 31 PID 2084 wrote to memory of 2772 2084 2004f7c71878aa601b35c543d3134e37839b536fb305162b2ebcf1c602c9dc25.exe 31 PID 2084 wrote to memory of 2772 2084 2004f7c71878aa601b35c543d3134e37839b536fb305162b2ebcf1c602c9dc25.exe 31 PID 2772 wrote to memory of 2876 2772 tntbhh.exe 32 PID 2772 wrote to memory of 2876 2772 tntbhh.exe 32 PID 2772 wrote to memory of 2876 2772 tntbhh.exe 32 PID 2772 wrote to memory of 2876 2772 tntbhh.exe 32 PID 2876 wrote to memory of 2740 2876 nhbtbt.exe 33 PID 2876 wrote to memory of 2740 2876 nhbtbt.exe 33 PID 2876 wrote to memory of 2740 2876 nhbtbt.exe 33 PID 2876 wrote to memory of 2740 2876 nhbtbt.exe 33 PID 2740 wrote to memory of 2556 2740 lfllxxf.exe 34 PID 2740 wrote to memory of 2556 2740 lfllxxf.exe 34 PID 2740 wrote to memory of 2556 2740 lfllxxf.exe 34 PID 2740 wrote to memory of 2556 2740 lfllxxf.exe 34 PID 2556 wrote to memory of 1068 2556 fxrfrxl.exe 35 PID 2556 wrote to memory of 1068 2556 fxrfrxl.exe 35 PID 2556 wrote to memory of 1068 2556 fxrfrxl.exe 35 PID 2556 wrote to memory of 1068 2556 fxrfrxl.exe 35 PID 1068 wrote to memory of 2592 1068 3jddd.exe 36 PID 1068 wrote to memory of 2592 1068 3jddd.exe 36 PID 1068 wrote to memory of 2592 1068 3jddd.exe 36 PID 1068 wrote to memory of 2592 1068 3jddd.exe 36 PID 2592 wrote to memory of 3008 2592 frflxfl.exe 37 PID 2592 wrote to memory of 3008 2592 frflxfl.exe 37 PID 2592 wrote to memory of 3008 2592 frflxfl.exe 37 PID 2592 wrote to memory of 3008 2592 frflxfl.exe 37 PID 3008 wrote to memory of 1840 3008 thbbhn.exe 38 PID 3008 wrote to memory of 1840 3008 thbbhn.exe 38 PID 3008 wrote to memory of 1840 3008 thbbhn.exe 38 PID 3008 wrote to memory of 1840 3008 thbbhn.exe 38 PID 1840 wrote to memory of 2572 1840 fxlxflx.exe 39 PID 1840 wrote to memory of 2572 1840 fxlxflx.exe 39 PID 1840 wrote to memory of 2572 1840 fxlxflx.exe 39 PID 1840 wrote to memory of 2572 1840 fxlxflx.exe 39 PID 2572 wrote to memory of 2388 2572 hbtthh.exe 40 PID 2572 wrote to memory of 2388 2572 hbtthh.exe 40 PID 2572 wrote to memory of 2388 2572 hbtthh.exe 40 PID 2572 wrote to memory of 2388 2572 hbtthh.exe 40 PID 2388 wrote to memory of 1812 2388 pdjjv.exe 41 PID 2388 wrote to memory of 1812 2388 pdjjv.exe 41 PID 2388 wrote to memory of 1812 2388 pdjjv.exe 41 PID 2388 wrote to memory of 1812 2388 pdjjv.exe 41 PID 1812 wrote to memory of 1268 1812 bnhhtt.exe 42 PID 1812 wrote to memory of 1268 1812 bnhhtt.exe 42 PID 1812 wrote to memory of 1268 1812 bnhhtt.exe 42 PID 1812 wrote to memory of 1268 1812 bnhhtt.exe 42 PID 1268 wrote to memory of 236 1268 rlxxxxf.exe 43 PID 1268 wrote to memory of 236 1268 rlxxxxf.exe 43 PID 1268 wrote to memory of 236 1268 rlxxxxf.exe 43 PID 1268 wrote to memory of 236 1268 rlxxxxf.exe 43 PID 236 wrote to memory of 2860 236 bnbtbb.exe 44 PID 236 wrote to memory of 2860 236 bnbtbb.exe 44 PID 236 wrote to memory of 2860 236 bnbtbb.exe 44 PID 236 wrote to memory of 2860 236 bnbtbb.exe 44 PID 2860 wrote to memory of 956 2860 vpppd.exe 45 PID 2860 wrote to memory of 956 2860 vpppd.exe 45 PID 2860 wrote to memory of 956 2860 vpppd.exe 45 PID 2860 wrote to memory of 956 2860 vpppd.exe 45 PID 956 wrote to memory of 1796 956 3xrxfff.exe 46 PID 956 wrote to memory of 1796 956 3xrxfff.exe 46 PID 956 wrote to memory of 1796 956 3xrxfff.exe 46 PID 956 wrote to memory of 1796 956 3xrxfff.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\2004f7c71878aa601b35c543d3134e37839b536fb305162b2ebcf1c602c9dc25.exe"C:\Users\Admin\AppData\Local\Temp\2004f7c71878aa601b35c543d3134e37839b536fb305162b2ebcf1c602c9dc25.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\tntbhh.exec:\tntbhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\nhbtbt.exec:\nhbtbt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\lfllxxf.exec:\lfllxxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\fxrfrxl.exec:\fxrfrxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\3jddd.exec:\3jddd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
\??\c:\frflxfl.exec:\frflxfl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\thbbhn.exec:\thbbhn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\fxlxflx.exec:\fxlxflx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
\??\c:\hbtthh.exec:\hbtthh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\pdjjv.exec:\pdjjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\bnhhtt.exec:\bnhhtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\rlxxxxf.exec:\rlxxxxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
\??\c:\bnbtbb.exec:\bnbtbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:236 -
\??\c:\vpppd.exec:\vpppd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\3xrxfff.exec:\3xrxfff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:956 -
\??\c:\dvvjv.exec:\dvvjv.exe17⤵
- Executes dropped EXE
PID:1796 -
\??\c:\rlflrlx.exec:\rlflrlx.exe18⤵
- Executes dropped EXE
PID:2900 -
\??\c:\tnnttt.exec:\tnnttt.exe19⤵
- Executes dropped EXE
PID:3016 -
\??\c:\lfrxrxx.exec:\lfrxrxx.exe20⤵
- Executes dropped EXE
PID:3036 -
\??\c:\nhnbnn.exec:\nhnbnn.exe21⤵
- Executes dropped EXE
PID:2464 -
\??\c:\vjddj.exec:\vjddj.exe22⤵
- Executes dropped EXE
PID:2136 -
\??\c:\7lxxrrr.exec:\7lxxrrr.exe23⤵
- Executes dropped EXE
PID:1348 -
\??\c:\jpdpd.exec:\jpdpd.exe24⤵
- Executes dropped EXE
PID:1300 -
\??\c:\rfrrxlx.exec:\rfrrxlx.exe25⤵
- Executes dropped EXE
PID:2484 -
\??\c:\jppdp.exec:\jppdp.exe26⤵
- Executes dropped EXE
PID:1380 -
\??\c:\lflrflx.exec:\lflrflx.exe27⤵
- Executes dropped EXE
PID:3012 -
\??\c:\7nbbnn.exec:\7nbbnn.exe28⤵
- Executes dropped EXE
PID:1740 -
\??\c:\dddvd.exec:\dddvd.exe29⤵
- Executes dropped EXE
PID:320 -
\??\c:\dvppv.exec:\dvppv.exe30⤵
- Executes dropped EXE
PID:2728 -
\??\c:\jdppd.exec:\jdppd.exe31⤵
- Executes dropped EXE
PID:2052 -
\??\c:\1hbhbn.exec:\1hbhbn.exe32⤵
- Executes dropped EXE
PID:1036 -
\??\c:\jvjpj.exec:\jvjpj.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2184 -
\??\c:\ddvpd.exec:\ddvpd.exe34⤵
- Executes dropped EXE
PID:2812 -
\??\c:\5vjpp.exec:\5vjpp.exe35⤵
- Executes dropped EXE
PID:1688 -
\??\c:\xxrxrxl.exec:\xxrxrxl.exe36⤵
- Executes dropped EXE
PID:2672 -
\??\c:\nhtbhh.exec:\nhtbhh.exe37⤵
- Executes dropped EXE
PID:2724 -
\??\c:\jjpdj.exec:\jjpdj.exe38⤵
- Executes dropped EXE
PID:2848 -
\??\c:\ffffrfl.exec:\ffffrfl.exe39⤵
- Executes dropped EXE
PID:2808 -
\??\c:\hhthtt.exec:\hhthtt.exe40⤵
- Executes dropped EXE
PID:2544 -
\??\c:\bthtnn.exec:\bthtnn.exe41⤵
- Executes dropped EXE
PID:2552 -
\??\c:\xrfflrf.exec:\xrfflrf.exe42⤵
- Executes dropped EXE
PID:2240 -
\??\c:\lxxfrrx.exec:\lxxfrrx.exe43⤵
- Executes dropped EXE
PID:1480 -
\??\c:\5nbttt.exec:\5nbttt.exe44⤵
- Executes dropped EXE
PID:2972 -
\??\c:\1dvdv.exec:\1dvdv.exe45⤵
- Executes dropped EXE
PID:2096 -
\??\c:\rlxrflx.exec:\rlxrflx.exe46⤵
- Executes dropped EXE
PID:2128 -
\??\c:\bhhbbn.exec:\bhhbbn.exe47⤵
- Executes dropped EXE
PID:2388 -
\??\c:\bththt.exec:\bththt.exe48⤵
- Executes dropped EXE
PID:2520 -
\??\c:\vvjpd.exec:\vvjpd.exe49⤵
- Executes dropped EXE
PID:1620 -
\??\c:\xflxrlr.exec:\xflxrlr.exe50⤵
- Executes dropped EXE
PID:1372 -
\??\c:\3nhthn.exec:\3nhthn.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:716 -
\??\c:\jjvvd.exec:\jjvvd.exe52⤵
- Executes dropped EXE
PID:2932 -
\??\c:\rrllflx.exec:\rrllflx.exe53⤵
- Executes dropped EXE
PID:536 -
\??\c:\nhnnnt.exec:\nhnnnt.exe54⤵
- Executes dropped EXE
PID:1400 -
\??\c:\pjdjv.exec:\pjdjv.exe55⤵
- Executes dropped EXE
PID:2232 -
\??\c:\vpjpd.exec:\vpjpd.exe56⤵
- Executes dropped EXE
PID:2024 -
\??\c:\xfxfrrf.exec:\xfxfrrf.exe57⤵
- Executes dropped EXE
PID:3060 -
\??\c:\hbtbtt.exec:\hbtbtt.exe58⤵
- Executes dropped EXE
PID:1940 -
\??\c:\9ppvj.exec:\9ppvj.exe59⤵
- Executes dropped EXE
PID:2916 -
\??\c:\3lxxrxl.exec:\3lxxrxl.exe60⤵
- Executes dropped EXE
PID:2464 -
\??\c:\hhbbnt.exec:\hhbbnt.exe61⤵
- Executes dropped EXE
PID:1596 -
\??\c:\btbbbb.exec:\btbbbb.exe62⤵
- Executes dropped EXE
PID:2600 -
\??\c:\dvvvd.exec:\dvvvd.exe63⤵
- Executes dropped EXE
PID:912 -
\??\c:\ffxfrxf.exec:\ffxfrxf.exe64⤵
- Executes dropped EXE
PID:932 -
\??\c:\3bntbh.exec:\3bntbh.exe65⤵
- Executes dropped EXE
PID:2064 -
\??\c:\nnnnbn.exec:\nnnnbn.exe66⤵PID:1744
-
\??\c:\pppdv.exec:\pppdv.exe67⤵PID:1724
-
\??\c:\llfxlrf.exec:\llfxlrf.exe68⤵PID:2480
-
\??\c:\9hbnbh.exec:\9hbnbh.exe69⤵PID:2412
-
\??\c:\3nntht.exec:\3nntht.exe70⤵PID:320
-
\??\c:\pvdpd.exec:\pvdpd.exe71⤵PID:2016
-
\??\c:\fxrxflx.exec:\fxrxflx.exe72⤵PID:2292
-
\??\c:\nhtnhn.exec:\nhtnhn.exe73⤵PID:1588
-
\??\c:\5hhtht.exec:\5hhtht.exe74⤵PID:1996
-
\??\c:\jjdvp.exec:\jjdvp.exe75⤵PID:1876
-
\??\c:\rllrlll.exec:\rllrlll.exe76⤵PID:1572
-
\??\c:\bhnthn.exec:\bhnthn.exe77⤵PID:2664
-
\??\c:\pjddv.exec:\pjddv.exe78⤵PID:2668
-
\??\c:\jdvdd.exec:\jdvdd.exe79⤵PID:2640
-
\??\c:\ffxlfrf.exec:\ffxlfrf.exe80⤵PID:2332
-
\??\c:\ntntnb.exec:\ntntnb.exe81⤵PID:2716
-
\??\c:\vvvdp.exec:\vvvdp.exe82⤵PID:2612
-
\??\c:\dvvjp.exec:\dvvjp.exe83⤵PID:2956
-
\??\c:\7xrxxfr.exec:\7xrxxfr.exe84⤵PID:2552
-
\??\c:\hbnnhn.exec:\hbnnhn.exe85⤵PID:3008
-
\??\c:\pppdp.exec:\pppdp.exe86⤵PID:1480
-
\??\c:\rlfxflx.exec:\rlfxflx.exe87⤵PID:2944
-
\??\c:\5llllxl.exec:\5llllxl.exe88⤵PID:2348
-
\??\c:\ttnhnt.exec:\ttnhnt.exe89⤵PID:2128
-
\??\c:\ppvdv.exec:\ppvdv.exe90⤵PID:1204
-
\??\c:\dddjp.exec:\dddjp.exe91⤵PID:1908
-
\??\c:\rlffllf.exec:\rlffllf.exe92⤵PID:1620
-
\??\c:\5hbbbh.exec:\5hbbbh.exe93⤵PID:2628
-
\??\c:\7vppd.exec:\7vppd.exe94⤵PID:716
-
\??\c:\pdvdp.exec:\pdvdp.exe95⤵PID:956
-
\??\c:\rfxxllx.exec:\rfxxllx.exe96⤵PID:2904
-
\??\c:\9bnhth.exec:\9bnhth.exe97⤵PID:1400
-
\??\c:\nhntth.exec:\nhntth.exe98⤵PID:2232
-
\??\c:\ppjvp.exec:\ppjvp.exe99⤵
- System Location Discovery: System Language Discovery
PID:3016 -
\??\c:\rlxxlrf.exec:\rlxxlrf.exe100⤵PID:3044
-
\??\c:\xrllxxf.exec:\xrllxxf.exe101⤵PID:1940
-
\??\c:\btthtb.exec:\btthtb.exe102⤵PID:1800
-
\??\c:\3jvjv.exec:\3jvjv.exe103⤵PID:1092
-
\??\c:\pjjvj.exec:\pjjvj.exe104⤵PID:1596
-
\??\c:\xxrlrlr.exec:\xxrlrlr.exe105⤵PID:948
-
\??\c:\hbbhth.exec:\hbbhth.exe106⤵PID:2936
-
\??\c:\1pjjv.exec:\1pjjv.exe107⤵PID:1868
-
\??\c:\xxlllrx.exec:\xxlllrx.exe108⤵PID:1328
-
\??\c:\frflrxl.exec:\frflrxl.exe109⤵PID:1716
-
\??\c:\btnthn.exec:\btnthn.exe110⤵PID:3032
-
\??\c:\7jddj.exec:\7jddj.exe111⤵PID:560
-
\??\c:\3fffrxl.exec:\3fffrxl.exe112⤵PID:2156
-
\??\c:\llxfflf.exec:\llxfflf.exe113⤵PID:2948
-
\??\c:\hhhtht.exec:\hhhtht.exe114⤵PID:1884
-
\??\c:\ffxfrfr.exec:\ffxfrfr.exe115⤵PID:2144
-
\??\c:\rllrffx.exec:\rllrffx.exe116⤵PID:2800
-
\??\c:\7bnnnb.exec:\7bnnnb.exe117⤵PID:2300
-
\??\c:\5ppdj.exec:\5ppdj.exe118⤵PID:2696
-
\??\c:\llllxfr.exec:\llllxfr.exe119⤵PID:2872
-
\??\c:\nhnhbt.exec:\nhnhbt.exe120⤵PID:2824
-
\??\c:\pjdvd.exec:\pjdvd.exe121⤵PID:2560
-
\??\c:\fxrxllf.exec:\fxrxllf.exe122⤵PID:2640
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-