Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-12-2024 23:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8d677f84c71cbf1839acb4e52cf6b61d3b507d83df7868b190be3be96f8f5e6f.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
8d677f84c71cbf1839acb4e52cf6b61d3b507d83df7868b190be3be96f8f5e6f.exe
-
Size
456KB
-
MD5
80dc06011ccb2447decac408b3b2188b
-
SHA1
333a757200d292c88a4ef7c679717d8839f5b8e0
-
SHA256
8d677f84c71cbf1839acb4e52cf6b61d3b507d83df7868b190be3be96f8f5e6f
-
SHA512
3b615edf9e2fdd6a24912bbdb808d1d699734cbe500fed4e664dd7de29d5d4bfafc7ae2c5ae9cd491889b09581b893c59ad9a356ae4a712724648b2bc8ac7c3d
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeR1:q7Tc2NYHUrAwfMp3CDR1
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/1796-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2452-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2444-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-43-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2996-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-80-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2568-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1488-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1612-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2436-153-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2436-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1736-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/408-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2496-224-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2512-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1908-321-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2476-334-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2476-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2148-375-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1696-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/976-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1100-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-403-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1952-474-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/892-481-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1476-513-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1144-519-0x00000000001C0000-0x00000000001EA000-memory.dmp family_blackmoon behavioral1/memory/880-527-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1332-534-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-602-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2848-609-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1848-658-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1416-689-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1048-731-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2916-1210-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2072-1213-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1276-1301-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1276-1299-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2732-1368-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2452 tnbtnt.exe 2444 1pppj.exe 2728 rrlxrrx.exe 2684 pjpdd.exe 3000 1frxlrl.exe 2996 1pjpv.exe 2576 rlflxxl.exe 2604 5fxxfrx.exe 2568 1hhthn.exe 2592 vvjvj.exe 1488 fxxfrrx.exe 1100 vdjvd.exe 1612 tbhbhb.exe 2796 5hhhnt.exe 1764 1nhhbh.exe 2436 3djjv.exe 1736 fflxrxl.exe 2956 dpvvd.exe 2960 xxrfrxf.exe 2196 htnhnh.exe 2964 7xrflrx.exe 408 hbthtn.exe 1084 ffrfxfx.exe 2496 hhtthh.exe 672 7jvjv.exe 316 lxrlxlr.exe 2424 1pdjj.exe 1472 ffrxfrx.exe 1044 vvjjv.exe 2256 lfxrxfr.exe 2512 jjvjv.exe 1548 3ppdj.exe 1536 ttnthn.exe 2164 3jjdp.exe 2728 lrlxlxl.exe 1908 nnhbnb.exe 2676 hnhtnt.exe 2476 ppjvv.exe 2888 rlxrrrx.exe 2688 nhbhbt.exe 2720 jvddj.exe 2580 5vjpv.exe 2404 1xxfrxl.exe 2148 nnhthn.exe 1696 1pjpj.exe 976 pjvvd.exe 1100 flfrflx.exe 2616 tbtnbh.exe 1668 vvpvj.exe 2648 5lrxfrf.exe 608 hnhnth.exe 2436 jppvj.exe 2924 7ppvp.exe 2968 rlflxxl.exe 3052 hthhhh.exe 2168 vppvp.exe 1772 vvpjp.exe 1636 ffflffl.exe 1952 btnbnb.exe 892 djdpp.exe 812 fxrfxfr.exe 688 hnnnhn.exe 2936 1bbhbn.exe 3056 pjpvd.exe -
resource yara_rule behavioral1/memory/1796-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-43-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/2996-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1488-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/408-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/316-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-321-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2476-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/976-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1100-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/892-481-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1476-513-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/880-527-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1332-534-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1156-547-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-609-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1848-658-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1416-689-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1048-731-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/2784-834-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-847-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-903-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/372-990-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1588-1003-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1840-1154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1276-1299-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2884-1325-0x0000000000220000-0x000000000024A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflxfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbhbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlxflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlxfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xrlrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8d677f84c71cbf1839acb4e52cf6b61d3b507d83df7868b190be3be96f8f5e6f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxfxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1796 wrote to memory of 2452 1796 8d677f84c71cbf1839acb4e52cf6b61d3b507d83df7868b190be3be96f8f5e6f.exe 31 PID 1796 wrote to memory of 2452 1796 8d677f84c71cbf1839acb4e52cf6b61d3b507d83df7868b190be3be96f8f5e6f.exe 31 PID 1796 wrote to memory of 2452 1796 8d677f84c71cbf1839acb4e52cf6b61d3b507d83df7868b190be3be96f8f5e6f.exe 31 PID 1796 wrote to memory of 2452 1796 8d677f84c71cbf1839acb4e52cf6b61d3b507d83df7868b190be3be96f8f5e6f.exe 31 PID 2452 wrote to memory of 2444 2452 tnbtnt.exe 32 PID 2452 wrote to memory of 2444 2452 tnbtnt.exe 32 PID 2452 wrote to memory of 2444 2452 tnbtnt.exe 32 PID 2452 wrote to memory of 2444 2452 tnbtnt.exe 32 PID 2444 wrote to memory of 2728 2444 1pppj.exe 33 PID 2444 wrote to memory of 2728 2444 1pppj.exe 33 PID 2444 wrote to memory of 2728 2444 1pppj.exe 33 PID 2444 wrote to memory of 2728 2444 1pppj.exe 33 PID 2728 wrote to memory of 2684 2728 rrlxrrx.exe 34 PID 2728 wrote to memory of 2684 2728 rrlxrrx.exe 34 PID 2728 wrote to memory of 2684 2728 rrlxrrx.exe 34 PID 2728 wrote to memory of 2684 2728 rrlxrrx.exe 34 PID 2684 wrote to memory of 3000 2684 pjpdd.exe 35 PID 2684 wrote to memory of 3000 2684 pjpdd.exe 35 PID 2684 wrote to memory of 3000 2684 pjpdd.exe 35 PID 2684 wrote to memory of 3000 2684 pjpdd.exe 35 PID 3000 wrote to memory of 2996 3000 1frxlrl.exe 36 PID 3000 wrote to memory of 2996 3000 1frxlrl.exe 36 PID 3000 wrote to memory of 2996 3000 1frxlrl.exe 36 PID 3000 wrote to memory of 2996 3000 1frxlrl.exe 36 PID 2996 wrote to memory of 2576 2996 1pjpv.exe 37 PID 2996 wrote to memory of 2576 2996 1pjpv.exe 37 PID 2996 wrote to memory of 2576 2996 1pjpv.exe 37 PID 2996 wrote to memory of 2576 2996 1pjpv.exe 37 PID 2576 wrote to memory of 2604 2576 rlflxxl.exe 38 PID 2576 wrote to memory of 2604 2576 rlflxxl.exe 38 PID 2576 wrote to memory of 2604 2576 rlflxxl.exe 38 PID 2576 wrote to memory of 2604 2576 rlflxxl.exe 38 PID 2604 wrote to memory of 2568 2604 5fxxfrx.exe 39 PID 2604 wrote to memory of 2568 2604 5fxxfrx.exe 39 PID 2604 wrote to memory of 2568 2604 5fxxfrx.exe 39 PID 2604 wrote to memory of 2568 2604 5fxxfrx.exe 39 PID 2568 wrote to memory of 2592 2568 1hhthn.exe 40 PID 2568 wrote to memory of 2592 2568 1hhthn.exe 40 PID 2568 wrote to memory of 2592 2568 1hhthn.exe 40 PID 2568 wrote to memory of 2592 2568 1hhthn.exe 40 PID 2592 wrote to memory of 1488 2592 vvjvj.exe 41 PID 2592 wrote to memory of 1488 2592 vvjvj.exe 41 PID 2592 wrote to memory of 1488 2592 vvjvj.exe 41 PID 2592 wrote to memory of 1488 2592 vvjvj.exe 41 PID 1488 wrote to memory of 1100 1488 fxxfrrx.exe 42 PID 1488 wrote to memory of 1100 1488 fxxfrrx.exe 42 PID 1488 wrote to memory of 1100 1488 fxxfrrx.exe 42 PID 1488 wrote to memory of 1100 1488 fxxfrrx.exe 42 PID 1100 wrote to memory of 1612 1100 vdjvd.exe 43 PID 1100 wrote to memory of 1612 1100 vdjvd.exe 43 PID 1100 wrote to memory of 1612 1100 vdjvd.exe 43 PID 1100 wrote to memory of 1612 1100 vdjvd.exe 43 PID 1612 wrote to memory of 2796 1612 tbhbhb.exe 44 PID 1612 wrote to memory of 2796 1612 tbhbhb.exe 44 PID 1612 wrote to memory of 2796 1612 tbhbhb.exe 44 PID 1612 wrote to memory of 2796 1612 tbhbhb.exe 44 PID 2796 wrote to memory of 1764 2796 5hhhnt.exe 45 PID 2796 wrote to memory of 1764 2796 5hhhnt.exe 45 PID 2796 wrote to memory of 1764 2796 5hhhnt.exe 45 PID 2796 wrote to memory of 1764 2796 5hhhnt.exe 45 PID 1764 wrote to memory of 2436 1764 1nhhbh.exe 46 PID 1764 wrote to memory of 2436 1764 1nhhbh.exe 46 PID 1764 wrote to memory of 2436 1764 1nhhbh.exe 46 PID 1764 wrote to memory of 2436 1764 1nhhbh.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d677f84c71cbf1839acb4e52cf6b61d3b507d83df7868b190be3be96f8f5e6f.exe"C:\Users\Admin\AppData\Local\Temp\8d677f84c71cbf1839acb4e52cf6b61d3b507d83df7868b190be3be96f8f5e6f.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\tnbtnt.exec:\tnbtnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\1pppj.exec:\1pppj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\rrlxrrx.exec:\rrlxrrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\pjpdd.exec:\pjpdd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\1frxlrl.exec:\1frxlrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\1pjpv.exec:\1pjpv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\rlflxxl.exec:\rlflxxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\5fxxfrx.exec:\5fxxfrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\1hhthn.exec:\1hhthn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\vvjvj.exec:\vvjvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\fxxfrrx.exec:\fxxfrrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\vdjvd.exec:\vdjvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
\??\c:\tbhbhb.exec:\tbhbhb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\5hhhnt.exec:\5hhhnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\1nhhbh.exec:\1nhhbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\3djjv.exec:\3djjv.exe17⤵
- Executes dropped EXE
PID:2436 -
\??\c:\fflxrxl.exec:\fflxrxl.exe18⤵
- Executes dropped EXE
PID:1736 -
\??\c:\dpvvd.exec:\dpvvd.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2956 -
\??\c:\xxrfrxf.exec:\xxrfrxf.exe20⤵
- Executes dropped EXE
PID:2960 -
\??\c:\htnhnh.exec:\htnhnh.exe21⤵
- Executes dropped EXE
PID:2196 -
\??\c:\7xrflrx.exec:\7xrflrx.exe22⤵
- Executes dropped EXE
PID:2964 -
\??\c:\hbthtn.exec:\hbthtn.exe23⤵
- Executes dropped EXE
PID:408 -
\??\c:\ffrfxfx.exec:\ffrfxfx.exe24⤵
- Executes dropped EXE
PID:1084 -
\??\c:\hhtthh.exec:\hhtthh.exe25⤵
- Executes dropped EXE
PID:2496 -
\??\c:\7jvjv.exec:\7jvjv.exe26⤵
- Executes dropped EXE
PID:672 -
\??\c:\lxrlxlr.exec:\lxrlxlr.exe27⤵
- Executes dropped EXE
PID:316 -
\??\c:\1pdjj.exec:\1pdjj.exe28⤵
- Executes dropped EXE
PID:2424 -
\??\c:\ffrxfrx.exec:\ffrxfrx.exe29⤵
- Executes dropped EXE
PID:1472 -
\??\c:\vvjjv.exec:\vvjjv.exe30⤵
- Executes dropped EXE
PID:1044 -
\??\c:\lfxrxfr.exec:\lfxrxfr.exe31⤵
- Executes dropped EXE
PID:2256 -
\??\c:\jjvjv.exec:\jjvjv.exe32⤵
- Executes dropped EXE
PID:2512 -
\??\c:\3ppdj.exec:\3ppdj.exe33⤵
- Executes dropped EXE
PID:1548 -
\??\c:\ttnthn.exec:\ttnthn.exe34⤵
- Executes dropped EXE
PID:1536 -
\??\c:\3jjdp.exec:\3jjdp.exe35⤵
- Executes dropped EXE
PID:2164 -
\??\c:\lrlxlxl.exec:\lrlxlxl.exe36⤵
- Executes dropped EXE
PID:2728 -
\??\c:\nnhbnb.exec:\nnhbnb.exe37⤵
- Executes dropped EXE
PID:1908 -
\??\c:\hnhtnt.exec:\hnhtnt.exe38⤵
- Executes dropped EXE
PID:2676 -
\??\c:\ppjvv.exec:\ppjvv.exe39⤵
- Executes dropped EXE
PID:2476 -
\??\c:\rlxrrrx.exec:\rlxrrrx.exe40⤵
- Executes dropped EXE
PID:2888 -
\??\c:\nhbhbt.exec:\nhbhbt.exe41⤵
- Executes dropped EXE
PID:2688 -
\??\c:\jvddj.exec:\jvddj.exe42⤵
- Executes dropped EXE
PID:2720 -
\??\c:\5vjpv.exec:\5vjpv.exe43⤵
- Executes dropped EXE
PID:2580 -
\??\c:\1xxfrxl.exec:\1xxfrxl.exe44⤵
- Executes dropped EXE
PID:2404 -
\??\c:\nnhthn.exec:\nnhthn.exe45⤵
- Executes dropped EXE
PID:2148 -
\??\c:\1pjpj.exec:\1pjpj.exe46⤵
- Executes dropped EXE
PID:1696 -
\??\c:\pjvvd.exec:\pjvvd.exe47⤵
- Executes dropped EXE
PID:976 -
\??\c:\flfrflx.exec:\flfrflx.exe48⤵
- Executes dropped EXE
PID:1100 -
\??\c:\tbtnbh.exec:\tbtnbh.exe49⤵
- Executes dropped EXE
PID:2616 -
\??\c:\vvpvj.exec:\vvpvj.exe50⤵
- Executes dropped EXE
PID:1668 -
\??\c:\5lrxfrf.exec:\5lrxfrf.exe51⤵
- Executes dropped EXE
PID:2648 -
\??\c:\hnhnth.exec:\hnhnth.exe52⤵
- Executes dropped EXE
PID:608 -
\??\c:\jppvj.exec:\jppvj.exe53⤵
- Executes dropped EXE
PID:2436 -
\??\c:\7ppvp.exec:\7ppvp.exe54⤵
- Executes dropped EXE
PID:2924 -
\??\c:\rlflxxl.exec:\rlflxxl.exe55⤵
- Executes dropped EXE
PID:2968 -
\??\c:\hthhhh.exec:\hthhhh.exe56⤵
- Executes dropped EXE
PID:3052 -
\??\c:\vppvp.exec:\vppvp.exe57⤵
- Executes dropped EXE
PID:2168 -
\??\c:\vvpjp.exec:\vvpjp.exe58⤵
- Executes dropped EXE
PID:1772 -
\??\c:\ffflffl.exec:\ffflffl.exe59⤵
- Executes dropped EXE
PID:1636 -
\??\c:\btnbnb.exec:\btnbnb.exe60⤵
- Executes dropped EXE
PID:1952 -
\??\c:\djdpp.exec:\djdpp.exe61⤵
- Executes dropped EXE
PID:892 -
\??\c:\fxrfxfr.exec:\fxrfxfr.exe62⤵
- Executes dropped EXE
PID:812 -
\??\c:\hnnnhn.exec:\hnnnhn.exe63⤵
- Executes dropped EXE
PID:688 -
\??\c:\1bbhbn.exec:\1bbhbn.exe64⤵
- Executes dropped EXE
PID:2936 -
\??\c:\pjpvd.exec:\pjpvd.exe65⤵
- Executes dropped EXE
PID:3056 -
\??\c:\1rrrxfr.exec:\1rrrxfr.exe66⤵PID:1476
-
\??\c:\fffrlxr.exec:\fffrlxr.exe67⤵PID:1144
-
\??\c:\7tntnt.exec:\7tntnt.exe68⤵PID:880
-
\??\c:\jjjpj.exec:\jjjpj.exe69⤵PID:1332
-
\??\c:\xxxlflf.exec:\xxxlflf.exe70⤵PID:2268
-
\??\c:\ntntnn.exec:\ntntnn.exe71⤵PID:2456
-
\??\c:\7tnntb.exec:\7tnntb.exe72⤵PID:1156
-
\??\c:\dpjdp.exec:\dpjdp.exe73⤵PID:1548
-
\??\c:\ffflxxl.exec:\ffflxxl.exe74⤵PID:2276
-
\??\c:\bttttt.exec:\bttttt.exe75⤵PID:1928
-
\??\c:\hhbthn.exec:\hhbthn.exe76⤵PID:2788
-
\??\c:\5jvjv.exec:\5jvjv.exe77⤵PID:2864
-
\??\c:\lxrlffx.exec:\lxrlffx.exe78⤵PID:2828
-
\??\c:\5hbbnn.exec:\5hbbnn.exe79⤵PID:2672
-
\??\c:\nttbnt.exec:\nttbnt.exe80⤵PID:2740
-
\??\c:\vpdjp.exec:\vpdjp.exe81⤵PID:2848
-
\??\c:\1rfxxlr.exec:\1rfxxlr.exe82⤵PID:2688
-
\??\c:\flfrfrf.exec:\flfrfrf.exe83⤵PID:2612
-
\??\c:\bbbhth.exec:\bbbhth.exe84⤵PID:2132
-
\??\c:\7vpdj.exec:\7vpdj.exe85⤵PID:380
-
\??\c:\3rrrxlr.exec:\3rrrxlr.exe86⤵PID:2148
-
\??\c:\5rlxlrf.exec:\5rlxlrf.exe87⤵PID:2768
-
\??\c:\3tbnhb.exec:\3tbnhb.exe88⤵PID:2296
-
\??\c:\jvdjd.exec:\jvdjd.exe89⤵PID:1848
-
\??\c:\rrrllxx.exec:\rrrllxx.exe90⤵PID:1784
-
\??\c:\xfrxxxr.exec:\xfrxxxr.exe91⤵PID:2744
-
\??\c:\bhbnbh.exec:\bhbnbh.exe92⤵PID:1664
-
\??\c:\jjvjv.exec:\jjvjv.exe93⤵PID:1740
-
\??\c:\lxxffrr.exec:\lxxffrr.exe94⤵PID:1416
-
\??\c:\rlllfrl.exec:\rlllfrl.exe95⤵PID:1736
-
\??\c:\5nnntb.exec:\5nnntb.exe96⤵PID:2984
-
\??\c:\3dvjp.exec:\3dvjp.exe97⤵PID:2904
-
\??\c:\lfrrffr.exec:\lfrrffr.exe98⤵PID:3068
-
\??\c:\btbtbb.exec:\btbtbb.exe99⤵PID:2168
-
\??\c:\3hhnhn.exec:\3hhnhn.exe100⤵PID:1772
-
\??\c:\jjjdp.exec:\jjjdp.exe101⤵PID:1048
-
\??\c:\rlxlxfx.exec:\rlxlxfx.exe102⤵PID:1952
-
\??\c:\ffxlrxr.exec:\ffxlrxr.exe103⤵PID:892
-
\??\c:\pvdjj.exec:\pvdjj.exe104⤵PID:812
-
\??\c:\jdvdp.exec:\jdvdp.exe105⤵PID:2496
-
\??\c:\fllxfxl.exec:\fllxfxl.exe106⤵PID:3036
-
\??\c:\nthttt.exec:\nthttt.exe107⤵PID:2992
-
\??\c:\jpjjv.exec:\jpjjv.exe108⤵PID:316
-
\??\c:\vpppd.exec:\vpppd.exe109⤵PID:3004
-
\??\c:\fxrfrfr.exec:\fxrfrfr.exe110⤵PID:288
-
\??\c:\ntnthh.exec:\ntnthh.exe111⤵PID:876
-
\??\c:\pppdp.exec:\pppdp.exe112⤵PID:2356
-
\??\c:\ppjjj.exec:\ppjjj.exe113⤵PID:2468
-
\??\c:\fffxfrl.exec:\fffxfrl.exe114⤵PID:1568
-
\??\c:\1hbhth.exec:\1hbhth.exe115⤵PID:1156
-
\??\c:\jpvpj.exec:\jpvpj.exe116⤵PID:1548
-
\??\c:\1vpvd.exec:\1vpvd.exe117⤵PID:2292
-
\??\c:\xfflxfx.exec:\xfflxfx.exe118⤵PID:2396
-
\??\c:\hhhnhn.exec:\hhhnhn.exe119⤵PID:2784
-
\??\c:\pvpdp.exec:\pvpdp.exe120⤵PID:2708
-
\??\c:\fllflfr.exec:\fllflfr.exe121⤵PID:2584
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-