Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-12-2024 00:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
86b75aa205cc9a8b086dc79d9d76f08260fbec4daceaf8245f274f46c6545a15.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
86b75aa205cc9a8b086dc79d9d76f08260fbec4daceaf8245f274f46c6545a15.exe
-
Size
456KB
-
MD5
abc45e7e40bded452877935ebac8a4f0
-
SHA1
777244ab61d2fcb45f499325cc8e615aafe55560
-
SHA256
86b75aa205cc9a8b086dc79d9d76f08260fbec4daceaf8245f274f46c6545a15
-
SHA512
bbda582bbaff8c3fa546bebaff30223bc84b8539104c40b53bd91fd31f346c04c6f89048c4e991aa9eee9a19dd03d8766b6a775b5b52aa301d15e18cd87138c4
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRl:q7Tc2NYHUrAwfMp3CDRl
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2616-0-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-24-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2748-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-44-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2684-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2516-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2160-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1992-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-130-0x0000000001C50000-0x0000000001C7A000-memory.dmp family_blackmoon behavioral1/memory/684-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1100-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-178-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2180-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1108-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/408-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1632-226-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1632-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/700-235-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/700-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2352-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2056-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1704-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1640-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-321-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2712-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-385-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/784-422-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1256-459-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2148-460-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-473-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/1200-495-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/660-569-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-596-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2228 1bntnh.exe 2748 vjjdd.exe 2764 btbbhb.exe 2684 fflfffl.exe 2660 nbnnhh.exe 2516 1pddv.exe 2644 flfrxfl.exe 2992 bnhbbt.exe 3016 1ppdv.exe 2160 lxfxxxf.exe 1992 5jvpp.exe 1440 3frrxrr.exe 2816 nbnnnn.exe 684 vvpjj.exe 2960 5rxrrff.exe 1100 hntntn.exe 1920 xrxffxl.exe 1108 nnbbhb.exe 2180 1jpjp.exe 2904 1vjdv.exe 408 nhnhht.exe 2304 dvvdd.exe 1632 9fxlrlr.exe 700 pjpdd.exe 2352 xlxflll.exe 1792 btbbbt.exe 1492 9frlllr.exe 2056 bnbttn.exe 1704 jvpdd.exe 1028 9rfxrlr.exe 2672 dvdvv.exe 1640 dpppv.exe 2716 xflllxf.exe 2712 3ntnnh.exe 2764 dvddv.exe 2688 jdjjj.exe 2744 lfffxxx.exe 2772 hnnbbt.exe 2980 vdjdd.exe 1820 lxfxrrr.exe 2144 7lxffff.exe 3012 nthbtb.exe 2200 dpppj.exe 2488 rflffrr.exe 1980 3lxllfl.exe 1740 nbhhnn.exe 1660 vjppp.exe 2592 3vdpv.exe 784 3lrlrll.exe 2412 thbttt.exe 2004 3ppvp.exe 2624 jddvv.exe 1920 lxrrlxx.exe 1256 7frrrlf.exe 2148 7htntn.exe 2944 djpjj.exe 2916 lrxxfxx.exe 2080 7thbbt.exe 1200 hntntn.exe 1876 7vpdv.exe 968 9frllll.exe 3056 xrxrllf.exe 1544 9nthtn.exe 2184 dppjp.exe -
resource yara_rule behavioral1/memory/2616-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1992-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/684-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1100-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1108-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/408-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/700-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1640-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-413-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/784-422-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2004-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1256-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1200-495-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-511-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-542-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-556-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/660-569-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-596-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-661-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-674-0x00000000001B0000-0x00000000001DA000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rxrxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xfxrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2616 wrote to memory of 2228 2616 86b75aa205cc9a8b086dc79d9d76f08260fbec4daceaf8245f274f46c6545a15.exe 30 PID 2616 wrote to memory of 2228 2616 86b75aa205cc9a8b086dc79d9d76f08260fbec4daceaf8245f274f46c6545a15.exe 30 PID 2616 wrote to memory of 2228 2616 86b75aa205cc9a8b086dc79d9d76f08260fbec4daceaf8245f274f46c6545a15.exe 30 PID 2616 wrote to memory of 2228 2616 86b75aa205cc9a8b086dc79d9d76f08260fbec4daceaf8245f274f46c6545a15.exe 30 PID 2228 wrote to memory of 2748 2228 1bntnh.exe 31 PID 2228 wrote to memory of 2748 2228 1bntnh.exe 31 PID 2228 wrote to memory of 2748 2228 1bntnh.exe 31 PID 2228 wrote to memory of 2748 2228 1bntnh.exe 31 PID 2748 wrote to memory of 2764 2748 vjjdd.exe 32 PID 2748 wrote to memory of 2764 2748 vjjdd.exe 32 PID 2748 wrote to memory of 2764 2748 vjjdd.exe 32 PID 2748 wrote to memory of 2764 2748 vjjdd.exe 32 PID 2764 wrote to memory of 2684 2764 btbbhb.exe 33 PID 2764 wrote to memory of 2684 2764 btbbhb.exe 33 PID 2764 wrote to memory of 2684 2764 btbbhb.exe 33 PID 2764 wrote to memory of 2684 2764 btbbhb.exe 33 PID 2684 wrote to memory of 2660 2684 fflfffl.exe 34 PID 2684 wrote to memory of 2660 2684 fflfffl.exe 34 PID 2684 wrote to memory of 2660 2684 fflfffl.exe 34 PID 2684 wrote to memory of 2660 2684 fflfffl.exe 34 PID 2660 wrote to memory of 2516 2660 nbnnhh.exe 35 PID 2660 wrote to memory of 2516 2660 nbnnhh.exe 35 PID 2660 wrote to memory of 2516 2660 nbnnhh.exe 35 PID 2660 wrote to memory of 2516 2660 nbnnhh.exe 35 PID 2516 wrote to memory of 2644 2516 1pddv.exe 36 PID 2516 wrote to memory of 2644 2516 1pddv.exe 36 PID 2516 wrote to memory of 2644 2516 1pddv.exe 36 PID 2516 wrote to memory of 2644 2516 1pddv.exe 36 PID 2644 wrote to memory of 2992 2644 flfrxfl.exe 37 PID 2644 wrote to memory of 2992 2644 flfrxfl.exe 37 PID 2644 wrote to memory of 2992 2644 flfrxfl.exe 37 PID 2644 wrote to memory of 2992 2644 flfrxfl.exe 37 PID 2992 wrote to memory of 3016 2992 bnhbbt.exe 38 PID 2992 wrote to memory of 3016 2992 bnhbbt.exe 38 PID 2992 wrote to memory of 3016 2992 bnhbbt.exe 38 PID 2992 wrote to memory of 3016 2992 bnhbbt.exe 38 PID 3016 wrote to memory of 2160 3016 1ppdv.exe 39 PID 3016 wrote to memory of 2160 3016 1ppdv.exe 39 PID 3016 wrote to memory of 2160 3016 1ppdv.exe 39 PID 3016 wrote to memory of 2160 3016 1ppdv.exe 39 PID 2160 wrote to memory of 1992 2160 lxfxxxf.exe 40 PID 2160 wrote to memory of 1992 2160 lxfxxxf.exe 40 PID 2160 wrote to memory of 1992 2160 lxfxxxf.exe 40 PID 2160 wrote to memory of 1992 2160 lxfxxxf.exe 40 PID 1992 wrote to memory of 1440 1992 5jvpp.exe 41 PID 1992 wrote to memory of 1440 1992 5jvpp.exe 41 PID 1992 wrote to memory of 1440 1992 5jvpp.exe 41 PID 1992 wrote to memory of 1440 1992 5jvpp.exe 41 PID 1440 wrote to memory of 2816 1440 3frrxrr.exe 42 PID 1440 wrote to memory of 2816 1440 3frrxrr.exe 42 PID 1440 wrote to memory of 2816 1440 3frrxrr.exe 42 PID 1440 wrote to memory of 2816 1440 3frrxrr.exe 42 PID 2816 wrote to memory of 684 2816 nbnnnn.exe 43 PID 2816 wrote to memory of 684 2816 nbnnnn.exe 43 PID 2816 wrote to memory of 684 2816 nbnnnn.exe 43 PID 2816 wrote to memory of 684 2816 nbnnnn.exe 43 PID 684 wrote to memory of 2960 684 vvpjj.exe 44 PID 684 wrote to memory of 2960 684 vvpjj.exe 44 PID 684 wrote to memory of 2960 684 vvpjj.exe 44 PID 684 wrote to memory of 2960 684 vvpjj.exe 44 PID 2960 wrote to memory of 1100 2960 5rxrrff.exe 45 PID 2960 wrote to memory of 1100 2960 5rxrrff.exe 45 PID 2960 wrote to memory of 1100 2960 5rxrrff.exe 45 PID 2960 wrote to memory of 1100 2960 5rxrrff.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\86b75aa205cc9a8b086dc79d9d76f08260fbec4daceaf8245f274f46c6545a15.exe"C:\Users\Admin\AppData\Local\Temp\86b75aa205cc9a8b086dc79d9d76f08260fbec4daceaf8245f274f46c6545a15.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\1bntnh.exec:\1bntnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\vjjdd.exec:\vjjdd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\btbbhb.exec:\btbbhb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\fflfffl.exec:\fflfffl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\nbnnhh.exec:\nbnnhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\1pddv.exec:\1pddv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\flfrxfl.exec:\flfrxfl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\bnhbbt.exec:\bnhbbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\1ppdv.exec:\1ppdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\lxfxxxf.exec:\lxfxxxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\5jvpp.exec:\5jvpp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\3frrxrr.exec:\3frrxrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
\??\c:\nbnnnn.exec:\nbnnnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\vvpjj.exec:\vvpjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
\??\c:\5rxrrff.exec:\5rxrrff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\hntntn.exec:\hntntn.exe17⤵
- Executes dropped EXE
PID:1100 -
\??\c:\xrxffxl.exec:\xrxffxl.exe18⤵
- Executes dropped EXE
PID:1920 -
\??\c:\nnbbhb.exec:\nnbbhb.exe19⤵
- Executes dropped EXE
PID:1108 -
\??\c:\1jpjp.exec:\1jpjp.exe20⤵
- Executes dropped EXE
PID:2180 -
\??\c:\1vjdv.exec:\1vjdv.exe21⤵
- Executes dropped EXE
PID:2904 -
\??\c:\nhnhht.exec:\nhnhht.exe22⤵
- Executes dropped EXE
PID:408 -
\??\c:\dvvdd.exec:\dvvdd.exe23⤵
- Executes dropped EXE
PID:2304 -
\??\c:\9fxlrlr.exec:\9fxlrlr.exe24⤵
- Executes dropped EXE
PID:1632 -
\??\c:\pjpdd.exec:\pjpdd.exe25⤵
- Executes dropped EXE
PID:700 -
\??\c:\xlxflll.exec:\xlxflll.exe26⤵
- Executes dropped EXE
PID:2352 -
\??\c:\btbbbt.exec:\btbbbt.exe27⤵
- Executes dropped EXE
PID:1792 -
\??\c:\9frlllr.exec:\9frlllr.exe28⤵
- Executes dropped EXE
PID:1492 -
\??\c:\bnbttn.exec:\bnbttn.exe29⤵
- Executes dropped EXE
PID:2056 -
\??\c:\jvpdd.exec:\jvpdd.exe30⤵
- Executes dropped EXE
PID:1704 -
\??\c:\9rfxrlr.exec:\9rfxrlr.exe31⤵
- Executes dropped EXE
PID:1028 -
\??\c:\dvdvv.exec:\dvdvv.exe32⤵
- Executes dropped EXE
PID:2672 -
\??\c:\dpppv.exec:\dpppv.exe33⤵
- Executes dropped EXE
PID:1640 -
\??\c:\xflllxf.exec:\xflllxf.exe34⤵
- Executes dropped EXE
PID:2716 -
\??\c:\3ntnnh.exec:\3ntnnh.exe35⤵
- Executes dropped EXE
PID:2712 -
\??\c:\dvddv.exec:\dvddv.exe36⤵
- Executes dropped EXE
PID:2764 -
\??\c:\jdjjj.exec:\jdjjj.exe37⤵
- Executes dropped EXE
PID:2688 -
\??\c:\lfffxxx.exec:\lfffxxx.exe38⤵
- Executes dropped EXE
PID:2744 -
\??\c:\hnnbbt.exec:\hnnbbt.exe39⤵
- Executes dropped EXE
PID:2772 -
\??\c:\vdjdd.exec:\vdjdd.exe40⤵
- Executes dropped EXE
PID:2980 -
\??\c:\lxfxrrr.exec:\lxfxrrr.exe41⤵
- Executes dropped EXE
PID:1820 -
\??\c:\7lxffff.exec:\7lxffff.exe42⤵
- Executes dropped EXE
PID:2144 -
\??\c:\nthbtb.exec:\nthbtb.exe43⤵
- Executes dropped EXE
PID:3012 -
\??\c:\dpppj.exec:\dpppj.exe44⤵
- Executes dropped EXE
PID:2200 -
\??\c:\rflffrr.exec:\rflffrr.exe45⤵
- Executes dropped EXE
PID:2488 -
\??\c:\3lxllfl.exec:\3lxllfl.exe46⤵
- Executes dropped EXE
PID:1980 -
\??\c:\nbhhnn.exec:\nbhhnn.exe47⤵
- Executes dropped EXE
PID:1740 -
\??\c:\vjppp.exec:\vjppp.exe48⤵
- Executes dropped EXE
PID:1660 -
\??\c:\3vdpv.exec:\3vdpv.exe49⤵
- Executes dropped EXE
PID:2592 -
\??\c:\3lrlrll.exec:\3lrlrll.exe50⤵
- Executes dropped EXE
PID:784 -
\??\c:\thbttt.exec:\thbttt.exe51⤵
- Executes dropped EXE
PID:2412 -
\??\c:\3ppvp.exec:\3ppvp.exe52⤵
- Executes dropped EXE
PID:2004 -
\??\c:\jddvv.exec:\jddvv.exe53⤵
- Executes dropped EXE
PID:2624 -
\??\c:\lxrrlxx.exec:\lxrrlxx.exe54⤵
- Executes dropped EXE
PID:1920 -
\??\c:\7frrrlf.exec:\7frrrlf.exe55⤵
- Executes dropped EXE
PID:1256 -
\??\c:\7htntn.exec:\7htntn.exe56⤵
- Executes dropped EXE
PID:2148 -
\??\c:\djpjj.exec:\djpjj.exe57⤵
- Executes dropped EXE
PID:2944 -
\??\c:\lrxxfxx.exec:\lrxxfxx.exe58⤵
- Executes dropped EXE
PID:2916 -
\??\c:\7thbbt.exec:\7thbbt.exe59⤵
- Executes dropped EXE
PID:2080 -
\??\c:\hntntn.exec:\hntntn.exe60⤵
- Executes dropped EXE
PID:1200 -
\??\c:\7vpdv.exec:\7vpdv.exe61⤵
- Executes dropped EXE
PID:1876 -
\??\c:\9frllll.exec:\9frllll.exe62⤵
- Executes dropped EXE
PID:968 -
\??\c:\xrxrllf.exec:\xrxrllf.exe63⤵
- Executes dropped EXE
PID:3056 -
\??\c:\9nthtn.exec:\9nthtn.exe64⤵
- Executes dropped EXE
PID:1544 -
\??\c:\dppjp.exec:\dppjp.exe65⤵
- Executes dropped EXE
PID:2184 -
\??\c:\frxxrrr.exec:\frxxrrr.exe66⤵PID:2348
-
\??\c:\bbhhnh.exec:\bbhhnh.exe67⤵PID:2428
-
\??\c:\thnnhb.exec:\thnnhb.exe68⤵PID:2456
-
\??\c:\jpjdd.exec:\jpjdd.exe69⤵PID:2056
-
\??\c:\rxfflfl.exec:\rxfflfl.exe70⤵PID:484
-
\??\c:\flrffxr.exec:\flrffxr.exe71⤵PID:660
-
\??\c:\nthtbt.exec:\nthtbt.exe72⤵PID:2632
-
\??\c:\9dvpv.exec:\9dvpv.exe73⤵PID:1588
-
\??\c:\xrflxrr.exec:\xrflxrr.exe74⤵PID:2884
-
\??\c:\xlfxxlr.exec:\xlfxxlr.exe75⤵PID:2880
-
\??\c:\1nbtht.exec:\1nbtht.exe76⤵PID:2700
-
\??\c:\1vvjj.exec:\1vvjj.exe77⤵PID:2684
-
\??\c:\pjvvv.exec:\pjvvv.exe78⤵PID:2552
-
\??\c:\frfxrlr.exec:\frfxrlr.exe79⤵PID:2596
-
\??\c:\hthhnn.exec:\hthhnn.exe80⤵PID:2532
-
\??\c:\pdpjd.exec:\pdpjd.exe81⤵PID:2088
-
\??\c:\dpdjd.exec:\dpdjd.exe82⤵PID:2968
-
\??\c:\rlllfxf.exec:\rlllfxf.exe83⤵PID:2560
-
\??\c:\thhbtn.exec:\thhbtn.exe84⤵PID:1516
-
\??\c:\hthbhb.exec:\hthbhb.exe85⤵PID:2812
-
\??\c:\dvjpp.exec:\dvjpp.exe86⤵PID:2860
-
\??\c:\pvvvv.exec:\pvvvv.exe87⤵PID:2132
-
\??\c:\rfrllfx.exec:\rfrllfx.exe88⤵PID:2420
-
\??\c:\hnntbn.exec:\hnntbn.exe89⤵PID:2508
-
\??\c:\9ntnhn.exec:\9ntnhn.exe90⤵PID:2760
-
\??\c:\jvpdd.exec:\jvpdd.exe91⤵PID:3000
-
\??\c:\rflxrll.exec:\rflxrll.exe92⤵PID:1308
-
\??\c:\3xxlfxr.exec:\3xxlfxr.exe93⤵PID:1032
-
\??\c:\nnbbnn.exec:\nnbbnn.exe94⤵PID:1168
-
\??\c:\dvdvp.exec:\dvdvp.exe95⤵PID:2808
-
\??\c:\vvvjd.exec:\vvvjd.exe96⤵PID:2108
-
\??\c:\fxfrlfr.exec:\fxfrlfr.exe97⤵PID:2148
-
\??\c:\htbnnh.exec:\htbnnh.exe98⤵PID:2248
-
\??\c:\htbhhb.exec:\htbhhb.exe99⤵PID:1608
-
\??\c:\dpvdv.exec:\dpvdv.exe100⤵PID:2032
-
\??\c:\pjvvp.exec:\pjvvp.exe101⤵PID:2304
-
\??\c:\lxlflff.exec:\lxlflff.exe102⤵PID:2020
-
\??\c:\bhhbbt.exec:\bhhbbt.exe103⤵PID:1760
-
\??\c:\thtnhh.exec:\thtnhh.exe104⤵PID:1376
-
\??\c:\pdjvp.exec:\pdjvp.exe105⤵PID:3032
-
\??\c:\frxxxxl.exec:\frxxxxl.exe106⤵PID:2124
-
\??\c:\xlrlrlr.exec:\xlrlrlr.exe107⤵PID:1952
-
\??\c:\bbnhhh.exec:\bbnhhh.exe108⤵PID:1956
-
\??\c:\pvdvv.exec:\pvdvv.exe109⤵PID:1680
-
\??\c:\5pjdd.exec:\5pjdd.exe110⤵PID:1644
-
\??\c:\rxlxrll.exec:\rxlxrll.exe111⤵PID:1964
-
\??\c:\hntnhh.exec:\hntnhh.exe112⤵PID:3068
-
\??\c:\vjppv.exec:\vjppv.exe113⤵PID:1628
-
\??\c:\jvjjp.exec:\jvjjp.exe114⤵PID:2720
-
\??\c:\lxfffff.exec:\lxfffff.exe115⤵PID:2776
-
\??\c:\nhnhhh.exec:\nhnhhh.exe116⤵PID:2768
-
\??\c:\5bnhhh.exec:\5bnhhh.exe117⤵PID:3044
-
\??\c:\9jdvp.exec:\9jdvp.exe118⤵PID:1720
-
\??\c:\rlxrrrr.exec:\rlxrrrr.exe119⤵PID:2524
-
\??\c:\fxflrrx.exec:\fxflrrx.exe120⤵PID:2600
-
\??\c:\3bhbbb.exec:\3bhbbb.exe121⤵PID:1756
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-