Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-12-2024 21:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2fde290448a3b95a3e61387da7d09fde6ac701bcaf19ba4de1f9acf5eea455d6.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
2fde290448a3b95a3e61387da7d09fde6ac701bcaf19ba4de1f9acf5eea455d6.exe
-
Size
454KB
-
MD5
91de9db8849e1cbb5b08f49a2d28acca
-
SHA1
3578e27ab5792b358d9f8a18c7a3e5d24b3987f0
-
SHA256
2fde290448a3b95a3e61387da7d09fde6ac701bcaf19ba4de1f9acf5eea455d6
-
SHA512
32a6b63d8eac9db090fd8a5ccce67ff8f0e9a5caf19b38e489338975d7f2abf13b8c16d9c87ff7f8d13e94df3c31bddde0cb1f9f422194008aa8ee703f7eb9f6
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbea:q7Tc2NYHUrAwfMp3CDa
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/2888-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1720-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2080-25-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2080-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1840-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2092-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/768-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1736-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1736-140-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/316-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1636-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1912-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/572-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1632-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1884-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-390-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1964-409-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1068-422-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2028-435-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1904-501-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1872-585-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2304-604-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/696-767-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1716-817-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/3040-869-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2304-882-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2304-883-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3060-897-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-948-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/960-1023-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2904-1058-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2348-1160-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1720 xlrllxf.exe 2080 nhbhhn.exe 2252 pvjdd.exe 1840 fxlxflr.exe 2744 dvdvj.exe 2800 ntnhbt.exe 2092 jdpvj.exe 2628 5rrrxxr.exe 2652 jdvvd.exe 2584 xlffflr.exe 3004 bnhhtt.exe 768 jjdvv.exe 2600 tnhnbb.exe 1736 5pppv.exe 2296 xrlrffr.exe 316 hbhtht.exe 1636 xrllxlr.exe 1912 nnhtbb.exe 2636 pdjpp.exe 1188 pdvdj.exe 840 fxxxllx.exe 2052 7nbhnt.exe 1660 dpjpp.exe 572 fxrrxfx.exe 2112 1nbbhn.exe 2396 vvvvd.exe 2928 ntnhnt.exe 2500 9btttt.exe 2944 xxrfxlx.exe 1712 hhbnnt.exe 2228 vvjpv.exe 276 tntnbh.exe 3040 dvdpp.exe 2288 3fxflrf.exe 2348 llxflxf.exe 1632 tbnhht.exe 2812 3djpd.exe 1884 xrllrrx.exe 2748 9xflxfl.exe 2696 5bbhnn.exe 2820 ppdjp.exe 2236 lllllrx.exe 2676 lfrxllx.exe 2540 hhbhnt.exe 2572 9dvvv.exe 2584 rlxfffr.exe 1560 1rllxfl.exe 1964 3nhtbb.exe 2832 vvjdp.exe 1068 7frxflx.exe 1208 rxlfxfl.exe 2028 hnhtht.exe 1412 jjvpv.exe 316 vpvdj.exe 1580 llrfxlx.exe 2868 tthtnn.exe 540 7tbnhb.exe 2192 dvjpd.exe 2904 xrlxrxl.exe 1152 lrxrrlx.exe 1672 bhhntb.exe 1904 5jdjv.exe 1660 1vvvj.exe 788 rxffxrf.exe -
resource yara_rule behavioral1/memory/2888-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-25-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/2080-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1840-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/768-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/316-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1912-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/572-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1884-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1884-362-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2676-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1068-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-435-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-456-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-476-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-538-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-552-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1872-585-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-590-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-604-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-623-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-643-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-692-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/688-742-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/696-767-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-804-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-817-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2188-820-0x00000000002A0000-0x00000000002CA000-memory.dmp upx behavioral1/memory/2304-883-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-897-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-948-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-1086-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2788-1167-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrllxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frffllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ntttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlflxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frllxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxflrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2888 wrote to memory of 1720 2888 2fde290448a3b95a3e61387da7d09fde6ac701bcaf19ba4de1f9acf5eea455d6.exe 31 PID 2888 wrote to memory of 1720 2888 2fde290448a3b95a3e61387da7d09fde6ac701bcaf19ba4de1f9acf5eea455d6.exe 31 PID 2888 wrote to memory of 1720 2888 2fde290448a3b95a3e61387da7d09fde6ac701bcaf19ba4de1f9acf5eea455d6.exe 31 PID 2888 wrote to memory of 1720 2888 2fde290448a3b95a3e61387da7d09fde6ac701bcaf19ba4de1f9acf5eea455d6.exe 31 PID 1720 wrote to memory of 2080 1720 xlrllxf.exe 32 PID 1720 wrote to memory of 2080 1720 xlrllxf.exe 32 PID 1720 wrote to memory of 2080 1720 xlrllxf.exe 32 PID 1720 wrote to memory of 2080 1720 xlrllxf.exe 32 PID 2080 wrote to memory of 2252 2080 nhbhhn.exe 33 PID 2080 wrote to memory of 2252 2080 nhbhhn.exe 33 PID 2080 wrote to memory of 2252 2080 nhbhhn.exe 33 PID 2080 wrote to memory of 2252 2080 nhbhhn.exe 33 PID 2252 wrote to memory of 1840 2252 pvjdd.exe 34 PID 2252 wrote to memory of 1840 2252 pvjdd.exe 34 PID 2252 wrote to memory of 1840 2252 pvjdd.exe 34 PID 2252 wrote to memory of 1840 2252 pvjdd.exe 34 PID 1840 wrote to memory of 2744 1840 fxlxflr.exe 35 PID 1840 wrote to memory of 2744 1840 fxlxflr.exe 35 PID 1840 wrote to memory of 2744 1840 fxlxflr.exe 35 PID 1840 wrote to memory of 2744 1840 fxlxflr.exe 35 PID 2744 wrote to memory of 2800 2744 dvdvj.exe 36 PID 2744 wrote to memory of 2800 2744 dvdvj.exe 36 PID 2744 wrote to memory of 2800 2744 dvdvj.exe 36 PID 2744 wrote to memory of 2800 2744 dvdvj.exe 36 PID 2800 wrote to memory of 2092 2800 ntnhbt.exe 37 PID 2800 wrote to memory of 2092 2800 ntnhbt.exe 37 PID 2800 wrote to memory of 2092 2800 ntnhbt.exe 37 PID 2800 wrote to memory of 2092 2800 ntnhbt.exe 37 PID 2092 wrote to memory of 2628 2092 jdpvj.exe 38 PID 2092 wrote to memory of 2628 2092 jdpvj.exe 38 PID 2092 wrote to memory of 2628 2092 jdpvj.exe 38 PID 2092 wrote to memory of 2628 2092 jdpvj.exe 38 PID 2628 wrote to memory of 2652 2628 5rrrxxr.exe 39 PID 2628 wrote to memory of 2652 2628 5rrrxxr.exe 39 PID 2628 wrote to memory of 2652 2628 5rrrxxr.exe 39 PID 2628 wrote to memory of 2652 2628 5rrrxxr.exe 39 PID 2652 wrote to memory of 2584 2652 jdvvd.exe 40 PID 2652 wrote to memory of 2584 2652 jdvvd.exe 40 PID 2652 wrote to memory of 2584 2652 jdvvd.exe 40 PID 2652 wrote to memory of 2584 2652 jdvvd.exe 40 PID 2584 wrote to memory of 3004 2584 xlffflr.exe 41 PID 2584 wrote to memory of 3004 2584 xlffflr.exe 41 PID 2584 wrote to memory of 3004 2584 xlffflr.exe 41 PID 2584 wrote to memory of 3004 2584 xlffflr.exe 41 PID 3004 wrote to memory of 768 3004 bnhhtt.exe 42 PID 3004 wrote to memory of 768 3004 bnhhtt.exe 42 PID 3004 wrote to memory of 768 3004 bnhhtt.exe 42 PID 3004 wrote to memory of 768 3004 bnhhtt.exe 42 PID 768 wrote to memory of 2600 768 jjdvv.exe 43 PID 768 wrote to memory of 2600 768 jjdvv.exe 43 PID 768 wrote to memory of 2600 768 jjdvv.exe 43 PID 768 wrote to memory of 2600 768 jjdvv.exe 43 PID 2600 wrote to memory of 1736 2600 tnhnbb.exe 44 PID 2600 wrote to memory of 1736 2600 tnhnbb.exe 44 PID 2600 wrote to memory of 1736 2600 tnhnbb.exe 44 PID 2600 wrote to memory of 1736 2600 tnhnbb.exe 44 PID 1736 wrote to memory of 2296 1736 5pppv.exe 45 PID 1736 wrote to memory of 2296 1736 5pppv.exe 45 PID 1736 wrote to memory of 2296 1736 5pppv.exe 45 PID 1736 wrote to memory of 2296 1736 5pppv.exe 45 PID 2296 wrote to memory of 316 2296 xrlrffr.exe 46 PID 2296 wrote to memory of 316 2296 xrlrffr.exe 46 PID 2296 wrote to memory of 316 2296 xrlrffr.exe 46 PID 2296 wrote to memory of 316 2296 xrlrffr.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\2fde290448a3b95a3e61387da7d09fde6ac701bcaf19ba4de1f9acf5eea455d6.exe"C:\Users\Admin\AppData\Local\Temp\2fde290448a3b95a3e61387da7d09fde6ac701bcaf19ba4de1f9acf5eea455d6.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\xlrllxf.exec:\xlrllxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
\??\c:\nhbhhn.exec:\nhbhhn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\pvjdd.exec:\pvjdd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\fxlxflr.exec:\fxlxflr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
\??\c:\dvdvj.exec:\dvdvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\ntnhbt.exec:\ntnhbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\jdpvj.exec:\jdpvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\5rrrxxr.exec:\5rrrxxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\jdvvd.exec:\jdvvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\xlffflr.exec:\xlffflr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\bnhhtt.exec:\bnhhtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\jjdvv.exec:\jjdvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
\??\c:\tnhnbb.exec:\tnhnbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\5pppv.exec:\5pppv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\xrlrffr.exec:\xrlrffr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\hbhtht.exec:\hbhtht.exe17⤵
- Executes dropped EXE
PID:316 -
\??\c:\xrllxlr.exec:\xrllxlr.exe18⤵
- Executes dropped EXE
PID:1636 -
\??\c:\nnhtbb.exec:\nnhtbb.exe19⤵
- Executes dropped EXE
PID:1912 -
\??\c:\pdjpp.exec:\pdjpp.exe20⤵
- Executes dropped EXE
PID:2636 -
\??\c:\pdvdj.exec:\pdvdj.exe21⤵
- Executes dropped EXE
PID:1188 -
\??\c:\fxxxllx.exec:\fxxxllx.exe22⤵
- Executes dropped EXE
PID:840 -
\??\c:\7nbhnt.exec:\7nbhnt.exe23⤵
- Executes dropped EXE
PID:2052 -
\??\c:\dpjpp.exec:\dpjpp.exe24⤵
- Executes dropped EXE
PID:1660 -
\??\c:\fxrrxfx.exec:\fxrrxfx.exe25⤵
- Executes dropped EXE
PID:572 -
\??\c:\1nbbhn.exec:\1nbbhn.exe26⤵
- Executes dropped EXE
PID:2112 -
\??\c:\vvvvd.exec:\vvvvd.exe27⤵
- Executes dropped EXE
PID:2396 -
\??\c:\ntnhnt.exec:\ntnhnt.exe28⤵
- Executes dropped EXE
PID:2928 -
\??\c:\9btttt.exec:\9btttt.exe29⤵
- Executes dropped EXE
PID:2500 -
\??\c:\xxrfxlx.exec:\xxrfxlx.exe30⤵
- Executes dropped EXE
PID:2944 -
\??\c:\hhbnnt.exec:\hhbnnt.exe31⤵
- Executes dropped EXE
PID:1712 -
\??\c:\vvjpv.exec:\vvjpv.exe32⤵
- Executes dropped EXE
PID:2228 -
\??\c:\tntnbh.exec:\tntnbh.exe33⤵
- Executes dropped EXE
PID:276 -
\??\c:\dvdpp.exec:\dvdpp.exe34⤵
- Executes dropped EXE
PID:3040 -
\??\c:\3fxflrf.exec:\3fxflrf.exe35⤵
- Executes dropped EXE
PID:2288 -
\??\c:\llxflxf.exec:\llxflxf.exe36⤵
- Executes dropped EXE
PID:2348 -
\??\c:\tbnhht.exec:\tbnhht.exe37⤵
- Executes dropped EXE
PID:1632 -
\??\c:\3djpd.exec:\3djpd.exe38⤵
- Executes dropped EXE
PID:2812 -
\??\c:\xrllrrx.exec:\xrllrrx.exe39⤵
- Executes dropped EXE
PID:1884 -
\??\c:\9xflxfl.exec:\9xflxfl.exe40⤵
- Executes dropped EXE
PID:2748 -
\??\c:\5bbhnn.exec:\5bbhnn.exe41⤵
- Executes dropped EXE
PID:2696 -
\??\c:\ppdjp.exec:\ppdjp.exe42⤵
- Executes dropped EXE
PID:2820 -
\??\c:\lllllrx.exec:\lllllrx.exe43⤵
- Executes dropped EXE
PID:2236 -
\??\c:\lfrxllx.exec:\lfrxllx.exe44⤵
- Executes dropped EXE
PID:2676 -
\??\c:\hhbhnt.exec:\hhbhnt.exe45⤵
- Executes dropped EXE
PID:2540 -
\??\c:\9dvvv.exec:\9dvvv.exe46⤵
- Executes dropped EXE
PID:2572 -
\??\c:\rlxfffr.exec:\rlxfffr.exe47⤵
- Executes dropped EXE
PID:2584 -
\??\c:\1rllxfl.exec:\1rllxfl.exe48⤵
- Executes dropped EXE
PID:1560 -
\??\c:\3nhtbb.exec:\3nhtbb.exe49⤵
- Executes dropped EXE
PID:1964 -
\??\c:\vvjdp.exec:\vvjdp.exe50⤵
- Executes dropped EXE
PID:2832 -
\??\c:\7frxflx.exec:\7frxflx.exe51⤵
- Executes dropped EXE
PID:1068 -
\??\c:\rxlfxfl.exec:\rxlfxfl.exe52⤵
- Executes dropped EXE
PID:1208 -
\??\c:\hnhtht.exec:\hnhtht.exe53⤵
- Executes dropped EXE
PID:2028 -
\??\c:\jjvpv.exec:\jjvpv.exe54⤵
- Executes dropped EXE
PID:1412 -
\??\c:\vpvdj.exec:\vpvdj.exe55⤵
- Executes dropped EXE
PID:316 -
\??\c:\llrfxlx.exec:\llrfxlx.exe56⤵
- Executes dropped EXE
PID:1580 -
\??\c:\tthtnn.exec:\tthtnn.exe57⤵
- Executes dropped EXE
PID:2868 -
\??\c:\7tbnhb.exec:\7tbnhb.exe58⤵
- Executes dropped EXE
PID:540 -
\??\c:\dvjpd.exec:\dvjpd.exe59⤵
- Executes dropped EXE
PID:2192 -
\??\c:\xrlxrxl.exec:\xrlxrxl.exe60⤵
- Executes dropped EXE
PID:2904 -
\??\c:\lrxrrlx.exec:\lrxrrlx.exe61⤵
- Executes dropped EXE
PID:1152 -
\??\c:\bhhntb.exec:\bhhntb.exe62⤵
- Executes dropped EXE
PID:1672 -
\??\c:\5jdjv.exec:\5jdjv.exe63⤵
- Executes dropped EXE
PID:1904 -
\??\c:\1vvvj.exec:\1vvvj.exe64⤵
- Executes dropped EXE
PID:1660 -
\??\c:\rxffxrf.exec:\rxffxrf.exe65⤵
- Executes dropped EXE
PID:788 -
\??\c:\nhttbh.exec:\nhttbh.exe66⤵PID:1708
-
\??\c:\3bthtt.exec:\3bthtt.exe67⤵PID:1756
-
\??\c:\vvpdv.exec:\vvpdv.exe68⤵PID:2392
-
\??\c:\ffrrlrf.exec:\ffrrlrf.exe69⤵PID:2956
-
\??\c:\hbnntt.exec:\hbnntt.exe70⤵PID:2188
-
\??\c:\7btttt.exec:\7btttt.exe71⤵PID:2500
-
\??\c:\7ddjj.exec:\7ddjj.exe72⤵PID:2104
-
\??\c:\xrffrlx.exec:\xrffrlx.exe73⤵PID:2512
-
\??\c:\rxrxrrf.exec:\rxrxrrf.exe74⤵PID:1872
-
\??\c:\7tnbnb.exec:\7tnbnb.exe75⤵PID:1524
-
\??\c:\vvjvj.exec:\vvjvj.exe76⤵PID:1652
-
\??\c:\5dpjd.exec:\5dpjd.exe77⤵PID:1508
-
\??\c:\rlfflrf.exec:\rlfflrf.exe78⤵PID:2080
-
\??\c:\bnbbhb.exec:\bnbbhb.exe79⤵PID:2304
-
\??\c:\tnbbhn.exec:\tnbbhn.exe80⤵PID:2992
-
\??\c:\3pdpp.exec:\3pdpp.exe81⤵PID:2632
-
\??\c:\9fxrrrx.exec:\9fxrrrx.exe82⤵PID:2768
-
\??\c:\nhtnnt.exec:\nhtnnt.exe83⤵PID:2748
-
\??\c:\tntbnn.exec:\tntbnn.exe84⤵PID:2800
-
\??\c:\7pjjp.exec:\7pjjp.exe85⤵
- System Location Discovery: System Language Discovery
PID:2720 -
\??\c:\rlfffxx.exec:\rlfffxx.exe86⤵PID:2908
-
\??\c:\hhbhtb.exec:\hhbhtb.exe87⤵PID:2552
-
\??\c:\nbbbbh.exec:\nbbbbh.exe88⤵PID:2652
-
\??\c:\vvpvp.exec:\vvpvp.exe89⤵PID:2592
-
\??\c:\xrflrrl.exec:\xrflrrl.exe90⤵PID:484
-
\??\c:\tntttt.exec:\tntttt.exe91⤵PID:324
-
\??\c:\tntntt.exec:\tntntt.exe92⤵PID:768
-
\??\c:\pdpvd.exec:\pdpvd.exe93⤵PID:2640
-
\??\c:\1djjv.exec:\1djjv.exe94⤵PID:1620
-
\??\c:\xlxflff.exec:\xlxflff.exe95⤵PID:1932
-
\??\c:\fxlrrlr.exec:\fxlrrlr.exe96⤵PID:2284
-
\??\c:\9htthh.exec:\9htthh.exe97⤵PID:2852
-
\??\c:\pjvdd.exec:\pjvdd.exe98⤵PID:2064
-
\??\c:\rlrxllx.exec:\rlrxllx.exe99⤵PID:2088
-
\??\c:\lflrffl.exec:\lflrffl.exe100⤵PID:1580
-
\??\c:\1bhntt.exec:\1bhntt.exe101⤵PID:2868
-
\??\c:\nnhthn.exec:\nnhthn.exe102⤵PID:688
-
\??\c:\7jdjv.exec:\7jdjv.exe103⤵PID:2192
-
\??\c:\lfxxflx.exec:\lfxxflx.exe104⤵PID:2904
-
\??\c:\bntbbn.exec:\bntbbn.exe105⤵PID:696
-
\??\c:\bhhnhn.exec:\bhhnhn.exe106⤵PID:2052
-
\??\c:\dvpjp.exec:\dvpjp.exe107⤵PID:340
-
\??\c:\rlxrxxf.exec:\rlxrxxf.exe108⤵PID:916
-
\??\c:\fxffrrr.exec:\fxffrrr.exe109⤵PID:1800
-
\??\c:\tnhntt.exec:\tnhntt.exe110⤵PID:704
-
\??\c:\dvpdp.exec:\dvpdp.exe111⤵PID:2384
-
\??\c:\1fxrxxx.exec:\1fxrxxx.exe112⤵PID:2960
-
\??\c:\xrffflx.exec:\xrffflx.exe113⤵PID:1716
-
\??\c:\nhbhtt.exec:\nhbhtt.exe114⤵PID:2188
-
\??\c:\pjjdv.exec:\pjjdv.exe115⤵PID:2268
-
\??\c:\3dvvj.exec:\3dvvj.exe116⤵PID:2056
-
\??\c:\fxrrrxl.exec:\fxrrrxl.exe117⤵PID:2040
-
\??\c:\9nhthn.exec:\9nhthn.exe118⤵PID:2200
-
\??\c:\bhbbnb.exec:\bhbbnb.exe119⤵PID:780
-
\??\c:\pvpvp.exec:\pvpvp.exe120⤵PID:2300
-
\??\c:\5rxlxrx.exec:\5rxlxrx.exe121⤵PID:3040
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-