Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-12-2024 01:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9f810998df6102e7d45fbac65130610cded309b6566c82dbff3508e8268c33f7.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
9f810998df6102e7d45fbac65130610cded309b6566c82dbff3508e8268c33f7.exe
-
Size
454KB
-
MD5
7da8d92eb3239e2873cf55d9f78f7ddf
-
SHA1
b5c1e180310c363376c267f6a43782a692b5b605
-
SHA256
9f810998df6102e7d45fbac65130610cded309b6566c82dbff3508e8268c33f7
-
SHA512
6e7a6290916e0cace2e773c3ae5209117ef4bacc7cf9eb12a33ef4ae895af297fbf97df131e4caa707ddc4c17eafe3e4bcbfe4f5806f1c2a6562a02172d5e19f
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbet7:q7Tc2NYHUrAwfMp3CDt7
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/2468-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2136-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-62-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2616-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/888-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1280-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2420-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2020-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/620-165-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1304-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/620-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1660-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-222-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1688-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2012-240-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2036-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/920-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/380-298-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2732-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1596-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1908-365-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1908-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/800-384-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1080-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-427-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2032-434-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1548-437-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/548-487-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1660-501-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-619-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-628-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2464-676-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2004-697-0x0000000001C50000-0x0000000001C7A000-memory.dmp family_blackmoon behavioral1/memory/2928-904-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2720-917-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1660-1065-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2512-1129-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1000-1140-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2892-1165-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2468 hhtbhh.exe 2880 5pppp.exe 2760 rxfrxxr.exe 2724 tthbhh.exe 2976 fxffffl.exe 2908 bnbbbt.exe 2616 llxxxxl.exe 1744 bnbntb.exe 2648 3rllrxf.exe 888 rlfllfl.exe 2056 ddpvd.exe 1812 lfllrrr.exe 1280 jdjjv.exe 2836 rffxrfl.exe 2420 hnbntt.exe 2816 9dppp.exe 2020 ttnnbb.exe 620 1jvpp.exe 1304 ddpvd.exe 2488 xlxxxrx.exe 2076 llxxffr.exe 1660 thnnnt.exe 2012 llrlrxl.exe 2500 xxflfxr.exe 1688 jpvvp.exe 1540 fxllrrx.exe 2308 ttbbtt.exe 920 jdjdd.exe 2036 rlxrrrx.exe 2156 thtthn.exe 2512 rfllffr.exe 1044 5bhbbh.exe 380 7pdjj.exe 2800 rlxrllx.exe 2316 bnhhnn.exe 2712 3bnhhh.exe 2732 pvddv.exe 1596 lfrrffl.exe 2992 5bbhbh.exe 2168 bbntnn.exe 2780 ddvvp.exe 2600 lxrlllf.exe 1908 frlfxrr.exe 3068 hhnhnn.exe 800 3vpjd.exe 2428 ffrrxxf.exe 1080 3lfxxxx.exe 2956 nhtbhn.exe 476 dvpjj.exe 2840 dvjdj.exe 2796 llxrxrx.exe 2032 thnhnh.exe 1548 ppdjv.exe 2340 rlrlrxf.exe 2020 ffrrfxl.exe 832 hhbtnn.exe 356 ddjvp.exe 2280 rffxxrx.exe 1816 3bbnhb.exe 548 dvjjv.exe 448 ddppv.exe 1660 1frrrrl.exe 1356 nbnhhh.exe 1952 hhhbtb.exe -
resource yara_rule behavioral1/memory/2468-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/888-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1280-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1304-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/620-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/920-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1596-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/800-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1080-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/548-487-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-501-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1576-527-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1164-540-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-619-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-697-0x0000000001C50000-0x0000000001C7A000-memory.dmp upx behavioral1/memory/2840-722-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-819-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1036-837-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-917-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-924-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-967-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-974-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-988-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-1014-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-1174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-1179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-1192-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bbnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlflxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfxxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ttnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nhbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlfffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxflrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhttbh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2136 wrote to memory of 2468 2136 9f810998df6102e7d45fbac65130610cded309b6566c82dbff3508e8268c33f7.exe 30 PID 2136 wrote to memory of 2468 2136 9f810998df6102e7d45fbac65130610cded309b6566c82dbff3508e8268c33f7.exe 30 PID 2136 wrote to memory of 2468 2136 9f810998df6102e7d45fbac65130610cded309b6566c82dbff3508e8268c33f7.exe 30 PID 2136 wrote to memory of 2468 2136 9f810998df6102e7d45fbac65130610cded309b6566c82dbff3508e8268c33f7.exe 30 PID 2468 wrote to memory of 2880 2468 hhtbhh.exe 31 PID 2468 wrote to memory of 2880 2468 hhtbhh.exe 31 PID 2468 wrote to memory of 2880 2468 hhtbhh.exe 31 PID 2468 wrote to memory of 2880 2468 hhtbhh.exe 31 PID 2880 wrote to memory of 2760 2880 5pppp.exe 32 PID 2880 wrote to memory of 2760 2880 5pppp.exe 32 PID 2880 wrote to memory of 2760 2880 5pppp.exe 32 PID 2880 wrote to memory of 2760 2880 5pppp.exe 32 PID 2760 wrote to memory of 2724 2760 rxfrxxr.exe 33 PID 2760 wrote to memory of 2724 2760 rxfrxxr.exe 33 PID 2760 wrote to memory of 2724 2760 rxfrxxr.exe 33 PID 2760 wrote to memory of 2724 2760 rxfrxxr.exe 33 PID 2724 wrote to memory of 2976 2724 tthbhh.exe 34 PID 2724 wrote to memory of 2976 2724 tthbhh.exe 34 PID 2724 wrote to memory of 2976 2724 tthbhh.exe 34 PID 2724 wrote to memory of 2976 2724 tthbhh.exe 34 PID 2976 wrote to memory of 2908 2976 fxffffl.exe 35 PID 2976 wrote to memory of 2908 2976 fxffffl.exe 35 PID 2976 wrote to memory of 2908 2976 fxffffl.exe 35 PID 2976 wrote to memory of 2908 2976 fxffffl.exe 35 PID 2908 wrote to memory of 2616 2908 bnbbbt.exe 36 PID 2908 wrote to memory of 2616 2908 bnbbbt.exe 36 PID 2908 wrote to memory of 2616 2908 bnbbbt.exe 36 PID 2908 wrote to memory of 2616 2908 bnbbbt.exe 36 PID 2616 wrote to memory of 1744 2616 llxxxxl.exe 37 PID 2616 wrote to memory of 1744 2616 llxxxxl.exe 37 PID 2616 wrote to memory of 1744 2616 llxxxxl.exe 37 PID 2616 wrote to memory of 1744 2616 llxxxxl.exe 37 PID 1744 wrote to memory of 2648 1744 bnbntb.exe 38 PID 1744 wrote to memory of 2648 1744 bnbntb.exe 38 PID 1744 wrote to memory of 2648 1744 bnbntb.exe 38 PID 1744 wrote to memory of 2648 1744 bnbntb.exe 38 PID 2648 wrote to memory of 888 2648 3rllrxf.exe 39 PID 2648 wrote to memory of 888 2648 3rllrxf.exe 39 PID 2648 wrote to memory of 888 2648 3rllrxf.exe 39 PID 2648 wrote to memory of 888 2648 3rllrxf.exe 39 PID 888 wrote to memory of 2056 888 rlfllfl.exe 40 PID 888 wrote to memory of 2056 888 rlfllfl.exe 40 PID 888 wrote to memory of 2056 888 rlfllfl.exe 40 PID 888 wrote to memory of 2056 888 rlfllfl.exe 40 PID 2056 wrote to memory of 1812 2056 ddpvd.exe 41 PID 2056 wrote to memory of 1812 2056 ddpvd.exe 41 PID 2056 wrote to memory of 1812 2056 ddpvd.exe 41 PID 2056 wrote to memory of 1812 2056 ddpvd.exe 41 PID 1812 wrote to memory of 1280 1812 lfllrrr.exe 42 PID 1812 wrote to memory of 1280 1812 lfllrrr.exe 42 PID 1812 wrote to memory of 1280 1812 lfllrrr.exe 42 PID 1812 wrote to memory of 1280 1812 lfllrrr.exe 42 PID 1280 wrote to memory of 2836 1280 jdjjv.exe 43 PID 1280 wrote to memory of 2836 1280 jdjjv.exe 43 PID 1280 wrote to memory of 2836 1280 jdjjv.exe 43 PID 1280 wrote to memory of 2836 1280 jdjjv.exe 43 PID 2836 wrote to memory of 2420 2836 rffxrfl.exe 44 PID 2836 wrote to memory of 2420 2836 rffxrfl.exe 44 PID 2836 wrote to memory of 2420 2836 rffxrfl.exe 44 PID 2836 wrote to memory of 2420 2836 rffxrfl.exe 44 PID 2420 wrote to memory of 2816 2420 hnbntt.exe 45 PID 2420 wrote to memory of 2816 2420 hnbntt.exe 45 PID 2420 wrote to memory of 2816 2420 hnbntt.exe 45 PID 2420 wrote to memory of 2816 2420 hnbntt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\9f810998df6102e7d45fbac65130610cded309b6566c82dbff3508e8268c33f7.exe"C:\Users\Admin\AppData\Local\Temp\9f810998df6102e7d45fbac65130610cded309b6566c82dbff3508e8268c33f7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\hhtbhh.exec:\hhtbhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\5pppp.exec:\5pppp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\rxfrxxr.exec:\rxfrxxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\tthbhh.exec:\tthbhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\fxffffl.exec:\fxffffl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\bnbbbt.exec:\bnbbbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\llxxxxl.exec:\llxxxxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\bnbntb.exec:\bnbntb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
\??\c:\3rllrxf.exec:\3rllrxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\rlfllfl.exec:\rlfllfl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
\??\c:\ddpvd.exec:\ddpvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\lfllrrr.exec:\lfllrrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\jdjjv.exec:\jdjjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
\??\c:\rffxrfl.exec:\rffxrfl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\hnbntt.exec:\hnbntt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\9dppp.exec:\9dppp.exe17⤵
- Executes dropped EXE
PID:2816 -
\??\c:\ttnnbb.exec:\ttnnbb.exe18⤵
- Executes dropped EXE
PID:2020 -
\??\c:\1jvpp.exec:\1jvpp.exe19⤵
- Executes dropped EXE
PID:620 -
\??\c:\ddpvd.exec:\ddpvd.exe20⤵
- Executes dropped EXE
PID:1304 -
\??\c:\xlxxxrx.exec:\xlxxxrx.exe21⤵
- Executes dropped EXE
PID:2488 -
\??\c:\llxxffr.exec:\llxxffr.exe22⤵
- Executes dropped EXE
PID:2076 -
\??\c:\thnnnt.exec:\thnnnt.exe23⤵
- Executes dropped EXE
PID:1660 -
\??\c:\llrlrxl.exec:\llrlrxl.exe24⤵
- Executes dropped EXE
PID:2012 -
\??\c:\xxflfxr.exec:\xxflfxr.exe25⤵
- Executes dropped EXE
PID:2500 -
\??\c:\jpvvp.exec:\jpvvp.exe26⤵
- Executes dropped EXE
PID:1688 -
\??\c:\fxllrrx.exec:\fxllrrx.exe27⤵
- Executes dropped EXE
PID:1540 -
\??\c:\ttbbtt.exec:\ttbbtt.exe28⤵
- Executes dropped EXE
PID:2308 -
\??\c:\jdjdd.exec:\jdjdd.exe29⤵
- Executes dropped EXE
PID:920 -
\??\c:\rlxrrrx.exec:\rlxrrrx.exe30⤵
- Executes dropped EXE
PID:2036 -
\??\c:\thtthn.exec:\thtthn.exe31⤵
- Executes dropped EXE
PID:2156 -
\??\c:\rfllffr.exec:\rfllffr.exe32⤵
- Executes dropped EXE
PID:2512 -
\??\c:\5bhbbh.exec:\5bhbbh.exe33⤵
- Executes dropped EXE
PID:1044 -
\??\c:\7pdjj.exec:\7pdjj.exe34⤵
- Executes dropped EXE
PID:380 -
\??\c:\rlxrllx.exec:\rlxrllx.exe35⤵
- Executes dropped EXE
PID:2800 -
\??\c:\bnhhnn.exec:\bnhhnn.exe36⤵
- Executes dropped EXE
PID:2316 -
\??\c:\3bnhhh.exec:\3bnhhh.exe37⤵
- Executes dropped EXE
PID:2712 -
\??\c:\pvddv.exec:\pvddv.exe38⤵
- Executes dropped EXE
PID:2732 -
\??\c:\lfrrffl.exec:\lfrrffl.exe39⤵
- Executes dropped EXE
PID:1596 -
\??\c:\5bbhbh.exec:\5bbhbh.exe40⤵
- Executes dropped EXE
PID:2992 -
\??\c:\bbntnn.exec:\bbntnn.exe41⤵
- Executes dropped EXE
PID:2168 -
\??\c:\ddvvp.exec:\ddvvp.exe42⤵
- Executes dropped EXE
PID:2780 -
\??\c:\lxrlllf.exec:\lxrlllf.exe43⤵
- Executes dropped EXE
PID:2600 -
\??\c:\frlfxrr.exec:\frlfxrr.exe44⤵
- Executes dropped EXE
PID:1908 -
\??\c:\hhnhnn.exec:\hhnhnn.exe45⤵
- Executes dropped EXE
PID:3068 -
\??\c:\3vpjd.exec:\3vpjd.exe46⤵
- Executes dropped EXE
PID:800 -
\??\c:\ffrrxxf.exec:\ffrrxxf.exe47⤵
- Executes dropped EXE
PID:2428 -
\??\c:\3lfxxxx.exec:\3lfxxxx.exe48⤵
- Executes dropped EXE
PID:1080 -
\??\c:\nhtbhn.exec:\nhtbhn.exe49⤵
- Executes dropped EXE
PID:2956 -
\??\c:\dvpjj.exec:\dvpjj.exe50⤵
- Executes dropped EXE
PID:476 -
\??\c:\dvjdj.exec:\dvjdj.exe51⤵
- Executes dropped EXE
PID:2840 -
\??\c:\llxrxrx.exec:\llxrxrx.exe52⤵
- Executes dropped EXE
PID:2796 -
\??\c:\thnhnh.exec:\thnhnh.exe53⤵
- Executes dropped EXE
PID:2032 -
\??\c:\ppdjv.exec:\ppdjv.exe54⤵
- Executes dropped EXE
PID:1548 -
\??\c:\rlrlrxf.exec:\rlrlrxf.exe55⤵
- Executes dropped EXE
PID:2340 -
\??\c:\ffrrfxl.exec:\ffrrfxl.exe56⤵
- Executes dropped EXE
PID:2020 -
\??\c:\hhbtnn.exec:\hhbtnn.exe57⤵
- Executes dropped EXE
PID:832 -
\??\c:\ddjvp.exec:\ddjvp.exe58⤵
- Executes dropped EXE
PID:356 -
\??\c:\rffxxrx.exec:\rffxxrx.exe59⤵
- Executes dropped EXE
PID:2280 -
\??\c:\3bbnhb.exec:\3bbnhb.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1816 -
\??\c:\dvjjv.exec:\dvjjv.exe61⤵
- Executes dropped EXE
PID:548 -
\??\c:\ddppv.exec:\ddppv.exe62⤵
- Executes dropped EXE
PID:448 -
\??\c:\1frrrrl.exec:\1frrrrl.exe63⤵
- Executes dropped EXE
PID:1660 -
\??\c:\nbnhhh.exec:\nbnhhh.exe64⤵
- Executes dropped EXE
PID:1356 -
\??\c:\hhhbtb.exec:\hhhbtb.exe65⤵
- Executes dropped EXE
PID:1952 -
\??\c:\vpvjj.exec:\vpvjj.exe66⤵PID:2300
-
\??\c:\rlxlflr.exec:\rlxlflr.exe67⤵PID:860
-
\??\c:\lrfrffr.exec:\lrfrffr.exe68⤵PID:1576
-
\??\c:\tnbbbh.exec:\tnbbbh.exe69⤵PID:948
-
\??\c:\9vddj.exec:\9vddj.exe70⤵PID:1164
-
\??\c:\pjpjj.exec:\pjpjj.exe71⤵PID:2244
-
\??\c:\5xfxxrx.exec:\5xfxxrx.exe72⤵PID:1036
-
\??\c:\bnbhnh.exec:\bnbhnh.exe73⤵PID:284
-
\??\c:\jjvdj.exec:\jjvdj.exe74⤵PID:1040
-
\??\c:\7vdvv.exec:\7vdvv.exe75⤵PID:2408
-
\??\c:\5rfxxrx.exec:\5rfxxrx.exe76⤵PID:2416
-
\??\c:\thtnnn.exec:\thtnnn.exe77⤵PID:2444
-
\??\c:\hntnhh.exec:\hntnhh.exe78⤵PID:2860
-
\??\c:\vjvvj.exec:\vjvvj.exe79⤵PID:2316
-
\??\c:\lrrllfr.exec:\lrrllfr.exe80⤵PID:2864
-
\??\c:\xlflrrx.exec:\xlflrrx.exe81⤵PID:3008
-
\??\c:\bttnhn.exec:\bttnhn.exe82⤵PID:2928
-
\??\c:\jjvdp.exec:\jjvdp.exe83⤵PID:2196
-
\??\c:\frffflx.exec:\frffflx.exe84⤵PID:2976
-
\??\c:\xxffrxx.exec:\xxffrxx.exe85⤵PID:2744
-
\??\c:\3tbhhh.exec:\3tbhhh.exe86⤵PID:2664
-
\??\c:\ddpvd.exec:\ddpvd.exe87⤵PID:2620
-
\??\c:\llfxllr.exec:\llfxllr.exe88⤵PID:1944
-
\??\c:\xrxxrrx.exec:\xrxxrrx.exe89⤵PID:2456
-
\??\c:\7bnhbt.exec:\7bnhbt.exe90⤵PID:2208
-
\??\c:\vjvvj.exec:\vjvvj.exe91⤵PID:2464
-
\??\c:\jdppd.exec:\jdppd.exe92⤵PID:664
-
\??\c:\lxfxlff.exec:\lxfxlff.exe93⤵PID:2144
-
\??\c:\9tbnnh.exec:\9tbnnh.exe94⤵PID:1832
-
\??\c:\9bbbhh.exec:\9bbbhh.exe95⤵PID:2004
-
\??\c:\1xlrrlr.exec:\1xlrrlr.exe96⤵PID:2840
-
\??\c:\frxxxfl.exec:\frxxxfl.exe97⤵PID:2352
-
\??\c:\hththh.exec:\hththh.exe98⤵PID:1420
-
\??\c:\pjpvd.exec:\pjpvd.exe99⤵PID:1548
-
\??\c:\pjvdv.exec:\pjvdv.exe100⤵PID:2816
-
\??\c:\rfrlrxl.exec:\rfrlrxl.exe101⤵PID:1632
-
\??\c:\3ntbhb.exec:\3ntbhb.exe102⤵PID:1620
-
\??\c:\1jddd.exec:\1jddd.exe103⤵PID:544
-
\??\c:\vpjjv.exec:\vpjjv.exe104⤵PID:2904
-
\??\c:\rrlrxxr.exec:\rrlrxxr.exe105⤵PID:1864
-
\??\c:\5hhbtt.exec:\5hhbtt.exe106⤵PID:2200
-
\??\c:\nhbhtt.exec:\nhbhtt.exe107⤵PID:820
-
\??\c:\jvjvv.exec:\jvjvv.exe108⤵PID:1244
-
\??\c:\7dppp.exec:\7dppp.exe109⤵PID:1608
-
\??\c:\llxxxfx.exec:\llxxxfx.exe110⤵PID:1640
-
\??\c:\bnbthb.exec:\bnbthb.exe111⤵PID:1780
-
\??\c:\7jdvv.exec:\7jdvv.exe112⤵PID:1760
-
\??\c:\jvddp.exec:\jvddp.exe113⤵PID:860
-
\??\c:\7rxrlll.exec:\7rxrlll.exe114⤵PID:3044
-
\??\c:\bnbbbb.exec:\bnbbbb.exe115⤵PID:568
-
\??\c:\tnnhtt.exec:\tnnhtt.exe116⤵PID:1568
-
\??\c:\jdvdv.exec:\jdvdv.exe117⤵PID:1892
-
\??\c:\lxxlrff.exec:\lxxlrff.exe118⤵PID:1036
-
\??\c:\3tnttt.exec:\3tnttt.exe119⤵PID:284
-
\??\c:\tbtnnn.exec:\tbtnnn.exe120⤵PID:1040
-
\??\c:\3vppp.exec:\3vppp.exe121⤵PID:2408
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-