Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-12-2024 02:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
babdfe61f16d62282606d2ea63bdbd4e4993c88c9f7e236bf57adef6c8270c6f.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
babdfe61f16d62282606d2ea63bdbd4e4993c88c9f7e236bf57adef6c8270c6f.exe
-
Size
454KB
-
MD5
b04f96217665277605e62a671869befe
-
SHA1
1e0693f1998cc079e15b6e1d04c41bb745854455
-
SHA256
babdfe61f16d62282606d2ea63bdbd4e4993c88c9f7e236bf57adef6c8270c6f
-
SHA512
624e437313d216e2ffe9535dfa2b66efc75d7019acdd577d5bccaf475de87199617a0ea5f15458b7604aa27618b07e0b9d8f7f70b931adf35e04fd6fcc6d80a0
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe6:q7Tc2NYHUrAwfMp3CD6
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/2100-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2064-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-46-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2792-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1420-137-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1420-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-219-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2912-218-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1520-239-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1520-244-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/980-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/300-270-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1836-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2076-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2484-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2304-344-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2800-368-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2616-371-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2812-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1936-421-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1988-422-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1700-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1708-459-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1628-487-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/584-495-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1480-584-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2224-603-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2244-616-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2948-629-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-642-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1540-670-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2332-681-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/800-770-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1084-1026-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2224-1134-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2100 vpdjv.exe 2500 rlxfrrf.exe 2064 5ttttb.exe 2108 1lrrlll.exe 2348 vpddj.exe 2304 lxllxxl.exe 2792 7rxfxxf.exe 2704 jvdvv.exe 2840 hbtnnh.exe 2676 rlxfflx.exe 2688 3vvvj.exe 2648 5pjpd.exe 2816 hbnthh.exe 1420 dvpjj.exe 1896 5frxlll.exe 1508 1btthh.exe 1648 vdvvd.exe 1636 frflrlr.exe 1152 fxrrllx.exe 2564 bthnnh.exe 2920 9vjjp.exe 2412 3flflff.exe 2912 7dvdj.exe 1096 fxrfllf.exe 2432 7jvdd.exe 1520 9frlxrx.exe 976 hthbhn.exe 980 9btthb.exe 300 vjddv.exe 2476 jdvpd.exe 872 1nbbhh.exe 1836 1rfrrxx.exe 1792 9thhhh.exe 2076 vjdjv.exe 2068 jdvjd.exe 2032 rlxxflr.exe 2484 bnbbhh.exe 2756 nnttnt.exe 2684 1jdjp.exe 2304 rlxxffr.exe 2792 bnbhhb.exe 2948 htbbhb.exe 2800 1pdjp.exe 2616 lxxrxxf.exe 2744 3thbbh.exe 2812 bhbhbt.exe 3016 jvpvd.exe 2648 1lfxffl.exe 1328 5tbthh.exe 1712 tnbhbt.exe 1936 pdpjd.exe 1988 jdppd.exe 1696 1rffllr.exe 1700 nhbbnn.exe 620 vpdpp.exe 1372 vjddj.exe 1708 xrfxlxf.exe 2888 3nhhnt.exe 2428 5nhhtb.exe 2996 5jpvd.exe 1628 lxrxfxl.exe 584 7nhhbn.exe 1296 bnbhnn.exe 2432 dvdvd.exe -
resource yara_rule behavioral1/memory/2100-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1420-137-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1420-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/980-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1836-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-344-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2948-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1988-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/620-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1372-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-487-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/584-495-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-502-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/952-515-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/296-552-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1480-577-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1480-584-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2224-603-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-616-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-629-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-642-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/536-661-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-681-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-742-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-755-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/800-770-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2080-835-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-842-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-849-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-862-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-882-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-928-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-955-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1788-962-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-1000-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1084-1019-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-1039-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-1052-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-1065-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-1078-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrxrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bnhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxrlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2236 wrote to memory of 2100 2236 babdfe61f16d62282606d2ea63bdbd4e4993c88c9f7e236bf57adef6c8270c6f.exe 30 PID 2236 wrote to memory of 2100 2236 babdfe61f16d62282606d2ea63bdbd4e4993c88c9f7e236bf57adef6c8270c6f.exe 30 PID 2236 wrote to memory of 2100 2236 babdfe61f16d62282606d2ea63bdbd4e4993c88c9f7e236bf57adef6c8270c6f.exe 30 PID 2236 wrote to memory of 2100 2236 babdfe61f16d62282606d2ea63bdbd4e4993c88c9f7e236bf57adef6c8270c6f.exe 30 PID 2100 wrote to memory of 2500 2100 vpdjv.exe 31 PID 2100 wrote to memory of 2500 2100 vpdjv.exe 31 PID 2100 wrote to memory of 2500 2100 vpdjv.exe 31 PID 2100 wrote to memory of 2500 2100 vpdjv.exe 31 PID 2500 wrote to memory of 2064 2500 rlxfrrf.exe 32 PID 2500 wrote to memory of 2064 2500 rlxfrrf.exe 32 PID 2500 wrote to memory of 2064 2500 rlxfrrf.exe 32 PID 2500 wrote to memory of 2064 2500 rlxfrrf.exe 32 PID 2064 wrote to memory of 2108 2064 5ttttb.exe 33 PID 2064 wrote to memory of 2108 2064 5ttttb.exe 33 PID 2064 wrote to memory of 2108 2064 5ttttb.exe 33 PID 2064 wrote to memory of 2108 2064 5ttttb.exe 33 PID 2108 wrote to memory of 2348 2108 1lrrlll.exe 34 PID 2108 wrote to memory of 2348 2108 1lrrlll.exe 34 PID 2108 wrote to memory of 2348 2108 1lrrlll.exe 34 PID 2108 wrote to memory of 2348 2108 1lrrlll.exe 34 PID 2348 wrote to memory of 2304 2348 vpddj.exe 35 PID 2348 wrote to memory of 2304 2348 vpddj.exe 35 PID 2348 wrote to memory of 2304 2348 vpddj.exe 35 PID 2348 wrote to memory of 2304 2348 vpddj.exe 35 PID 2304 wrote to memory of 2792 2304 lxllxxl.exe 36 PID 2304 wrote to memory of 2792 2304 lxllxxl.exe 36 PID 2304 wrote to memory of 2792 2304 lxllxxl.exe 36 PID 2304 wrote to memory of 2792 2304 lxllxxl.exe 36 PID 2792 wrote to memory of 2704 2792 7rxfxxf.exe 37 PID 2792 wrote to memory of 2704 2792 7rxfxxf.exe 37 PID 2792 wrote to memory of 2704 2792 7rxfxxf.exe 37 PID 2792 wrote to memory of 2704 2792 7rxfxxf.exe 37 PID 2704 wrote to memory of 2840 2704 jvdvv.exe 38 PID 2704 wrote to memory of 2840 2704 jvdvv.exe 38 PID 2704 wrote to memory of 2840 2704 jvdvv.exe 38 PID 2704 wrote to memory of 2840 2704 jvdvv.exe 38 PID 2840 wrote to memory of 2676 2840 hbtnnh.exe 39 PID 2840 wrote to memory of 2676 2840 hbtnnh.exe 39 PID 2840 wrote to memory of 2676 2840 hbtnnh.exe 39 PID 2840 wrote to memory of 2676 2840 hbtnnh.exe 39 PID 2676 wrote to memory of 2688 2676 rlxfflx.exe 40 PID 2676 wrote to memory of 2688 2676 rlxfflx.exe 40 PID 2676 wrote to memory of 2688 2676 rlxfflx.exe 40 PID 2676 wrote to memory of 2688 2676 rlxfflx.exe 40 PID 2688 wrote to memory of 2648 2688 3vvvj.exe 41 PID 2688 wrote to memory of 2648 2688 3vvvj.exe 41 PID 2688 wrote to memory of 2648 2688 3vvvj.exe 41 PID 2688 wrote to memory of 2648 2688 3vvvj.exe 41 PID 2648 wrote to memory of 2816 2648 5pjpd.exe 42 PID 2648 wrote to memory of 2816 2648 5pjpd.exe 42 PID 2648 wrote to memory of 2816 2648 5pjpd.exe 42 PID 2648 wrote to memory of 2816 2648 5pjpd.exe 42 PID 2816 wrote to memory of 1420 2816 hbnthh.exe 43 PID 2816 wrote to memory of 1420 2816 hbnthh.exe 43 PID 2816 wrote to memory of 1420 2816 hbnthh.exe 43 PID 2816 wrote to memory of 1420 2816 hbnthh.exe 43 PID 1420 wrote to memory of 1896 1420 dvpjj.exe 44 PID 1420 wrote to memory of 1896 1420 dvpjj.exe 44 PID 1420 wrote to memory of 1896 1420 dvpjj.exe 44 PID 1420 wrote to memory of 1896 1420 dvpjj.exe 44 PID 1896 wrote to memory of 1508 1896 5frxlll.exe 45 PID 1896 wrote to memory of 1508 1896 5frxlll.exe 45 PID 1896 wrote to memory of 1508 1896 5frxlll.exe 45 PID 1896 wrote to memory of 1508 1896 5frxlll.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\babdfe61f16d62282606d2ea63bdbd4e4993c88c9f7e236bf57adef6c8270c6f.exe"C:\Users\Admin\AppData\Local\Temp\babdfe61f16d62282606d2ea63bdbd4e4993c88c9f7e236bf57adef6c8270c6f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\vpdjv.exec:\vpdjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\rlxfrrf.exec:\rlxfrrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\5ttttb.exec:\5ttttb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\1lrrlll.exec:\1lrrlll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\vpddj.exec:\vpddj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\lxllxxl.exec:\lxllxxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\7rxfxxf.exec:\7rxfxxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\jvdvv.exec:\jvdvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\hbtnnh.exec:\hbtnnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\rlxfflx.exec:\rlxfflx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\3vvvj.exec:\3vvvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\5pjpd.exec:\5pjpd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\hbnthh.exec:\hbnthh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\dvpjj.exec:\dvpjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
\??\c:\5frxlll.exec:\5frxlll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
\??\c:\1btthh.exec:\1btthh.exe17⤵
- Executes dropped EXE
PID:1508 -
\??\c:\vdvvd.exec:\vdvvd.exe18⤵
- Executes dropped EXE
PID:1648 -
\??\c:\frflrlr.exec:\frflrlr.exe19⤵
- Executes dropped EXE
PID:1636 -
\??\c:\fxrrllx.exec:\fxrrllx.exe20⤵
- Executes dropped EXE
PID:1152 -
\??\c:\bthnnh.exec:\bthnnh.exe21⤵
- Executes dropped EXE
PID:2564 -
\??\c:\9vjjp.exec:\9vjjp.exe22⤵
- Executes dropped EXE
PID:2920 -
\??\c:\3flflff.exec:\3flflff.exe23⤵
- Executes dropped EXE
PID:2412 -
\??\c:\7dvdj.exec:\7dvdj.exe24⤵
- Executes dropped EXE
PID:2912 -
\??\c:\fxrfllf.exec:\fxrfllf.exe25⤵
- Executes dropped EXE
PID:1096 -
\??\c:\7jvdd.exec:\7jvdd.exe26⤵
- Executes dropped EXE
PID:2432 -
\??\c:\9frlxrx.exec:\9frlxrx.exe27⤵
- Executes dropped EXE
PID:1520 -
\??\c:\hthbhn.exec:\hthbhn.exe28⤵
- Executes dropped EXE
PID:976 -
\??\c:\9btthb.exec:\9btthb.exe29⤵
- Executes dropped EXE
PID:980 -
\??\c:\vjddv.exec:\vjddv.exe30⤵
- Executes dropped EXE
PID:300 -
\??\c:\jdvpd.exec:\jdvpd.exe31⤵
- Executes dropped EXE
PID:2476 -
\??\c:\1nbbhh.exec:\1nbbhh.exe32⤵
- Executes dropped EXE
PID:872 -
\??\c:\1rfrrxx.exec:\1rfrrxx.exe33⤵
- Executes dropped EXE
PID:1836 -
\??\c:\9thhhh.exec:\9thhhh.exe34⤵
- Executes dropped EXE
PID:1792 -
\??\c:\vjdjv.exec:\vjdjv.exe35⤵
- Executes dropped EXE
PID:2076 -
\??\c:\jdvjd.exec:\jdvjd.exe36⤵
- Executes dropped EXE
PID:2068 -
\??\c:\rlxxflr.exec:\rlxxflr.exe37⤵
- Executes dropped EXE
PID:2032 -
\??\c:\bnbbhh.exec:\bnbbhh.exe38⤵
- Executes dropped EXE
PID:2484 -
\??\c:\nnttnt.exec:\nnttnt.exe39⤵
- Executes dropped EXE
PID:2756 -
\??\c:\1jdjp.exec:\1jdjp.exe40⤵
- Executes dropped EXE
PID:2684 -
\??\c:\rlxxffr.exec:\rlxxffr.exe41⤵
- Executes dropped EXE
PID:2304 -
\??\c:\bnbhhb.exec:\bnbhhb.exe42⤵
- Executes dropped EXE
PID:2792 -
\??\c:\htbbhb.exec:\htbbhb.exe43⤵
- Executes dropped EXE
PID:2948 -
\??\c:\1pdjp.exec:\1pdjp.exe44⤵
- Executes dropped EXE
PID:2800 -
\??\c:\lxxrxxf.exec:\lxxrxxf.exe45⤵
- Executes dropped EXE
PID:2616 -
\??\c:\3thbbh.exec:\3thbbh.exe46⤵
- Executes dropped EXE
PID:2744 -
\??\c:\bhbhbt.exec:\bhbhbt.exe47⤵
- Executes dropped EXE
PID:2812 -
\??\c:\jvpvd.exec:\jvpvd.exe48⤵
- Executes dropped EXE
PID:3016 -
\??\c:\1lfxffl.exec:\1lfxffl.exe49⤵
- Executes dropped EXE
PID:2648 -
\??\c:\5tbthh.exec:\5tbthh.exe50⤵
- Executes dropped EXE
PID:1328 -
\??\c:\tnbhbt.exec:\tnbhbt.exe51⤵
- Executes dropped EXE
PID:1712 -
\??\c:\pdpjd.exec:\pdpjd.exe52⤵
- Executes dropped EXE
PID:1936 -
\??\c:\jdppd.exec:\jdppd.exe53⤵
- Executes dropped EXE
PID:1988 -
\??\c:\1rffllr.exec:\1rffllr.exe54⤵
- Executes dropped EXE
PID:1696 -
\??\c:\nhbbnn.exec:\nhbbnn.exe55⤵
- Executes dropped EXE
PID:1700 -
\??\c:\vpdpp.exec:\vpdpp.exe56⤵
- Executes dropped EXE
PID:620 -
\??\c:\vjddj.exec:\vjddj.exe57⤵
- Executes dropped EXE
PID:1372 -
\??\c:\xrfxlxf.exec:\xrfxlxf.exe58⤵
- Executes dropped EXE
PID:1708 -
\??\c:\3nhhnt.exec:\3nhhnt.exe59⤵
- Executes dropped EXE
PID:2888 -
\??\c:\5nhhtb.exec:\5nhhtb.exe60⤵
- Executes dropped EXE
PID:2428 -
\??\c:\5jpvd.exec:\5jpvd.exe61⤵
- Executes dropped EXE
PID:2996 -
\??\c:\lxrxfxl.exec:\lxrxfxl.exe62⤵
- Executes dropped EXE
PID:1628 -
\??\c:\7nhhbn.exec:\7nhhbn.exe63⤵
- Executes dropped EXE
PID:584 -
\??\c:\bnbhnn.exec:\bnbhnn.exe64⤵
- Executes dropped EXE
PID:1296 -
\??\c:\dvdvd.exec:\dvdvd.exe65⤵
- Executes dropped EXE
PID:2432 -
\??\c:\rlflrlr.exec:\rlflrlr.exe66⤵PID:3040
-
\??\c:\5xlfllr.exec:\5xlfllr.exe67⤵PID:952
-
\??\c:\9thbbb.exec:\9thbbb.exe68⤵PID:2252
-
\??\c:\vvvdj.exec:\vvvdj.exe69⤵PID:972
-
\??\c:\5dvdv.exec:\5dvdv.exe70⤵PID:2444
-
\??\c:\fxlrxxf.exec:\fxlrxxf.exe71⤵PID:1488
-
\??\c:\1ttbbb.exec:\1ttbbb.exe72⤵PID:2476
-
\??\c:\thbbhn.exec:\thbbhn.exe73⤵PID:296
-
\??\c:\ddvjv.exec:\ddvjv.exe74⤵PID:1588
-
\??\c:\xrlxxfr.exec:\xrlxxfr.exe75⤵PID:2488
-
\??\c:\rrflffr.exec:\rrflffr.exe76⤵PID:2540
-
\??\c:\hbnthh.exec:\hbnthh.exe77⤵PID:1480
-
\??\c:\jjjpv.exec:\jjjpv.exe78⤵PID:1592
-
\??\c:\9rrrffr.exec:\9rrrffr.exe79⤵PID:2188
-
\??\c:\fxrxrrx.exec:\fxrxrrx.exe80⤵
- System Location Discovery: System Language Discovery
PID:2224 -
\??\c:\7nbbhb.exec:\7nbbhb.exe81⤵PID:1476
-
\??\c:\dpddj.exec:\dpddj.exe82⤵PID:2724
-
\??\c:\xrllfxf.exec:\xrllfxf.exe83⤵PID:2244
-
\??\c:\xlrxrll.exec:\xlrxrll.exe84⤵PID:2212
-
\??\c:\btttnn.exec:\btttnn.exe85⤵PID:2948
-
\??\c:\btntbb.exec:\btntbb.exe86⤵PID:2712
-
\??\c:\pjvdj.exec:\pjvdj.exe87⤵PID:2572
-
\??\c:\7rfflrx.exec:\7rfflrx.exe88⤵PID:2640
-
\??\c:\fxllrrf.exec:\fxllrrf.exe89⤵
- System Location Discovery: System Language Discovery
PID:2588 -
\??\c:\nbhntt.exec:\nbhntt.exe90⤵PID:536
-
\??\c:\ppjvd.exec:\ppjvd.exe91⤵PID:1540
-
\??\c:\dpvdd.exec:\dpvdd.exe92⤵PID:2332
-
\??\c:\rlflxfl.exec:\rlflxfl.exe93⤵PID:2336
-
\??\c:\bnttnn.exec:\bnttnn.exe94⤵PID:2004
-
\??\c:\1dppv.exec:\1dppv.exe95⤵PID:1988
-
\??\c:\vpddj.exec:\vpddj.exe96⤵PID:1696
-
\??\c:\frrrfxf.exec:\frrrfxf.exe97⤵PID:1528
-
\??\c:\hthhnn.exec:\hthhnn.exe98⤵PID:1432
-
\??\c:\5thhbt.exec:\5thhbt.exe99⤵PID:1996
-
\??\c:\9jppd.exec:\9jppd.exe100⤵PID:3008
-
\??\c:\frxrrll.exec:\frxrrll.exe101⤵PID:2152
-
\??\c:\xrlrllr.exec:\xrlrllr.exe102⤵PID:2436
-
\??\c:\htbhnb.exec:\htbhnb.exe103⤵PID:2452
-
\??\c:\pdpjp.exec:\pdpjp.exe104⤵PID:1084
-
\??\c:\pjddj.exec:\pjddj.exe105⤵PID:2176
-
\??\c:\frfrrrf.exec:\frfrrrf.exe106⤵PID:1976
-
\??\c:\thnhth.exec:\thnhth.exe107⤵PID:800
-
\??\c:\bnhhtb.exec:\bnhhtb.exe108⤵PID:1524
-
\??\c:\7ppvd.exec:\7ppvd.exe109⤵PID:2828
-
\??\c:\ffrxllr.exec:\ffrxllr.exe110⤵PID:2112
-
\??\c:\9xfflfr.exec:\9xfflfr.exe111⤵PID:796
-
\??\c:\7ttttn.exec:\7ttttn.exe112⤵PID:2276
-
\??\c:\jdpvd.exec:\jdpvd.exe113⤵PID:2468
-
\??\c:\jvjpp.exec:\jvjpp.exe114⤵PID:2388
-
\??\c:\7rflllr.exec:\7rflllr.exe115⤵PID:1184
-
\??\c:\hbbtnn.exec:\hbbtnn.exe116⤵PID:1836
-
\??\c:\dvjjv.exec:\dvjjv.exe117⤵PID:2128
-
\??\c:\9vdvd.exec:\9vdvd.exe118⤵PID:2080
-
\??\c:\fxlllff.exec:\fxlllff.exe119⤵PID:2020
-
\??\c:\tnbbnb.exec:\tnbbnb.exe120⤵PID:1920
-
\??\c:\thbthh.exec:\thbthh.exe121⤵PID:2484
-
\??\c:\vjpvd.exec:\vjpvd.exe122⤵PID:2756
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-