Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-12-2024 00:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8ab6c819841b4f00c3ce622ba2207b2a7c69d68de982542c29c76920aff6f479.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
8ab6c819841b4f00c3ce622ba2207b2a7c69d68de982542c29c76920aff6f479.exe
-
Size
454KB
-
MD5
38b9ab2ef5fdb731341c869d37e0c3d5
-
SHA1
29a435a76c4e72b2ec75ed162b547b5e2a161074
-
SHA256
8ab6c819841b4f00c3ce622ba2207b2a7c69d68de982542c29c76920aff6f479
-
SHA512
df816ad040bb82870b8376662743eed5b27ab062a71452ea6818784f8db068dbc256bb901fbbcb7ba58b6bdab7dea06922e8142146eff7c30b572914bd6cc29b
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeE:q7Tc2NYHUrAwfMp3CDE
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/2884-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2312-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/584-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/372-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/400-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-139-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2944-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1676-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/408-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1724-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1668-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1864-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/996-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/580-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2148-381-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2532-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/680-453-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1604-506-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1804-527-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-581-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-620-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-627-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1860-661-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/816-696-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/1500-741-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2056-766-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1624-825-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-904-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2536-953-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2740 hthbhh.exe 2896 xxlxxfl.exe 3020 hbhbbb.exe 2632 pdjjp.exe 2608 frrxxff.exe 2312 vvvvd.exe 592 1lrrlxx.exe 584 7nttth.exe 372 dpppj.exe 2108 xlxlflx.exe 400 jdpvd.exe 3036 3dppj.exe 2864 ttnttb.exe 2944 pjvpp.exe 2876 rrxfxlf.exe 2776 nnntth.exe 1676 jjvdj.exe 2152 5flfffl.exe 2124 5dppp.exe 2056 lfrrfff.exe 408 nnnhbn.exe 2372 1xxlxlf.exe 1724 btttbb.exe 1912 vvpjd.exe 1804 tnbbbh.exe 1668 jjjjd.exe 616 frfffxx.exe 2120 nhhnbh.exe 1864 xlrlrlx.exe 996 hthhhh.exe 1644 flfxfxf.exe 2476 9thhnh.exe 2696 jddvv.exe 2816 vddvp.exe 2788 bhnbtn.exe 2704 htnnth.exe 3020 9dpjd.exe 2796 xrlxrxx.exe 2664 xlxrlfx.exe 2608 tbhtth.exe 536 1vjvp.exe 796 3rxrlfx.exe 580 fxfrlff.exe 2148 3nnhbb.exe 556 vvpvj.exe 2532 rlrrrrr.exe 2928 lxffxll.exe 1960 7hthbb.exe 3036 jdjjj.exe 468 lxlfxrr.exe 2308 lxrflff.exe 2276 hbhtnb.exe 1132 jvddd.exe 2792 xxlrxrx.exe 680 9lxxrrx.exe 2648 nhnhbb.exe 2212 vpdvv.exe 1108 5xrlxxl.exe 1608 tntthh.exe 2056 vjppp.exe 1956 jdppv.exe 704 flxrrlr.exe 1604 tnbtbb.exe 868 jjvjp.exe -
resource yara_rule behavioral1/memory/2884-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/584-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/372-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/400-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1676-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/408-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/408-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1668-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1864-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/996-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/536-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/580-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/580-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/680-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/680-468-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1604-506-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-519-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-527-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1864-555-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-581-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-620-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/804-634-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/800-647-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1860-661-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/800-670-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-689-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1500-741-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-766-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1392-792-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-825-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-904-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-953-0x00000000002B0000-0x00000000002DA000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbttbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lxffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfxfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfflll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frllxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhtbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2884 wrote to memory of 2740 2884 8ab6c819841b4f00c3ce622ba2207b2a7c69d68de982542c29c76920aff6f479.exe 30 PID 2884 wrote to memory of 2740 2884 8ab6c819841b4f00c3ce622ba2207b2a7c69d68de982542c29c76920aff6f479.exe 30 PID 2884 wrote to memory of 2740 2884 8ab6c819841b4f00c3ce622ba2207b2a7c69d68de982542c29c76920aff6f479.exe 30 PID 2884 wrote to memory of 2740 2884 8ab6c819841b4f00c3ce622ba2207b2a7c69d68de982542c29c76920aff6f479.exe 30 PID 2740 wrote to memory of 2896 2740 hthbhh.exe 31 PID 2740 wrote to memory of 2896 2740 hthbhh.exe 31 PID 2740 wrote to memory of 2896 2740 hthbhh.exe 31 PID 2740 wrote to memory of 2896 2740 hthbhh.exe 31 PID 2896 wrote to memory of 3020 2896 xxlxxfl.exe 32 PID 2896 wrote to memory of 3020 2896 xxlxxfl.exe 32 PID 2896 wrote to memory of 3020 2896 xxlxxfl.exe 32 PID 2896 wrote to memory of 3020 2896 xxlxxfl.exe 32 PID 3020 wrote to memory of 2632 3020 hbhbbb.exe 33 PID 3020 wrote to memory of 2632 3020 hbhbbb.exe 33 PID 3020 wrote to memory of 2632 3020 hbhbbb.exe 33 PID 3020 wrote to memory of 2632 3020 hbhbbb.exe 33 PID 2632 wrote to memory of 2608 2632 pdjjp.exe 34 PID 2632 wrote to memory of 2608 2632 pdjjp.exe 34 PID 2632 wrote to memory of 2608 2632 pdjjp.exe 34 PID 2632 wrote to memory of 2608 2632 pdjjp.exe 34 PID 2608 wrote to memory of 2312 2608 frrxxff.exe 35 PID 2608 wrote to memory of 2312 2608 frrxxff.exe 35 PID 2608 wrote to memory of 2312 2608 frrxxff.exe 35 PID 2608 wrote to memory of 2312 2608 frrxxff.exe 35 PID 2312 wrote to memory of 592 2312 vvvvd.exe 36 PID 2312 wrote to memory of 592 2312 vvvvd.exe 36 PID 2312 wrote to memory of 592 2312 vvvvd.exe 36 PID 2312 wrote to memory of 592 2312 vvvvd.exe 36 PID 592 wrote to memory of 584 592 1lrrlxx.exe 37 PID 592 wrote to memory of 584 592 1lrrlxx.exe 37 PID 592 wrote to memory of 584 592 1lrrlxx.exe 37 PID 592 wrote to memory of 584 592 1lrrlxx.exe 37 PID 584 wrote to memory of 372 584 7nttth.exe 38 PID 584 wrote to memory of 372 584 7nttth.exe 38 PID 584 wrote to memory of 372 584 7nttth.exe 38 PID 584 wrote to memory of 372 584 7nttth.exe 38 PID 372 wrote to memory of 2108 372 dpppj.exe 39 PID 372 wrote to memory of 2108 372 dpppj.exe 39 PID 372 wrote to memory of 2108 372 dpppj.exe 39 PID 372 wrote to memory of 2108 372 dpppj.exe 39 PID 2108 wrote to memory of 400 2108 xlxlflx.exe 40 PID 2108 wrote to memory of 400 2108 xlxlflx.exe 40 PID 2108 wrote to memory of 400 2108 xlxlflx.exe 40 PID 2108 wrote to memory of 400 2108 xlxlflx.exe 40 PID 400 wrote to memory of 3036 400 jdpvd.exe 41 PID 400 wrote to memory of 3036 400 jdpvd.exe 41 PID 400 wrote to memory of 3036 400 jdpvd.exe 41 PID 400 wrote to memory of 3036 400 jdpvd.exe 41 PID 3036 wrote to memory of 2864 3036 3dppj.exe 42 PID 3036 wrote to memory of 2864 3036 3dppj.exe 42 PID 3036 wrote to memory of 2864 3036 3dppj.exe 42 PID 3036 wrote to memory of 2864 3036 3dppj.exe 42 PID 2864 wrote to memory of 2944 2864 ttnttb.exe 43 PID 2864 wrote to memory of 2944 2864 ttnttb.exe 43 PID 2864 wrote to memory of 2944 2864 ttnttb.exe 43 PID 2864 wrote to memory of 2944 2864 ttnttb.exe 43 PID 2944 wrote to memory of 2876 2944 pjvpp.exe 44 PID 2944 wrote to memory of 2876 2944 pjvpp.exe 44 PID 2944 wrote to memory of 2876 2944 pjvpp.exe 44 PID 2944 wrote to memory of 2876 2944 pjvpp.exe 44 PID 2876 wrote to memory of 2776 2876 rrxfxlf.exe 45 PID 2876 wrote to memory of 2776 2876 rrxfxlf.exe 45 PID 2876 wrote to memory of 2776 2876 rrxfxlf.exe 45 PID 2876 wrote to memory of 2776 2876 rrxfxlf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ab6c819841b4f00c3ce622ba2207b2a7c69d68de982542c29c76920aff6f479.exe"C:\Users\Admin\AppData\Local\Temp\8ab6c819841b4f00c3ce622ba2207b2a7c69d68de982542c29c76920aff6f479.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\hthbhh.exec:\hthbhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\xxlxxfl.exec:\xxlxxfl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\hbhbbb.exec:\hbhbbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\pdjjp.exec:\pdjjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\frrxxff.exec:\frrxxff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\vvvvd.exec:\vvvvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\1lrrlxx.exec:\1lrrlxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:592 -
\??\c:\7nttth.exec:\7nttth.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:584 -
\??\c:\dpppj.exec:\dpppj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:372 -
\??\c:\xlxlflx.exec:\xlxlflx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\jdpvd.exec:\jdpvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
\??\c:\3dppj.exec:\3dppj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\ttnttb.exec:\ttnttb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\pjvpp.exec:\pjvpp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\rrxfxlf.exec:\rrxfxlf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\nnntth.exec:\nnntth.exe17⤵
- Executes dropped EXE
PID:2776 -
\??\c:\jjvdj.exec:\jjvdj.exe18⤵
- Executes dropped EXE
PID:1676 -
\??\c:\5flfffl.exec:\5flfffl.exe19⤵
- Executes dropped EXE
PID:2152 -
\??\c:\5dppp.exec:\5dppp.exe20⤵
- Executes dropped EXE
PID:2124 -
\??\c:\lfrrfff.exec:\lfrrfff.exe21⤵
- Executes dropped EXE
PID:2056 -
\??\c:\nnnhbn.exec:\nnnhbn.exe22⤵
- Executes dropped EXE
PID:408 -
\??\c:\1xxlxlf.exec:\1xxlxlf.exe23⤵
- Executes dropped EXE
PID:2372 -
\??\c:\btttbb.exec:\btttbb.exe24⤵
- Executes dropped EXE
PID:1724 -
\??\c:\vvpjd.exec:\vvpjd.exe25⤵
- Executes dropped EXE
PID:1912 -
\??\c:\tnbbbh.exec:\tnbbbh.exe26⤵
- Executes dropped EXE
PID:1804 -
\??\c:\jjjjd.exec:\jjjjd.exe27⤵
- Executes dropped EXE
PID:1668 -
\??\c:\frfffxx.exec:\frfffxx.exe28⤵
- Executes dropped EXE
PID:616 -
\??\c:\nhhnbh.exec:\nhhnbh.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2120 -
\??\c:\xlrlrlx.exec:\xlrlrlx.exe30⤵
- Executes dropped EXE
PID:1864 -
\??\c:\hthhhh.exec:\hthhhh.exe31⤵
- Executes dropped EXE
PID:996 -
\??\c:\flfxfxf.exec:\flfxfxf.exe32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1644 -
\??\c:\9thhnh.exec:\9thhnh.exe33⤵
- Executes dropped EXE
PID:2476 -
\??\c:\jddvv.exec:\jddvv.exe34⤵
- Executes dropped EXE
PID:2696 -
\??\c:\vddvp.exec:\vddvp.exe35⤵
- Executes dropped EXE
PID:2816 -
\??\c:\bhnbtn.exec:\bhnbtn.exe36⤵
- Executes dropped EXE
PID:2788 -
\??\c:\htnnth.exec:\htnnth.exe37⤵
- Executes dropped EXE
PID:2704 -
\??\c:\9dpjd.exec:\9dpjd.exe38⤵
- Executes dropped EXE
PID:3020 -
\??\c:\xrlxrxx.exec:\xrlxrxx.exe39⤵
- Executes dropped EXE
PID:2796 -
\??\c:\xlxrlfx.exec:\xlxrlfx.exe40⤵
- Executes dropped EXE
PID:2664 -
\??\c:\tbhtth.exec:\tbhtth.exe41⤵
- Executes dropped EXE
PID:2608 -
\??\c:\1vjvp.exec:\1vjvp.exe42⤵
- Executes dropped EXE
PID:536 -
\??\c:\3rxrlfx.exec:\3rxrlfx.exe43⤵
- Executes dropped EXE
PID:796 -
\??\c:\fxfrlff.exec:\fxfrlff.exe44⤵
- Executes dropped EXE
PID:580 -
\??\c:\3nnhbb.exec:\3nnhbb.exe45⤵
- Executes dropped EXE
PID:2148 -
\??\c:\vvpvj.exec:\vvpvj.exe46⤵
- Executes dropped EXE
PID:556 -
\??\c:\rlrrrrr.exec:\rlrrrrr.exe47⤵
- Executes dropped EXE
PID:2532 -
\??\c:\lxffxll.exec:\lxffxll.exe48⤵
- Executes dropped EXE
PID:2928 -
\??\c:\7hthbb.exec:\7hthbb.exe49⤵
- Executes dropped EXE
PID:1960 -
\??\c:\jdjjj.exec:\jdjjj.exe50⤵
- Executes dropped EXE
PID:3036 -
\??\c:\lxlfxrr.exec:\lxlfxrr.exe51⤵
- Executes dropped EXE
PID:468 -
\??\c:\lxrflff.exec:\lxrflff.exe52⤵
- Executes dropped EXE
PID:2308 -
\??\c:\hbhtnb.exec:\hbhtnb.exe53⤵
- Executes dropped EXE
PID:2276 -
\??\c:\jvddd.exec:\jvddd.exe54⤵
- Executes dropped EXE
PID:1132 -
\??\c:\xxlrxrx.exec:\xxlrxrx.exe55⤵
- Executes dropped EXE
PID:2792 -
\??\c:\9lxxrrx.exec:\9lxxrrx.exe56⤵
- Executes dropped EXE
PID:680 -
\??\c:\nhnhbb.exec:\nhnhbb.exe57⤵
- Executes dropped EXE
PID:2648 -
\??\c:\vpdvv.exec:\vpdvv.exe58⤵
- Executes dropped EXE
PID:2212 -
\??\c:\5xrlxxl.exec:\5xrlxxl.exe59⤵
- Executes dropped EXE
PID:1108 -
\??\c:\tntthh.exec:\tntthh.exe60⤵
- Executes dropped EXE
PID:1608 -
\??\c:\vjppp.exec:\vjppp.exe61⤵
- Executes dropped EXE
PID:2056 -
\??\c:\jdppv.exec:\jdppv.exe62⤵
- Executes dropped EXE
PID:1956 -
\??\c:\flxrrlr.exec:\flxrrlr.exe63⤵
- Executes dropped EXE
PID:704 -
\??\c:\tnbtbb.exec:\tnbtbb.exe64⤵
- Executes dropped EXE
PID:1604 -
\??\c:\jjvjp.exec:\jjvjp.exe65⤵
- Executes dropped EXE
PID:868 -
\??\c:\xfrfxlr.exec:\xfrfxlr.exe66⤵PID:1908
-
\??\c:\fxxxxrr.exec:\fxxxxrr.exe67⤵PID:1804
-
\??\c:\hbhntt.exec:\hbhntt.exe68⤵PID:2196
-
\??\c:\7ddjj.exec:\7ddjj.exe69⤵PID:2012
-
\??\c:\3fllrlr.exec:\3fllrlr.exe70⤵PID:2428
-
\??\c:\9thbbt.exec:\9thbbt.exe71⤵PID:2384
-
\??\c:\7dvvd.exec:\7dvvd.exe72⤵PID:1864
-
\??\c:\djppd.exec:\djppd.exe73⤵PID:1636
-
\??\c:\lxxrxrx.exec:\lxxrxrx.exe74⤵PID:1796
-
\??\c:\7ttnnh.exec:\7ttnnh.exe75⤵PID:2452
-
\??\c:\pjpjj.exec:\pjpjj.exe76⤵PID:3068
-
\??\c:\jvjpj.exec:\jvjpj.exe77⤵PID:2804
-
\??\c:\rfllrrx.exec:\rfllrrx.exe78⤵PID:2712
-
\??\c:\hbhhnh.exec:\hbhhnh.exe79⤵PID:2748
-
\??\c:\pdppv.exec:\pdppv.exe80⤵PID:2896
-
\??\c:\jdjdv.exec:\jdjdv.exe81⤵PID:3020
-
\??\c:\fxflxxl.exec:\fxflxxl.exe82⤵PID:2756
-
\??\c:\tbnhhb.exec:\tbnhhb.exe83⤵PID:2368
-
\??\c:\5thhbh.exec:\5thhbh.exe84⤵PID:804
-
\??\c:\pjvvv.exec:\pjvvv.exe85⤵PID:320
-
\??\c:\xrxxffr.exec:\xrxxffr.exe86⤵PID:800
-
\??\c:\9btttt.exec:\9btttt.exe87⤵PID:580
-
\??\c:\bnbbhn.exec:\bnbbhn.exe88⤵PID:1860
-
\??\c:\9dppv.exec:\9dppv.exe89⤵PID:816
-
\??\c:\3lffllr.exec:\3lffllr.exe90⤵PID:1968
-
\??\c:\fxrrxxr.exec:\fxrrxxr.exe91⤵PID:2972
-
\??\c:\tnbtbb.exec:\tnbtbb.exe92⤵PID:3008
-
\??\c:\9vdvv.exec:\9vdvv.exe93⤵PID:3036
-
\??\c:\lfllrrf.exec:\lfllrrf.exe94⤵PID:2908
-
\??\c:\lxlxrrr.exec:\lxlxrrr.exe95⤵PID:2308
-
\??\c:\bthnnn.exec:\bthnnn.exe96⤵PID:2276
-
\??\c:\dpddj.exec:\dpddj.exe97⤵PID:1132
-
\??\c:\xrxlxrf.exec:\xrxlxrf.exe98⤵PID:2136
-
\??\c:\rfxrrlr.exec:\rfxrrlr.exe99⤵PID:1500
-
\??\c:\3btbhn.exec:\3btbhn.exe100⤵PID:2356
-
\??\c:\dvddp.exec:\dvddp.exe101⤵PID:2036
-
\??\c:\pjvjj.exec:\pjvjj.exe102⤵PID:844
-
\??\c:\llxxflr.exec:\llxxflr.exe103⤵PID:1900
-
\??\c:\tnhtbb.exec:\tnhtbb.exe104⤵PID:2056
-
\??\c:\pjddj.exec:\pjddj.exe105⤵PID:2552
-
\??\c:\jjppj.exec:\jjppj.exe106⤵PID:1328
-
\??\c:\ffrlxrx.exec:\ffrlxrx.exe107⤵PID:2364
-
\??\c:\1bbntb.exec:\1bbntb.exe108⤵PID:1392
-
\??\c:\htnttt.exec:\htnttt.exe109⤵PID:1912
-
\??\c:\vvjvv.exec:\vvjvv.exe110⤵PID:852
-
\??\c:\9fxxxxf.exec:\9fxxxxf.exe111⤵PID:924
-
\??\c:\9btnhh.exec:\9btnhh.exe112⤵PID:1624
-
\??\c:\7bhbhb.exec:\7bhbhb.exe113⤵PID:1736
-
\??\c:\vdjdv.exec:\vdjdv.exe114⤵PID:2100
-
\??\c:\fxllfxl.exec:\fxllfxl.exe115⤵PID:1664
-
\??\c:\btbntt.exec:\btbntt.exe116⤵PID:2164
-
\??\c:\nhttbb.exec:\nhttbb.exe117⤵PID:1896
-
\??\c:\jvpdd.exec:\jvpdd.exe118⤵PID:1248
-
\??\c:\3fllrrx.exec:\3fllrrx.exe119⤵PID:2476
-
\??\c:\9rfxlfx.exec:\9rfxlfx.exe120⤵PID:1872
-
\??\c:\nhttbb.exec:\nhttbb.exe121⤵PID:2732
-
\??\c:\vpdvv.exec:\vpdvv.exe122⤵PID:2712
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-